Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
12/07/2023, 11:43
General
-
Target
AnyDesk.exe
-
Size
3.9MB
-
MD5
bca01af10aac7833188c47d7fec17196
-
SHA1
7f7898da333b924bd358aeb9936a944eb8bf3c09
-
SHA256
734f3577aa453fe8e89d6f351a382474a5dab97204aff1e194eee4e9fdff0a4a
-
SHA512
4429536226a6f3e72d008525c99bc0e676973be04670f7bb49f93ad20e7c8957ceb945c9eeea3ff47e6a751525976b0f4702e90d682940d225d6cb82a6567032
-
SSDEEP
49152:6ZeC+Xpi5ZnHuNO7HrDequJVU6GTTC/gZAjj4agcXz75rtelRqEiruLh3fZlTP5t:cpfn7HruwEk00agcD7fkRX6uRfZrnAnC
Malware Config
Signatures
-
Drops file in System32 directory 15 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 6 IoCs
-
Suspicious use of SendNotifyMessage 6 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-service2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --backend3⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-control2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4fc 0x3d41⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
385KB
MD51ce7d5a1566c8c449d0f6772a8c27900
SHA160854185f6338e1bfc7497fd41aa44c5c00d8f85
SHA25673170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264bb8ffaf
SHA5127e3411be8614170ae91db1626c452997dc6db663d79130872a124af982ee1d457cefba00abd7f5269adce3052403be31238aecc3934c7379d224cb792d519753
-
Filesize
9KB
MD589de90efcdad526bf8bbbd6b2d501009
SHA1c815e8121b5e2d13f2f11deff659ba58203f8a98
SHA256393219d3470506a5aa1d517b3b91739541aee5c97f830673ed1d9d2b5da746cc
SHA512b1efc8df4459b42363cbd4eecb84f661879279cd9be06d595c1cdb03b1a5286b238545fcf67aac623f03720ad8451c46bff3baea80cd10e35eb500acec4c032b
-
Filesize
9KB
MD589de90efcdad526bf8bbbd6b2d501009
SHA1c815e8121b5e2d13f2f11deff659ba58203f8a98
SHA256393219d3470506a5aa1d517b3b91739541aee5c97f830673ed1d9d2b5da746cc
SHA512b1efc8df4459b42363cbd4eecb84f661879279cd9be06d595c1cdb03b1a5286b238545fcf67aac623f03720ad8451c46bff3baea80cd10e35eb500acec4c032b
-
Filesize
44KB
MD5e91daa55c020043a0b1f8b90427e03ad
SHA11d97874df12b8d9372c9449d75ad3d87e799fae4
SHA2567b2ec73f7bf39fb77bba55bc14bebff11d8cfa729e956d043eeb35695974b0bd
SHA512bbb329af85fdd360ba8081e0654dcbfbff9ccfdff55c9ffc340f9dfb1435fe808ca5eb680511870ac717fe14197335fba838cb91c6020191df5d016f41be1b15
-
Filesize
2KB
MD5baa5d1f2acc2a4af61d8693f7f800b5c
SHA17c5ea33fc0844c815c46ba2cdef96285a49cb3c0
SHA2566ac8b3c1513f041746c8c7b9d2b5461df990116ecc22ed72b957b6bc6409b9f7
SHA51214c93582bf18d82b94f60b8e9a3a7b982f5e91daa998067406fd81d888f99b4540ee6d584ac9d69a74f53e5974b2b00aad6c3e238d8fb56e47b9e8f3a76b28b5
-
Filesize
2KB
MD5baa5d1f2acc2a4af61d8693f7f800b5c
SHA17c5ea33fc0844c815c46ba2cdef96285a49cb3c0
SHA2566ac8b3c1513f041746c8c7b9d2b5461df990116ecc22ed72b957b6bc6409b9f7
SHA51214c93582bf18d82b94f60b8e9a3a7b982f5e91daa998067406fd81d888f99b4540ee6d584ac9d69a74f53e5974b2b00aad6c3e238d8fb56e47b9e8f3a76b28b5
-
Filesize
2KB
MD5f2e42f19c946c2660e9ffc0bd8498764
SHA1d5ff628993ba0747de4a8ceaa1d7a7263dce75bd
SHA256741a014061aed1a741010f955bcf91c78883108df0c90e1ec24eacec943cead7
SHA51215fca9516cc6ad6e6fee58a072c710254c80027f092de11bce4567866c914bd412ddd9de71aa1eea2f2eb93ff01d97b74077d355e416966406f0bab0682946eb
-
Filesize
312B
MD50c04ad1083dc5c7c45e3ee2cd344ae38
SHA1f1cf190f8ca93000e56d49732e9e827e2554c46f
SHA2566452273c017db7cbe0ffc5b109bbf3f8d3282fb91bfa3c5eabc4fb8f1fc98cb0
SHA5126c414b39bbc1f1f08446c6c6da6f6e1ceb9303bbf183ae279c872d91641ea8d67ec5e5c4e0824da3837eca73ec29fe70e92b72c09458c8ce50fa6f08791d1492
-
Filesize
424B
MD58f26feaa8ca90ddc4f72e9e8df1925f0
SHA1c93d9a59e28fefe49d5c62532eeeaca1b2f6e0de
SHA2562ebace24870feab2d1516cd2d0b2654689b5abcbc9dcb7f43a9fe741b8424f3a
SHA51228765afbb8d94a5e424d43fbc93ae9416edb7c53b545ff8a2050e9635e152b464f5bbd9797797aaabffb2784d2c3252f23c3b304c941794adaa5f1bf480b8a4f
-
Filesize
424B
MD58f26feaa8ca90ddc4f72e9e8df1925f0
SHA1c93d9a59e28fefe49d5c62532eeeaca1b2f6e0de
SHA2562ebace24870feab2d1516cd2d0b2654689b5abcbc9dcb7f43a9fe741b8424f3a
SHA51228765afbb8d94a5e424d43fbc93ae9416edb7c53b545ff8a2050e9635e152b464f5bbd9797797aaabffb2784d2c3252f23c3b304c941794adaa5f1bf480b8a4f
-
Filesize
681B
MD574e4dd16583379df0d8a66483dfbb0e7
SHA12db91639f8ed45a7cae88bf50abb154d913b835a
SHA2563b3dd6996a950dc6faf52a9b4b0aef589c2e18e9b7391e3c13a1e44da2571090
SHA51212de6e1bf8447b24febc69aea83d39817c53a16f185065fe941741eb06c84fa6999305892bf619a2d2c4605038316b150304105edba5219a8a3aecf8b2389bc6
-
Filesize
681B
MD574e4dd16583379df0d8a66483dfbb0e7
SHA12db91639f8ed45a7cae88bf50abb154d913b835a
SHA2563b3dd6996a950dc6faf52a9b4b0aef589c2e18e9b7391e3c13a1e44da2571090
SHA51212de6e1bf8447b24febc69aea83d39817c53a16f185065fe941741eb06c84fa6999305892bf619a2d2c4605038316b150304105edba5219a8a3aecf8b2389bc6
-
Filesize
802B
MD50acf667031d5e6bb67fa25770e9dc1b2
SHA18c7b4f2ca886391f13083154d924757e5d38ddcc
SHA2561e30f6ed20c79c7136bbdd15ecea59a2e7b4b504394452df0b365e851da62225
SHA5122ca378ba3c10f13971fcce3fa5e8356973d9763ef0b7ce5b6da0b49e860c782c7de4d5a61029ab1615156bdfa22d3bcf07bec1920d88aeb664e1031f3d1f05b7
-
Filesize
849B
MD554851e9563a6709545d2b30ed279f76d
SHA10b4441ac45f46e2233ba1fd3f06e132fcc20ebf5
SHA256c197645d18e406844d2ea181a24f4a4438e4415fbbb76b4e6a853b5a90925073
SHA512c02fd860c87f48f21526c81dad282aefcc18941a795c1ff1ed2bb31ff8b731724248e1f713fcda14dfb6d2b18de35cbe756850d76236d0c40c400af6b04bb2dc
-
Filesize
849B
MD554851e9563a6709545d2b30ed279f76d
SHA10b4441ac45f46e2233ba1fd3f06e132fcc20ebf5
SHA256c197645d18e406844d2ea181a24f4a4438e4415fbbb76b4e6a853b5a90925073
SHA512c02fd860c87f48f21526c81dad282aefcc18941a795c1ff1ed2bb31ff8b731724248e1f713fcda14dfb6d2b18de35cbe756850d76236d0c40c400af6b04bb2dc
-
Filesize
1KB
MD535e8d13ac99e502c1d2f0c1bcbc51f2f
SHA15dc49017430e0e955bf2c839a9041e7f366ffda0
SHA2562bdabcaba6e127e9d034f9821d9dd466363fcff377477a796fe30537e77b5c91
SHA512baf7567cb7c56a342663cc46f017e57a2184a58d71fe604855086efea977e5fa767867723ee673c830016884828ec9b648c2a443443b834fbf89303a59214886
-
Filesize
1KB
MD535e8d13ac99e502c1d2f0c1bcbc51f2f
SHA15dc49017430e0e955bf2c839a9041e7f366ffda0
SHA2562bdabcaba6e127e9d034f9821d9dd466363fcff377477a796fe30537e77b5c91
SHA512baf7567cb7c56a342663cc46f017e57a2184a58d71fe604855086efea977e5fa767867723ee673c830016884828ec9b648c2a443443b834fbf89303a59214886
-
Filesize
1KB
MD5aa4cac7d0ce6df8aef2bdb012d6d431e
SHA109bd52a1643ada9f4d8fd9d76f9e9d6d429f388b
SHA2569e1acaef3632ae64830020e9fd14add7082b02717ba78e077500369f27207d5f
SHA512c137099a27fde36c494bab20e4e700f8c348632e35db12a30a2091c15a08a6c4ade7cb8c0935ed74ed8e7793a2e6cf7d7866ce83e477d5a01a86e074fd7953ff
-
Filesize
1KB
MD52e392dd038599f96328d5585c877e0dc
SHA1c05e2a7ed92ce038cf9cf781ca1fd604abf20c4a
SHA25674611603c74153ee857800478166d25e66df0669bf89d39d89b3aeb11e2d0acd
SHA5129884eddcb06871e3e938d825ad283b2659beb553db58ff7e3c71b7523d8ada4709cbe0b911b1a61ec8eb11edc1c23b7bcebd9ce5b567b2d68400a198a621516f
-
Filesize
1KB
MD5bd4f90c62e814484de1e04596e78c6cb
SHA125337183c0a7f51e70c5116d36fe2bf2b3a33bed
SHA25618c7c07026f139e7024e8cee68ceb302518f0ef9378d1b1239a45ac13e804487
SHA512892020d8dcab2527961840f62d905ec82d8a8a98444a772e2956ceb2544c4bf7779948b94533018a1b1c2ad33367a4b02b2563783597acb964fb87850f9a7a60
-
Filesize
1KB
MD5bd4f90c62e814484de1e04596e78c6cb
SHA125337183c0a7f51e70c5116d36fe2bf2b3a33bed
SHA25618c7c07026f139e7024e8cee68ceb302518f0ef9378d1b1239a45ac13e804487
SHA512892020d8dcab2527961840f62d905ec82d8a8a98444a772e2956ceb2544c4bf7779948b94533018a1b1c2ad33367a4b02b2563783597acb964fb87850f9a7a60
-
Filesize
1KB
MD5bd4f90c62e814484de1e04596e78c6cb
SHA125337183c0a7f51e70c5116d36fe2bf2b3a33bed
SHA25618c7c07026f139e7024e8cee68ceb302518f0ef9378d1b1239a45ac13e804487
SHA512892020d8dcab2527961840f62d905ec82d8a8a98444a772e2956ceb2544c4bf7779948b94533018a1b1c2ad33367a4b02b2563783597acb964fb87850f9a7a60
-
Filesize
1KB
MD5bd4f90c62e814484de1e04596e78c6cb
SHA125337183c0a7f51e70c5116d36fe2bf2b3a33bed
SHA25618c7c07026f139e7024e8cee68ceb302518f0ef9378d1b1239a45ac13e804487
SHA512892020d8dcab2527961840f62d905ec82d8a8a98444a772e2956ceb2544c4bf7779948b94533018a1b1c2ad33367a4b02b2563783597acb964fb87850f9a7a60
-
Filesize
1KB
MD5bd4f90c62e814484de1e04596e78c6cb
SHA125337183c0a7f51e70c5116d36fe2bf2b3a33bed
SHA25618c7c07026f139e7024e8cee68ceb302518f0ef9378d1b1239a45ac13e804487
SHA512892020d8dcab2527961840f62d905ec82d8a8a98444a772e2956ceb2544c4bf7779948b94533018a1b1c2ad33367a4b02b2563783597acb964fb87850f9a7a60
-
Filesize
2KB
MD5e286c5fa1d38c26e2e9f508f3bc60864
SHA1db57dc6ff3763a150c2f86116521d9371d993517
SHA256e53577810e7268649fabebcc7183bb39b00fa783e88b1f1a0fc7ae259abb104d
SHA5125fe31c774c675e36f7c9b6ba229c90c7644005f350b9755e8c6091ba925903eb35555b0bad22b244d6a1eb2d7bbde79837d1c278237ab9fa9bf7bd8299d13a1d
-
Filesize
2KB
MD5e286c5fa1d38c26e2e9f508f3bc60864
SHA1db57dc6ff3763a150c2f86116521d9371d993517
SHA256e53577810e7268649fabebcc7183bb39b00fa783e88b1f1a0fc7ae259abb104d
SHA5125fe31c774c675e36f7c9b6ba229c90c7644005f350b9755e8c6091ba925903eb35555b0bad22b244d6a1eb2d7bbde79837d1c278237ab9fa9bf7bd8299d13a1d
-
Filesize
5KB
MD528e8d249989adfbb1ec18c456a563eb4
SHA1a0c19c840f099fcc3b4f922d01db087b4a0972c0
SHA256ee1b31ad6b069fc1bf05241cf365f5335502fb2e686e403c3f90d8955232c907
SHA51205b923f831138a061adfd4757ae195d436144734b3ac9cf83e19d373ce23ad73aca17e1c19401131308cc78172ad09fc9f1b8017b5329c876a439142f5356f0d
-
Filesize
5KB
MD528e8d249989adfbb1ec18c456a563eb4
SHA1a0c19c840f099fcc3b4f922d01db087b4a0972c0
SHA256ee1b31ad6b069fc1bf05241cf365f5335502fb2e686e403c3f90d8955232c907
SHA51205b923f831138a061adfd4757ae195d436144734b3ac9cf83e19d373ce23ad73aca17e1c19401131308cc78172ad09fc9f1b8017b5329c876a439142f5356f0d
-
Filesize
5KB
MD528e8d249989adfbb1ec18c456a563eb4
SHA1a0c19c840f099fcc3b4f922d01db087b4a0972c0
SHA256ee1b31ad6b069fc1bf05241cf365f5335502fb2e686e403c3f90d8955232c907
SHA51205b923f831138a061adfd4757ae195d436144734b3ac9cf83e19d373ce23ad73aca17e1c19401131308cc78172ad09fc9f1b8017b5329c876a439142f5356f0d
-
Filesize
6KB
MD591a9de429c68dfa077c97b26f2b59883
SHA152c95fc1a384b1e4a466b91f139f02198c0d9d12
SHA256eea3b247231a25a73d1c5c5176845091aafb55d9473867f55512dbf00ca1312b
SHA5126365f3f8534e0dde07f961fddb39653bd512d216a8c2ae452f33e41eb9090a12cc5a00f24c1d3bdf8f6fe7910aaba2fe44dd0ca0868abd926a328601aaf05cad
-
Filesize
6KB
MD591a9de429c68dfa077c97b26f2b59883
SHA152c95fc1a384b1e4a466b91f139f02198c0d9d12
SHA256eea3b247231a25a73d1c5c5176845091aafb55d9473867f55512dbf00ca1312b
SHA5126365f3f8534e0dde07f961fddb39653bd512d216a8c2ae452f33e41eb9090a12cc5a00f24c1d3bdf8f6fe7910aaba2fe44dd0ca0868abd926a328601aaf05cad
-
Filesize
6KB
MD5cb2d445a35e26ecff3e99e3ac71e7459
SHA1b97dff32eb4a0dca8cb05fc7b2ce2938500b5a8d
SHA256501c64551e4e7ee112a3b0428fdb630a469c682b971f4cd775bf1856d85fa72f
SHA512d6083d19df4c2589915f76e0bd6342099a2f431f6123d35ae8e6705b3b1690a8df022b46331316daa2ae1e96bd2efdeda5c3cfbcd32c622a96a50d8dff59572b
-
Filesize
6KB
MD5948f4c329bfd6ab1a9dd5927387491c0
SHA182b62fe98945cac4112713739083512c4b969e5c
SHA2564bad15ec5ad4d4d7721ea340c13848b677275535f889df1fd8cd2a51816a5fbc
SHA5129112110ee06b9997ad7e8f10e7100f7260f119ea6cc4afa0bafa8cdc757baf91393eaa7bc40588db9c74d9a887cebcf63c4f301643202952eb38694497222e30
-
Filesize
6KB
MD5948f4c329bfd6ab1a9dd5927387491c0
SHA182b62fe98945cac4112713739083512c4b969e5c
SHA2564bad15ec5ad4d4d7721ea340c13848b677275535f889df1fd8cd2a51816a5fbc
SHA5129112110ee06b9997ad7e8f10e7100f7260f119ea6cc4afa0bafa8cdc757baf91393eaa7bc40588db9c74d9a887cebcf63c4f301643202952eb38694497222e30
-
Filesize
6KB
MD5948f4c329bfd6ab1a9dd5927387491c0
SHA182b62fe98945cac4112713739083512c4b969e5c
SHA2564bad15ec5ad4d4d7721ea340c13848b677275535f889df1fd8cd2a51816a5fbc
SHA5129112110ee06b9997ad7e8f10e7100f7260f119ea6cc4afa0bafa8cdc757baf91393eaa7bc40588db9c74d9a887cebcf63c4f301643202952eb38694497222e30
-
Filesize
6KB
MD5149ffe4a58e87182a379435fdaf03c83
SHA1df7b6b0472511b4745162be8c363454226be7dc1
SHA256e72161ea91cfc6ca51f73a505f2f57fdf55d53eeebd4cafd634270033b6b5773
SHA5123c9be7d458ac59d35fa046ddb57e2467cb156b1f855aa4f9747f617755b6e5b097f3ea85364dca51c721f9930b0f3d7380b56e7a7666b8119a8fd666c2718b92
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
16.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
16.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
16.5MB
-
Filesize
4KB
-
Filesize
16.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
16.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
16.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
16.5MB
-
Filesize
4KB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB