Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
21/09/2023, 11:35
General
-
Target
AnyDesk_6.0.8.exe
-
Size
3.5MB
-
MD5
e9fb13875b744fa633d1a7a34b0f6a52
-
SHA1
f0966985745541ba01800aa213509a89a7fdf716
-
SHA256
fb8fb89b5f56ce2acd9668021a470a18b7898808750800861151e908d5b1a20e
-
SHA512
c2feda22e23fda47f0b0ede38f5f432a656a5e7598c7a9d3d4e8babf9ff94189b69f4f4a3894c094260c3b72d21888720f60ed7ee2c018c8aced9d754e03e292
-
SSDEEP
98304:CR2784xuvNza4gtJkiGPGAccN3JyD5qcDinRKs:CRqKvNWZtJkiG+3cik6cD
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk_6.0.8.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk_6.0.8.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk_6.0.8.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk_6.0.8.exe" --local-service2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk_6.0.8.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk_6.0.8.exe" --local-control2⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
385KB
MD5551f46d4d66917f93d095ba0a0066db1
SHA1ec8e7d6752cec742019d37afa0e868aeddf08dc0
SHA256b3912035d6e90aa56a9772276007c1e6632dde64fc8bb2fd810bbbfdeaa7e551
SHA5128d4d4f7047dca306d0e06936be51ce224957f0e5cae8c79c9eba25f4498c545d361493a62bc93b9bb14ef27577e8d44178201a6beee0c33f0a2ef5296031d398
-
Filesize
385KB
MD5551f46d4d66917f93d095ba0a0066db1
SHA1ec8e7d6752cec742019d37afa0e868aeddf08dc0
SHA256b3912035d6e90aa56a9772276007c1e6632dde64fc8bb2fd810bbbfdeaa7e551
SHA5128d4d4f7047dca306d0e06936be51ce224957f0e5cae8c79c9eba25f4498c545d361493a62bc93b9bb14ef27577e8d44178201a6beee0c33f0a2ef5296031d398
-
Filesize
8KB
MD52a85c38b9f40bcc7f4b61f45f625afc3
SHA13c52dc1ddfef43b0f3518952b5f188745e67a7aa
SHA256ff5ab9265d8c19b9ef251b2bf4d96063c1d45791cd6e1195de990a0bb7143402
SHA512f84d735314e2fb4396ee937000e2b08ad368ee3b43f8385e0f6db9ce38b86efae391d97b9c4d0b4d5b5339fb39f49fc69cc672527dd1c896499e72afcf047397
-
Filesize
8KB
MD52a85c38b9f40bcc7f4b61f45f625afc3
SHA13c52dc1ddfef43b0f3518952b5f188745e67a7aa
SHA256ff5ab9265d8c19b9ef251b2bf4d96063c1d45791cd6e1195de990a0bb7143402
SHA512f84d735314e2fb4396ee937000e2b08ad368ee3b43f8385e0f6db9ce38b86efae391d97b9c4d0b4d5b5339fb39f49fc69cc672527dd1c896499e72afcf047397
-
Filesize
2KB
MD5a9441f7a46a61914c8aa058c00612744
SHA1bdb74fe41c41dd64843ec0dec23eaa4f06f1a567
SHA256e0c1fdda5dfa6477e2ba639ebb58de134c0152a44d5daccb32418a6e95d8f2aa
SHA5120d689f682e93633090d4a1e66fcdffa607e17c63940ca5634d6502b77cda322632413189c4b7ea1ffaf71db8d3b609584a7a81ba716df0b5c7b60fd154622d06
-
Filesize
105B
MD5d53ec75dea20043f6711e5fa8cafcece
SHA11b2ae62e71f28728be2356c2037f03a886768393
SHA256438399882ba435c78a04df3caf3bf2b54e56712dc5a27e1a94fbf5551d9c71a7
SHA512b79e37d48215995c6d1020c98ef79621cf87a8e7ac1723e54df898f6a743cc339003673129835c127a7a6c00666ec579e989fc19a5f42091596418a6e07e2373
-
Filesize
105B
MD5d53ec75dea20043f6711e5fa8cafcece
SHA11b2ae62e71f28728be2356c2037f03a886768393
SHA256438399882ba435c78a04df3caf3bf2b54e56712dc5a27e1a94fbf5551d9c71a7
SHA512b79e37d48215995c6d1020c98ef79621cf87a8e7ac1723e54df898f6a743cc339003673129835c127a7a6c00666ec579e989fc19a5f42091596418a6e07e2373
-
Filesize
329B
MD5154c935bc960f2b09e23ebbff3d520bf
SHA1e75303e7d075de41681260c399bd6c992d0260b8
SHA256eb104b6b3efa98fe82367bcec339ca81285671397970f3c8cb8f9254da771822
SHA51285c61e2c565dedc84a1651bf61bafabcbb8162ad220df21d9e63f6d508d44a0537e837d20730739e52a009ff9d06d52e90365c621f55e5df0808afd623f4f556
-
Filesize
329B
MD5154c935bc960f2b09e23ebbff3d520bf
SHA1e75303e7d075de41681260c399bd6c992d0260b8
SHA256eb104b6b3efa98fe82367bcec339ca81285671397970f3c8cb8f9254da771822
SHA51285c61e2c565dedc84a1651bf61bafabcbb8162ad220df21d9e63f6d508d44a0537e837d20730739e52a009ff9d06d52e90365c621f55e5df0808afd623f4f556
-
Filesize
386B
MD5a8c47e57abc3664c1415764a3e13722a
SHA1ff5bcb9732a17de246461e6936c22c702f2e05cc
SHA2568acb6d3c82723890851ec4836d2d3cbacb2ad7b5f9293ee2458fbbe14df7eca5
SHA512082e9c29e5ab902d4940061318bfd149f2e876bf92857e6369ae2defab0250f26436c4f96dd330fb911bda98a0cb9dc9c54c74b5583a17d28b82a9ee04a6538a
-
Filesize
450B
MD5aafc81b4127de11d726d53f795f6f965
SHA1527858920750b56ae6174569a6caab3dafd64f17
SHA25687ba128fda714cb19940b2089724cc3912bace934919a7325440ad95be364423
SHA51272674a563ad4732284a2a3cd697166c524910db48c342301b1f2f32f14c76c2210defc68fd78016e0fc848e6173c71952368c0338cb1ea8642e9a75d83b26d4c
-
Filesize
205B
MD559352c2b0c590c5fd96365d3168d723b
SHA153ab571639cc3e3a38032c1095985f7f4278d8fc
SHA256079db0d18cb8ca55e8653f3d67608c5e445d32e368feb874ed3fa1d797c7c286
SHA5122d21bcd26ef934095ca5b37aa1e66091547870f5e09c2d203dfd75923d2575f93f1a42f31e4fb7b2423b766984464ed65b048f49519837918de246a892c82828
-
Filesize
13.5MB
-
Filesize
4KB
-
Filesize
13.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
13.5MB
-
Filesize
13.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
13.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
13.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
13.5MB
-
Filesize
13.5MB
-
Filesize
13.5MB
-
Filesize
13.5MB