Analysis
-
max time kernel
140s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
04/02/2024, 21:05
General
-
Target
AnyDesk.exe
-
Size
5.3MB
-
MD5
75eecc3a8b215c465f541643e9c4f484
-
SHA1
3ad1f800b63640128bfdcc8dbee909554465ee11
-
SHA256
ec33d8ee9c3881b8fcea18f9f862d5926d994553aec1b65081d925afd3e8b028
-
SHA512
b3a48230fc6f20038c938e5295b68a3f020b94e220ca2fab6a894d126dc41f6f1021c239613bf9d6de84370ad7df9d9a91baf716a87d43eb101ee3e48578e5ff
-
SSDEEP
98304:j5ObAu2pmits24nYhQCWQdaQQo/mJPv4KYZPKBhYI5RuN4OL2wIjcsJWNg3:IAnRu24nR5QcTvYdmPuWOL2TcQWe3
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 8 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 7 IoCs
-
Suspicious use of SendNotifyMessage 6 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-service2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --backend3⤵
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-control2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
385KB
MD51ce7d5a1566c8c449d0f6772a8c27900
SHA160854185f6338e1bfc7497fd41aa44c5c00d8f85
SHA25673170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264bb8ffaf
SHA5127e3411be8614170ae91db1626c452997dc6db663d79130872a124af982ee1d457cefba00abd7f5269adce3052403be31238aecc3934c7379d224cb792d519753
-
Filesize
8KB
MD59bf272a485be9ad44dfd9ca1b8787116
SHA1d6364598ff71b7bd056164499d7ef765bdb3b47d
SHA2563f3155f1241c59f83f430bffec9e2087c859adefd7a2371567cc88dab9387462
SHA51220eed67651e962c2b8f3bd475c5fd62e96fbd5a321cedc1c3777a881885b9c76c6b255a3ca18b58ca18044ba752b3e67e58de32ab2084fa5d4949381b3eed2ed
-
Filesize
38KB
MD5eb30c42f835bd8e9c834212060b05c64
SHA1081a4aecbbb3c12ac9e99851111b97f336a8adef
SHA256d4350148301ab79bf0b1713d4f659249d8e590d58aaf5e1f618b80812f0022a5
SHA512a07ede58de329079219def7a5892af9999bcb0886fa8f301650cc0d1f600afb1a115200f9247d3236160c267eb44ef749b40e755e548f02bfa17a45f1ddb4fe0
-
Filesize
2KB
MD54106d74356dff3df7f7b6b98cc708d5b
SHA17f15b7a79f02371d330131088cab88a0c6306779
SHA2560a1b245179a75cd66d041181879dbda9eb01b71c75aae71331dbd7c3c612879f
SHA51266c8058589e190a364278b533dfeaf097dfc8190ff447500fae1dd947820f2eb4abcbb037ecd17f6be07cace5cce0bc775dbd4633c8095394101db12bf39d1d7
-
Filesize
2KB
MD5a248415f2d90a8fd58b8cb655dbd9dc5
SHA155d2a528e86ac03b1f6f54c91897d4e71c8d7c6f
SHA256c93c5bd62acd5045bcd31f0eb3d451db3a2f668b186825380d0693462b0fd5c0
SHA512a29142d721c9cad47aee2d2166262aeeaa6873c723ad1acf3809fb41430c2b1abff78cc3539a3c82ad497104585569db4fa1078b88bdc79c3e5609de2090f603
-
Filesize
681B
MD54cfd1645b3b1bdd7ba802c6538f26dfd
SHA1bf9e6ddd3a28fe4dc733a47c98d48ca142aac3ca
SHA256e8c2670c74628f9464e575b601e0437cbd45e094768e904d7eb48a35b7eb4f1d
SHA51214d778b317cb10acbfb20802f49245fd8792fae865980935f5104d6b4d916cb93affd9c711bde0c202032f111f9df6fd261b00a56145b6a6dac37208a831bd1f
-
Filesize
745B
MD5d3eb656306fa90827f212d6b10ca2795
SHA15182f6bcba80aa977fb37a13e01f012aa69ca053
SHA256bfae741690ded5033df68233ca4fe7b5ced193ff4819bd3d848e2203b19c66cb
SHA51218a34ea9445adf8a45b75229e8c17ba510b8580004a41024f4bf339f9ddd8a6bf86a4162fed88106c7d612fcf513f108601bcc104f62e3e0e1c3d5c4bfce5d8f
-
Filesize
802B
MD563e7e707ab3981e12e0c7a68751b859c
SHA101fab77b3058bf19e2514bf9d179ae5401d6fdd6
SHA256ead7b7f2f3da0e1db86d687e9041ac552584cd16e4fd508f2ddbe9730144a2e5
SHA5129942b85178f76d1d9a292a9c1b5c6e160dc2b21c7584b7fe71147caf4b1f4b2d190016364423692801afec8d74b183013aafd2b770f6b864f3950d710d6a1c31
-
Filesize
424B
MD596f7e3c1cbc53aa94486f77b1b1ac3e2
SHA1f48280e25f37c1fc4140e15d5de03b83d34579a8
SHA256b195c70e2fa81d4dd35214b4a4c274a3dae399bb45e39321ba61e035bbea0987
SHA512d6a7f41fa448ae62569804dee958f8966279f2dc8dc640dc4317becb578cbbb9d94d77612cf6b551f03e94ac93b55cc0b90558c5462f84ebd325950a07327aeb
-
Filesize
1KB
MD5d0ec93fe8e64ac11623c3232189540dd
SHA1e8264d3e416202275d86e11c1371efa8cb63e4fd
SHA2560483ced0f8737881512323fb797affb9e2cd40aef76ce8baf7f3757e83b65ffb
SHA5121c3df13cb99d5310b424586f64cd176f86c6615b3144a42449e282418364b9109f5fca9875887acd962e4b6a7c39b04e31df1ca2cfc22f0664311dd5a2e8c11b
-
Filesize
2KB
MD506293b03df9a8a52f402946f411e2546
SHA1a63d7cb4cdf5cf24e71ed7927455ce9b678192a7
SHA256e941c14cf5071987b7b50a1041b0792f1c741586de42401f836263a731ab061c
SHA512e26c74ce8d6f74a33ce153d30e54799b3fe85c8b5f9d39aae06e9f625199f95e4b909490045c84816a9382573f9ffcb331618637fba18de84d299d969bbceb7b
-
Filesize
1KB
MD596099afbf12e96ee54b349df4442eeb7
SHA14cd57f9b183eee0af3c9df5371cb3bdb8b4ec11b
SHA25692761bab30cdbb1bb43b41aff581152375e6467dbc9c23ab4c469780ecab2dd8
SHA5126fac9c526642c27ca684a4af83fd3c3173f31997f4731c2633faa686d16df31e378f290788668c2795d41a032d67a0c7d84a60863f8aa614b936bba5d655cadf
-
Filesize
6KB
MD53ffaa8398ae323fe8124cf87cc5749cf
SHA15aafcba3b82e5306a046864320c41214fc5529d7
SHA256f879c6a4bd91c879831dfb9d2ed3c2ecdc13d756e43408a126210fe107ef33c3
SHA5120804fbe0edcaf26c500d7be420392600d7f63557923f81ef1f89fcd29558408fe90118855125c3f686a20f6555e120fe2c1f8c1434e461ee1ca23a7324b98453
-
Filesize
6KB
MD595e4e86786a526aaf0d4bf2984bfcc59
SHA1bab37f9c5b6914e7558a7e75b3c620c16105ba07
SHA256254d03650a54f08648a2e02a73b803587dfae635a005504dc07ed7f1596989ae
SHA512434203207bd1aeabf0dd734b5b1ee1dcec24efcf32a497d3a8adb6b5c3c39fc96340a9e9dc4516acf89b2bd9456b0cd4067b02320bdbd1fcad09e4bd2ddd2a3a
-
Filesize
1KB
MD5c93fabe8b9678b62c412220218f1540c
SHA1b9c657766d07a11a92d702d3b8150a149c2cd0f6
SHA2561dd7474a4d18f86a8e3e598a03f54feeebe4e828f3b64610a67d4c43b9bb78ea
SHA512223153bdb35f011221ec2138976717f218f0f0f0dcc7d83f3470c1acb4a5623a4f954d69c772842eda0da848b6f5ec2cbfb1e6c3fd2fe37698eb968c4f38c672
-
Filesize
6KB
MD574007ab26a81107a492e42e816015c56
SHA1e99e9a3834b00c67b185e915cbf66e7257928aa8
SHA25644afd8b9d11c8abcac97e18c2f4cbb9de12f4f12c02c900ebea73cb404943721
SHA512e5a6eb7565d1cabc6193e42f6c401930f3b90bc035b70e45defc56f6581346d313b097ffffc9cd3a4fda74b4546d894a8845e31262457fb5055340038ff83a6a
-
Filesize
7KB
MD5612c2ab9bf4f82242d237d1ebaae17a7
SHA1080dd9c0468bda4a74de9e5de69613cdb505aa75
SHA2568f39b618ec0b56e525f8fbf9845048886596e1203519edc483ab39433cd16afc
SHA512ada2584c4e20908e3a95c7b55346c9f3daafbc46bd93061260d61c3e7fda127cca39eac2a905fec675b555553cf2e32e871e6c61e1461659ab6c51c0875b7772
-
Filesize
1KB
MD550cfb2f047d00ae1cabae508cc4901b8
SHA14ac0a5f9e840f77366c31c3641f9166d1334836e
SHA256e0ee8364841cc6c388923ca8a2fe0cf5ce53db5847ce26c90587ec4a56613aa6
SHA5128afb7cb06ac19af17c05120ad5250e89acabc1168f75ad492e5c9b177c4bf28a9580365a8e80993b6ee91fb0d340d95373e5f967bb25f0aa4237288878c1a1e9
-
Filesize
1KB
MD576f0f73a0355945916514e19be90ef64
SHA1f8a2df7d655cfdb2e3c26c50021bb617aafd3932
SHA256db1f9dd3047fc4a693f398a31f4461ffc1e2edb068f25e29a8373b43b22d839c
SHA512baa1da38d85e506caf8a0c005dfab57403512d022b35f36b714cf4c68ca887d5372919f9a5b3f0cac20063ab29d8bdec03049943c84da4d895945c1c0fa2a413
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.8MB
-
Filesize
4KB
-
Filesize
23.8MB
-
Filesize
23.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.8MB
-
Filesize
23.8MB
-
Filesize
23.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.8MB
-
Filesize
23.8MB
-
Filesize
23.8MB
-
Filesize
4KB
-
Filesize
23.8MB
-
Filesize
23.8MB
-
Filesize
23.8MB
-
Filesize
23.8MB
-
Filesize
23.8MB
-
Filesize
4KB
-
Filesize
23.8MB
-
Filesize
23.8MB
-
Filesize
23.8MB
-
Filesize
23.8MB
-
Filesize
23.8MB
-
Filesize
23.8MB
-
Filesize
23.8MB
-
Filesize
23.8MB