Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
14/11/2023, 07:04
General
-
Target
AnyDesk.exe
-
Size
3.9MB
-
MD5
17d3cc33a125d39097b58d5f653407d5
-
SHA1
818948f6b9eb98be0e0776593737b58ad6b2754e
-
SHA256
bb99d82c785b174928e89e5895121c562b14888d03ca61ff93c0050af87b07fc
-
SHA512
9e14395f043756c95174e82519a0070ce6554abe5bc4ed10765d476c67b5e7fb3f0d7b486c59ad12e9d5c26601fe16b08d870a777a3341d679079fc05c389a90
-
SSDEEP
98304:5F4uPbhDU4Wdtqd6jDJAwwvx9CESoN0SwXOc3VpdilL:TT24ZgjFTwvnSRSWO2fiV
Malware Config
Signatures
-
Drops file in System32 directory 15 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-service2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --backend3⤵
- Drops file in System32 directory
-
-
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-control2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x33c 0x3381⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
385KB
MD51ce7d5a1566c8c449d0f6772a8c27900
SHA160854185f6338e1bfc7497fd41aa44c5c00d8f85
SHA25673170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264bb8ffaf
SHA5127e3411be8614170ae91db1626c452997dc6db663d79130872a124af982ee1d457cefba00abd7f5269adce3052403be31238aecc3934c7379d224cb792d519753
-
Filesize
7KB
MD57ff32e12c70b651a70460e45f12a2dc8
SHA17fd6a06855724304028e55bd084f6dd934eba5c3
SHA25603ab2d5bcf5bbffc07313190385514d09f2861ce25692edaec5d128e3bd47a9b
SHA512ae1f92580bb2732bd0189571f9b3edd134f4ea5cc4d8e7de8a5fa267833b95f11fcc00aaea3d670f2ee6a7e93cf1658c635c7f3b4f8cb076ce2cc1d988525693
-
Filesize
54KB
MD5b7445b57012b3dbb8dc4f0de27a51234
SHA10da8ee5396979616067bfc8ff681de82b26cb91e
SHA25655369986a9abd8aa5d20ad404d9c6ad98a05d765daf7a38e17b2b21646008c96
SHA512cdb6ad10a5a7d3aef955d85806b89a51a82d8346d5f804b8cc72741a01cacf001b2db47c69f9643bcf4fa566f9b83f931827226a76d2e771a328211a885e11b5
-
Filesize
10KB
MD5926e8556fadc87d6750bdf5ad3411b20
SHA12eae03b4be4bbb133e5540880dcb821c9d64d9bb
SHA256c9778808c7638421b7f530c3339ce1cb9180665e78e58124b7894e4aba90deda
SHA5128d8ac2cf13b8fc932706b645c32ab14ffaef565391880a8b1e37cee92dc8214b4a3b4d5375a6a84311fcd54fa453cf857bd6c3f92b4fbc6bbdd5fa5cbf9449a2
-
Filesize
2KB
MD50cb22119791ac87a2a8c0476e8195818
SHA191351fe1604e8a5ad3406453fc4e2d1763822fc9
SHA2563ce96afa96fe19d37865e30f9cdaa6c795d55834eeb8f0055130582661b34b99
SHA5123cdb32ab2237d6da742f02ff7954dc50b8bf4b0c5bf966c2109846e315b75586e274d8292c8f0f125713918e0430fc78064e048d46687a17e2fde463f8544307
-
Filesize
2KB
MD5ac8d64975db553d2aa876af4c06d6c05
SHA1509c88e8ffcde1a6b02f0f2797283c2c3f048d8a
SHA25621e948d192a435f4d199875bcf2408e6179a12eb4de72604ef4708a91f482ab9
SHA5124d05f64afd8c61800a0c8ec6f43de0c842ea7005173cc7d3da31c3caf2f29cbcb2eaf50aafd2a5f297ba843c617afe4e8a9a439e20f075c26f2d34e06f87a130
-
Filesize
2KB
MD5ac8d64975db553d2aa876af4c06d6c05
SHA1509c88e8ffcde1a6b02f0f2797283c2c3f048d8a
SHA25621e948d192a435f4d199875bcf2408e6179a12eb4de72604ef4708a91f482ab9
SHA5124d05f64afd8c61800a0c8ec6f43de0c842ea7005173cc7d3da31c3caf2f29cbcb2eaf50aafd2a5f297ba843c617afe4e8a9a439e20f075c26f2d34e06f87a130
-
Filesize
611B
MD5406ddc361344367655754bb007fb59df
SHA1434842f24f6f8f1d0d986f66368274a873f6bcc1
SHA256f1f2836e0d5284faff4c80917712481383de614e7e12593367218cb068656e91
SHA5129826ae56e177c15d25ff5c397c7be1035c986f3611b669773d0c3e8faf92011735c0f2078ea2d0df4d5a6c81ec50257b7440a61fa4bf287d4d41062fc4e5e408
-
Filesize
680B
MD5b48d8c31176f8e026ecb7d68d74719fc
SHA105d34f4d8bb0700279232ee16fd9e6031a9efef0
SHA2565eb1180d998148ff9d7d5fbec722dcf77f5332ce105185bb70d6aa06cb5512c7
SHA51298ec52041c7ba3fe82086950101e41c5fe7bda17ac85f66f0e923df3218d30dfe81bc4a2f1e5c63fe9e115ed816a1e8ca941c8d669e475d176b8b0f6188515de
-
Filesize
744B
MD5728f443bbaa97da1954980a0890e7358
SHA197f4c9749f491a156fd192bbb0d7ffe07ba1fe1a
SHA25692b06be799cf767e1ee0999ed4bb211dda3e3388ddb2a57a301d29cdc5c9001f
SHA512c5b0318f3b768eaa8f77512d4da39c154946bfc4173bb1ac1a6a930222b94ecb46f113b1a588063445f31c058338d67efa93fd94f1c3c52034701bad0e6500ec
-
Filesize
312B
MD50c04ad1083dc5c7c45e3ee2cd344ae38
SHA1f1cf190f8ca93000e56d49732e9e827e2554c46f
SHA2566452273c017db7cbe0ffc5b109bbf3f8d3282fb91bfa3c5eabc4fb8f1fc98cb0
SHA5126c414b39bbc1f1f08446c6c6da6f6e1ceb9303bbf183ae279c872d91641ea8d67ec5e5c4e0824da3837eca73ec29fe70e92b72c09458c8ce50fa6f08791d1492
-
Filesize
424B
MD5a966ec29af38b671623f92fcb1cefbd3
SHA16d90a83c5e4a15fca8af233607c8d6b501118fdd
SHA25653c8a92b508c974e10e037bf1a962a02d35f4d8141c636bb64e3b4aab7da94e5
SHA512d127022ff6308a2abeb31677c99dc91177399a5d4441ab0e9732ebaf9ec176ab1509178d15d6f00de3c360832b8cdefbdb354797f01bd6d6b92f1d9f82f828ae
-
Filesize
424B
MD5a966ec29af38b671623f92fcb1cefbd3
SHA16d90a83c5e4a15fca8af233607c8d6b501118fdd
SHA25653c8a92b508c974e10e037bf1a962a02d35f4d8141c636bb64e3b4aab7da94e5
SHA512d127022ff6308a2abeb31677c99dc91177399a5d4441ab0e9732ebaf9ec176ab1509178d15d6f00de3c360832b8cdefbdb354797f01bd6d6b92f1d9f82f828ae
-
Filesize
5KB
MD578207549ed1f4c6548cfef80f8a99127
SHA1fcab7650b19ee65880e627054e19dc305d1738dd
SHA2562502a342972a6a3dd74f44d3602711b7639c5838e2ac88a0a9df3dada72fd45c
SHA512a2592aa24862ad78b94f8a8c6d1c6545a60adf67417f5a8fff66e17762b4d68f070ab3f5c4646f4c491c344a22e8f9ec25dd1ada32fc04c0f5e992a3478b0ad9
-
Filesize
5KB
MD578207549ed1f4c6548cfef80f8a99127
SHA1fcab7650b19ee65880e627054e19dc305d1738dd
SHA2562502a342972a6a3dd74f44d3602711b7639c5838e2ac88a0a9df3dada72fd45c
SHA512a2592aa24862ad78b94f8a8c6d1c6545a60adf67417f5a8fff66e17762b4d68f070ab3f5c4646f4c491c344a22e8f9ec25dd1ada32fc04c0f5e992a3478b0ad9
-
Filesize
5KB
MD56a484dd0089369263be4978aab61a4d5
SHA1655efd9a75ecbea6a87c82ec552e382e5a74d9aa
SHA2562d1e67a3175f13e11a6e87df024508f4eb822ec933f85ade7dd38ab1cac214a6
SHA512e04b47da8c87732fe02737b9c8d6642aca09affc63604e5435836352ae50e4ad83302fe68ced468b4fb20ace10591690cdc61003ebcba1df944ac661253e8445
-
Filesize
5KB
MD5b9ac6e433f5c528471363a8331b91dcc
SHA199430f668e6449bc37701511dfc63b7e6ad69195
SHA25666e2403cc7e3a47c750b79140428fcb5ac30bb8386b792a0ee61ad78bad064f2
SHA512e9e477dee5b1bc73f3f3ab994d742ac7bc9e31f731295ead32f804fcd82063ee3c4cbf53bdcfff3fa8287aff1a7fbfd6b6089cc850edd65c8c4c5b88be0e4aab
-
Filesize
5KB
MD56a484dd0089369263be4978aab61a4d5
SHA1655efd9a75ecbea6a87c82ec552e382e5a74d9aa
SHA2562d1e67a3175f13e11a6e87df024508f4eb822ec933f85ade7dd38ab1cac214a6
SHA512e04b47da8c87732fe02737b9c8d6642aca09affc63604e5435836352ae50e4ad83302fe68ced468b4fb20ace10591690cdc61003ebcba1df944ac661253e8445
-
Filesize
5KB
MD56a484dd0089369263be4978aab61a4d5
SHA1655efd9a75ecbea6a87c82ec552e382e5a74d9aa
SHA2562d1e67a3175f13e11a6e87df024508f4eb822ec933f85ade7dd38ab1cac214a6
SHA512e04b47da8c87732fe02737b9c8d6642aca09affc63604e5435836352ae50e4ad83302fe68ced468b4fb20ace10591690cdc61003ebcba1df944ac661253e8445
-
Filesize
5KB
MD56a484dd0089369263be4978aab61a4d5
SHA1655efd9a75ecbea6a87c82ec552e382e5a74d9aa
SHA2562d1e67a3175f13e11a6e87df024508f4eb822ec933f85ade7dd38ab1cac214a6
SHA512e04b47da8c87732fe02737b9c8d6642aca09affc63604e5435836352ae50e4ad83302fe68ced468b4fb20ace10591690cdc61003ebcba1df944ac661253e8445
-
Filesize
5KB
MD56a484dd0089369263be4978aab61a4d5
SHA1655efd9a75ecbea6a87c82ec552e382e5a74d9aa
SHA2562d1e67a3175f13e11a6e87df024508f4eb822ec933f85ade7dd38ab1cac214a6
SHA512e04b47da8c87732fe02737b9c8d6642aca09affc63604e5435836352ae50e4ad83302fe68ced468b4fb20ace10591690cdc61003ebcba1df944ac661253e8445
-
Filesize
5KB
MD56a484dd0089369263be4978aab61a4d5
SHA1655efd9a75ecbea6a87c82ec552e382e5a74d9aa
SHA2562d1e67a3175f13e11a6e87df024508f4eb822ec933f85ade7dd38ab1cac214a6
SHA512e04b47da8c87732fe02737b9c8d6642aca09affc63604e5435836352ae50e4ad83302fe68ced468b4fb20ace10591690cdc61003ebcba1df944ac661253e8445
-
Filesize
5KB
MD56a484dd0089369263be4978aab61a4d5
SHA1655efd9a75ecbea6a87c82ec552e382e5a74d9aa
SHA2562d1e67a3175f13e11a6e87df024508f4eb822ec933f85ade7dd38ab1cac214a6
SHA512e04b47da8c87732fe02737b9c8d6642aca09affc63604e5435836352ae50e4ad83302fe68ced468b4fb20ace10591690cdc61003ebcba1df944ac661253e8445
-
Filesize
5KB
MD56a484dd0089369263be4978aab61a4d5
SHA1655efd9a75ecbea6a87c82ec552e382e5a74d9aa
SHA2562d1e67a3175f13e11a6e87df024508f4eb822ec933f85ade7dd38ab1cac214a6
SHA512e04b47da8c87732fe02737b9c8d6642aca09affc63604e5435836352ae50e4ad83302fe68ced468b4fb20ace10591690cdc61003ebcba1df944ac661253e8445
-
Filesize
5KB
MD56a484dd0089369263be4978aab61a4d5
SHA1655efd9a75ecbea6a87c82ec552e382e5a74d9aa
SHA2562d1e67a3175f13e11a6e87df024508f4eb822ec933f85ade7dd38ab1cac214a6
SHA512e04b47da8c87732fe02737b9c8d6642aca09affc63604e5435836352ae50e4ad83302fe68ced468b4fb20ace10591690cdc61003ebcba1df944ac661253e8445
-
Filesize
5KB
MD534a418dc3bac051320102cc576478ab2
SHA103bbca14cfb4092b0443dec0be15e24600ff4ea9
SHA25624357f6169dbe6506a505280f9db3b5f102d79f9224ed20e26547b4ec6487640
SHA51218a518ca4fd03d28a332e190b046824675d81332c41dfe90d87a0da771f227c948e3dda638f3c384d0448638ad2638f23dedd6a3a29bd4023d09b0016ba78971
-
Filesize
1KB
MD5772cc94f0a9be200d7163ffb2c66b097
SHA106ca1f203822f6ee7e1b7fd5f2bcaebae18cc547
SHA256fdaf0f53dd44537d9c4463e3bc9b6e1f187cc71bcf65db1ca23989fabced4d96
SHA512fba0ddf6382d3fc8b541802af216df688f168ff5aae16457507da297322d56e1c88a16a443c58e82e7731deceaa76d0824cbe6750b9f8dc1379278697d7566a1
-
Filesize
5KB
MD5f1520a0b7b5fde13dfc0a6b8938362f3
SHA1d92b99ba658004d10d24ba30fb8fccccb18f0993
SHA25688f12e4529d482c33edd2d7692f0672e4aea6d7472aa3eee91d65b3c3a44e86f
SHA5124904ae6650000c8462820c63124323ec13761eaf368946865812f525ed714a3199911ab05ab6255f4d8c2589caee9773b2c37ffc49764f0ed6f4d9cbce3714da
-
Filesize
5KB
MD5f1520a0b7b5fde13dfc0a6b8938362f3
SHA1d92b99ba658004d10d24ba30fb8fccccb18f0993
SHA25688f12e4529d482c33edd2d7692f0672e4aea6d7472aa3eee91d65b3c3a44e86f
SHA5124904ae6650000c8462820c63124323ec13761eaf368946865812f525ed714a3199911ab05ab6255f4d8c2589caee9773b2c37ffc49764f0ed6f4d9cbce3714da
-
Filesize
5KB
MD5f1520a0b7b5fde13dfc0a6b8938362f3
SHA1d92b99ba658004d10d24ba30fb8fccccb18f0993
SHA25688f12e4529d482c33edd2d7692f0672e4aea6d7472aa3eee91d65b3c3a44e86f
SHA5124904ae6650000c8462820c63124323ec13761eaf368946865812f525ed714a3199911ab05ab6255f4d8c2589caee9773b2c37ffc49764f0ed6f4d9cbce3714da
-
Filesize
1KB
MD5772cc94f0a9be200d7163ffb2c66b097
SHA106ca1f203822f6ee7e1b7fd5f2bcaebae18cc547
SHA256fdaf0f53dd44537d9c4463e3bc9b6e1f187cc71bcf65db1ca23989fabced4d96
SHA512fba0ddf6382d3fc8b541802af216df688f168ff5aae16457507da297322d56e1c88a16a443c58e82e7731deceaa76d0824cbe6750b9f8dc1379278697d7566a1
-
Filesize
5KB
MD5f1520a0b7b5fde13dfc0a6b8938362f3
SHA1d92b99ba658004d10d24ba30fb8fccccb18f0993
SHA25688f12e4529d482c33edd2d7692f0672e4aea6d7472aa3eee91d65b3c3a44e86f
SHA5124904ae6650000c8462820c63124323ec13761eaf368946865812f525ed714a3199911ab05ab6255f4d8c2589caee9773b2c37ffc49764f0ed6f4d9cbce3714da
-
Filesize
1KB
MD56a442dd077755a262e6780319f329597
SHA1235ac73d51dbaec06e91d6f8aba8d5c11e5ec640
SHA256f194843ad9b545d1b2f18f19efe47d4de5a4734578898bd707e7836e5c55575c
SHA512e608c8a7690e750c8771d5d3539b3584a677c2210b8ae385690309e8b4d5035bc0063e8772f28857d7947e775312a7a8b8afeb9fc6721de51358152bd941c021
-
Filesize
1KB
MD56a442dd077755a262e6780319f329597
SHA1235ac73d51dbaec06e91d6f8aba8d5c11e5ec640
SHA256f194843ad9b545d1b2f18f19efe47d4de5a4734578898bd707e7836e5c55575c
SHA512e608c8a7690e750c8771d5d3539b3584a677c2210b8ae385690309e8b4d5035bc0063e8772f28857d7947e775312a7a8b8afeb9fc6721de51358152bd941c021
-
Filesize
1KB
MD56a442dd077755a262e6780319f329597
SHA1235ac73d51dbaec06e91d6f8aba8d5c11e5ec640
SHA256f194843ad9b545d1b2f18f19efe47d4de5a4734578898bd707e7836e5c55575c
SHA512e608c8a7690e750c8771d5d3539b3584a677c2210b8ae385690309e8b4d5035bc0063e8772f28857d7947e775312a7a8b8afeb9fc6721de51358152bd941c021
-
Filesize
1KB
MD56a442dd077755a262e6780319f329597
SHA1235ac73d51dbaec06e91d6f8aba8d5c11e5ec640
SHA256f194843ad9b545d1b2f18f19efe47d4de5a4734578898bd707e7836e5c55575c
SHA512e608c8a7690e750c8771d5d3539b3584a677c2210b8ae385690309e8b4d5035bc0063e8772f28857d7947e775312a7a8b8afeb9fc6721de51358152bd941c021
-
Filesize
1KB
MD5b317e44a370bff3f163f25fb37838fae
SHA182d947df8c7fe3caefe3298142320354842b8cc4
SHA256fb7ec9a57b1a8f8ac3ec6aa260c496416a7efded0936ffb2ae35375c935e7189
SHA512aef4491c9f32104da46df58655c94e7b9fe1caa5e0f28092a31bdd2b0d0827cf09d617b5f61629f9ff5b40e4233d09a56bc4f3839a31030f0b8a4b7b6dd5c00b
-
Filesize
4KB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
16.5MB
-
Filesize
4KB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
4KB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB