Analysis
-
max time kernel
1802s -
max time network
1807s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-de -
resource tags
-
submitted
05-02-2024 19:20
General
-
Target
AnyDesk.exe
-
Size
5.0MB
-
MD5
a21768190f3b9feae33aaef660cb7a83
-
SHA1
24780657328783ef50ae0964b23288e68841a421
-
SHA256
55e4ce3fe726043070ecd7de5a74b2459ea8bed19ef2a36ce7884b2ab0863047
-
SHA512
ca6da822072cb0d3797221e578780b19c8953e4207729a002a64a00ced134059c0ed21b02572c43924e4ba3930c0e88cd2cdb309259e3d0dcfb0c282f1832d62
-
SSDEEP
98304:NzTZ3cINQscs0m++LNkT6OpwDGUUH57yvZ/49Mr8EO3QhA9Kq:Nzt3cINQscNmvLCwDkHEvZ/4R79x
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-service2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-control2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
385KB
MD51ce7d5a1566c8c449d0f6772a8c27900
SHA160854185f6338e1bfc7497fd41aa44c5c00d8f85
SHA25673170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264bb8ffaf
SHA5127e3411be8614170ae91db1626c452997dc6db663d79130872a124af982ee1d457cefba00abd7f5269adce3052403be31238aecc3934c7379d224cb792d519753
-
Filesize
8KB
MD5526084429f0b111b254fe7db6eb14d1c
SHA1b423b3389e3c8910b26f08a0df409cbd694093be
SHA256b82c87d6bcaef1d80024af143389b09479ad69e537bf85c76fc2e3ae85faf381
SHA5123440670f88b14f332f7f164b34d439348bb6d4e6627e1545503beab8f780d147dd3b30ccd9df314b2c78407fdb5bb91e6c61723c2c95d34a4b43d8a9848c6a2c
-
Filesize
2KB
MD582fb22dc1610a509baa9b92d13af2468
SHA1aabef77df53fc708a18f26118286c834b12f3121
SHA256f0c171aa8a44a2be69988386cf2bc81d068bb81a4b09221ba12044897517b815
SHA512eb96498a76bf749c063bd9a357d9d784f42cd1253d3e9e8ff71bcf2c503c4eb6bc503efc93675e42d117b86c7ad32c14c73bbc54eed34904f03928b7c89e338b
-
Filesize
2KB
MD584eddf2b76ae87661409d3b00cb45af7
SHA146b99207faf703a6394465b46f59301a58e0eb01
SHA2566e82da79b4b85de16be9206c73c2c82cf8c40ba8f575fcdcde8830ad067d2c85
SHA51202546f050ab3504a3603bb29357efdfa2b5fa784fdb1d3cbd9a7f1cd2f06e43bfde8036d4b6de421f524f5161b54fd24fd6b0c3eed20e28f43489b6176337259
-
Filesize
612B
MD5d6ee027e8c43dae6a2704879395a148c
SHA1ababc19d4875f6507d12c9154dffc720bac7717c
SHA25611c5f4f38adae64b727f285ec07760427507c4a0562ae05898459b93933f93cd
SHA5126f1770253d09ddd33e349118368ba73ad11311c73de6fb115989feef6d4dd36050014dadcddb9ec72f752c0d32ad4064924f191de2d41e145584203181e7dcb0
-
Filesize
733B
MD5221d12ff5eca83d3637adb7e04868f6b
SHA183a7c757586bcf0a9c094bd35c850c607dd44908
SHA25645c423f6abc34f778b79e848e83d39c0986735efa14cfe37fec9cb3449af2f85
SHA512621e675d6d798955725bb4d65cddfdcec2414ea385ebdde6253c7e6ec3033db7d4f316a9a1a73d37048ece1b047567439109187c5437d48e6987981acc5a0b4f
-
Filesize
802B
MD5e37de47f589b1b01d3fd25c464a4bf70
SHA1b9c9547cd91a44561c4dc0cb5e56acf9866de356
SHA25603dda6a3a48cb359f0470b72fddd6bd71d0078b8fcd75eae5a9ff0cb1dd27edb
SHA5127290d15f11c4bec5250e893bc6065da60d1740768abc3cb6240033c7a79efdd9c9c99482f1a2a5c53ba24779ea54aee16f856c0090ffd07bdab4e21245fc499b
-
Filesize
312B
MD50c04ad1083dc5c7c45e3ee2cd344ae38
SHA1f1cf190f8ca93000e56d49732e9e827e2554c46f
SHA2566452273c017db7cbe0ffc5b109bbf3f8d3282fb91bfa3c5eabc4fb8f1fc98cb0
SHA5126c414b39bbc1f1f08446c6c6da6f6e1ceb9303bbf183ae279c872d91641ea8d67ec5e5c4e0824da3837eca73ec29fe70e92b72c09458c8ce50fa6f08791d1492
-
Filesize
2KB
MD5fb9cd99213ee4f659747c0cd708d7b15
SHA1f21141246e4cb7e9dfe68d28c1a7f7b77ef15e01
SHA256479940a215c93e77388dc6feedcd9c2539f9411fa71d8b4d376f15e8cf46bd66
SHA512d86b501f61b24e99c28927bc123b586b5537df86a1a326b4900efa301d9992bd3d67e152dc44c5022a9fca566d5af55b72b84b112ab39f9c3b1a018abc6d285a
-
Filesize
424B
MD529b4690eda560360e7d3389e8e0f4227
SHA1143a6fe9861277b0b4403f8e72784d7ef911a623
SHA256c4a436459190a5ce12e06bf6b6b46248eb7ed30e24fa6eb9a4371e394318b33a
SHA512a09d0fa1cf27c1988a6f3ba1e53474d2e663b34735a0b6fe677e881f31a841999e8b11c17cc19dc26059386aa21e33b6e2a0371b52feae6c4a4abb63e0548738
-
Filesize
424B
MD55291f7acf9856eb9f855a88582c25cbb
SHA17eedf627f13de25e0ffb1b75529fb6f096a667c8
SHA256c7abc2642752414ea67a803a8440084abbf689322223661c323fef1f7b6d8b8c
SHA51228223175142767e0a3092304b7f177930bd77989c91c086414ae7f3aaac3755bf9d6373dc3a3c878c30eed52e37b9c9f77ccc8b2882897d7fc201a220eb46e92
-
Filesize
2KB
MD5076123266cb8ed8e6a4cc7d16986644f
SHA12d36c12b3b48119f9694635f0b5b8faa7489b13a
SHA2563f80d609e84f3bcc826a6b3cfbdcdc6a1ae8d5c6902ea1fc587d6277da3621d8
SHA512fc1bd89aa81bdd0ddfa85bf162f8da160bbf8ad327f5150848e59c5bc1ce1717ba27891dda21d11ee8ae2b3abf375e3b317ad84ac72847354dae847bb4cc15ea
-
Filesize
3KB
MD580aaae4ed6791779417f827737922520
SHA1a1cca3eae772b5a94fd3b0c4cb93b18d78c9dd87
SHA256d1d4ab67d553fc039b060bb35b83e9d288264b5120b1cd6349a186146dfeabcd
SHA51236e75c8d800b4791f7b5949d46681c90152af34c288afec7ff078fa1f493882e51b5f4a696b7398c71959a2403e1b9f074d5eec83fee07a573e255f8316e9ee7
-
Filesize
3KB
MD5bcf227840b5b550a71e563490dd47ea4
SHA17506af13e101c39d10dc7aa6256cc4872427c8db
SHA256935bbb433ea34f8d54f30b0a09e8f86164a58308b5c0aaca9c8259309482c531
SHA5127285dee20741d71551ad6935ccdc0eed351d81d35e80cd31ac24f58db76ac5105a354b8a9c665babf8b5aae83581582e3a2b060ddd1f22e99072de08fcac5780
-
Filesize
1KB
MD586e47bae8ec409b0c48c26e01a1d2682
SHA153833ab83d705b443ed0c555e7d64b3748dff85d
SHA2562d3108562be33fb2a07c459334f2c69a5eb6c539b93298cb4bb47ce011876d52
SHA512a8ede48a2d333c8b44a2bb9d800e62ff2ad28a6062afa2e010fa78b7b5b7ad97918bef921f33486d5941e1582f4599ab0001af2baa5bd3a084f9174cb889fa79
-
Filesize
6KB
MD569a9151dbafa2b2d35ab1e86b44eb6c4
SHA14255f2ca62673bd697a5b02251f55243e45e97a2
SHA25655c454d71a57a5ce0f29e21321fae264c8561f1288ebd1cc09560f47a74ab6b0
SHA51288f49add3e68324652a8c80cefa8378d17476ca61fccbfd26efd2fd69e131a888f402e41fb57bfdc011317df56244b8aa539ea9953f6e96dfc2b0b8566d2c8dc
-
Filesize
6KB
MD568880419d0488295d94f15e120592678
SHA14c34bf9cee11e9298fb35ee31a85ed100d18d1c7
SHA25625d1be52bc92cb20a8b768cb450244e10102169b7fdf44e046562ca8ab711c78
SHA51221f71cdb4b4edae43a84978cc655d42eaa68f9036d745429d2e04d347192abe9456ab8909b35e6072ed3f59563452ceb669a5d25b0dc6535a33de0f73a3d4b84
-
Filesize
1KB
MD5ae12f27c4997661068933737b6318850
SHA1b3a28ad6260a63998df423033b74588642be0ead
SHA2568619361f933c1e73ebd62f0902ad8175510db8e44ad350c927df7be746b2ae5d
SHA5126efc19669eafe8a9c511cfabc836078dab4732565392d487b96ffb7b4750d1ebc8b0a11422799bbd464f6060f9a09127c75a5ac62118f882913680190c5621ca
-
Filesize
6KB
MD5cea11ea210cf2d8ccb3ad077058ff773
SHA1592a43cfee2f07d58d003e7bd00b3b595815bebf
SHA256819848baec2f34b771df5e10017a646b6d8ed240f78b494a2dda9bf7168dc5da
SHA5125caff142facca30b2751e87b47050086f63b9644a33d04874802b9a4ab5a81736e924ca05223b15d2446e372f28c68ab9a5d39cf6d8828bc6e0f631e17ad28db
-
Filesize
7KB
MD51f5beb4470939524c8cdbe2089b7e616
SHA18ed2e738efb8e38119fe33fbb59257bed324a5f0
SHA256db52d7055179696d4c6c1db0f9b8a1cfe921733492f1a379f0e5f01333367793
SHA512783bd6f21dfb5e4303aa866f6cbb1c420675b8d34e4352c18574474de6afe69443e5f0dad7e53f09f7014cca63fe576bb8728949fc10539c67a0d7cba3c5e91d
-
Filesize
1KB
MD5d19461dc548f231faf17c09a62647a87
SHA15460513cc070d2daf7954ab820f40556230e4a0e
SHA25611049f3605aac17c603cf98c71f771080357919d89468fa0403655fe45556355
SHA512097ebef3082a52d3d3c4faad1dc653fa8d8fe1c1265a23955761461d42ecdc811a8f03f71f95377b8b0b267eafce77669e6e637179363ad8f1136e0142efdb9f
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
4KB