Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
08/02/2024, 20:06
240208-yvqprsbh98 708/02/2024, 20:04
240208-ytg18sbh89 708/02/2024, 20:02
240208-ysb4laac9y 108/02/2024, 20:02
240208-yr4r8abh77 108/02/2024, 19:58
240208-yqcbksbh63 308/02/2024, 19:54
240208-ymx4wabh38 708/02/2024, 19:52
240208-ylw57abh26 108/02/2024, 19:51
240208-yk2z2sac4v 108/02/2024, 19:50
240208-yklytsbg95 108/02/2024, 19:46
240208-yg8y7abg62 3Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
08/02/2024, 19:58
Static task
static1
Behavioral task
behavioral1
Sample
AnyDesk.exe
Resource
win10v2004-20231215-en
General
-
Target
AnyDesk.exe
-
Size
5.0MB
-
MD5
a21768190f3b9feae33aaef660cb7a83
-
SHA1
24780657328783ef50ae0964b23288e68841a421
-
SHA256
55e4ce3fe726043070ecd7de5a74b2459ea8bed19ef2a36ce7884b2ab0863047
-
SHA512
ca6da822072cb0d3797221e578780b19c8953e4207729a002a64a00ced134059c0ed21b02572c43924e4ba3930c0e88cd2cdb309259e3d0dcfb0c282f1832d62
-
SSDEEP
98304:NzTZ3cINQscs0m++LNkT6OpwDGUUH57yvZ/49Mr8EO3QhA9Kq:Nzt3cINQscNmvLCwDkHEvZ/4R79x
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AnyDesk.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString AnyDesk.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2192 AnyDesk.exe 2192 AnyDesk.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2680 AnyDesk.exe 2680 AnyDesk.exe 2680 AnyDesk.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2680 AnyDesk.exe 2680 AnyDesk.exe 2680 AnyDesk.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3004 wrote to memory of 2192 3004 AnyDesk.exe 86 PID 3004 wrote to memory of 2192 3004 AnyDesk.exe 86 PID 3004 wrote to memory of 2192 3004 AnyDesk.exe 86 PID 3004 wrote to memory of 2680 3004 AnyDesk.exe 85 PID 3004 wrote to memory of 2680 3004 AnyDesk.exe 85 PID 3004 wrote to memory of 2680 3004 AnyDesk.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-control2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2680
-
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-service2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2192
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4664
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
385KB
MD51ce7d5a1566c8c449d0f6772a8c27900
SHA160854185f6338e1bfc7497fd41aa44c5c00d8f85
SHA25673170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264bb8ffaf
SHA5127e3411be8614170ae91db1626c452997dc6db663d79130872a124af982ee1d457cefba00abd7f5269adce3052403be31238aecc3934c7379d224cb792d519753
-
Filesize
9KB
MD56b4a2da79cf1f8f0d8d4a1650ef2830c
SHA1c299c893d353351c4657ae1eb8546c2b57eefa84
SHA256374a5691fcaf325aa2471717be5bf554dac27fd560c62a427f21a9806587d92e
SHA5129907ad71b95fcc32c3423eaa271020e20d47b9c8a97697cd0068a1e57a4f152f5c62dbd0fb5e2b8cd397c743dc8bc458d46a6f2998622d0a800ed19720be9f07
-
Filesize
7KB
MD588df187c112579fa24e48aefc4ef04ac
SHA197c1ce6d67757a435caab435176f872b607eb050
SHA2567e462fc547328fd5167aa0c066df7f83881b616fc3420ea769c081d63d1d01fe
SHA512f0c2e43dc348e304ddfcbb43ffcb41a33b603132437431e3ab307da2f70b2ae3cfcecb4820367b31e8044620d740384479a34583b8a8d9eb203aac3b5e917d9c
-
Filesize
2KB
MD50a05e7c27c2ab0f0f902d4517f1ec139
SHA1082ab0e6ab71698cec2dd3e8f781a957009e8d35
SHA25663c94dee49f6559c9603690efd54309e3df64fe389716927b6cd906f2cc32b88
SHA512474587189a593238d40fc343fb3b5ee6da851bdab3c63c6df29bc2ee8ee160e5a5f5bc03f7275d2209cd21beed9d5c6c0fef6d977c5bb2e0e50298e617693ec9
-
Filesize
2KB
MD58ca2f629f6a6f80611b237bf34559c37
SHA1b38eda353876e1e9d135118433eeba1c292451c6
SHA2566069e728ce2ff6412c4e93efd485ab3bb0919657c4afb39bdbeaaa316c8efa38
SHA51267994fa808f7e43827b893f58f27245ada002310cd3d150084ea027fe6f4576534fab1dad7916d2100653ce4e35a3efac75604570172df6fff1783d4105ba88e
-
Filesize
681B
MD5ae93740e68f25eaa1d2069e873d73519
SHA1b3d256a0a90ef7b2071a4340514f5034ab1af175
SHA256dc320a95ea6f36bb75b8d573715ca1412696cd1a3cc81611191caaa003f4c585
SHA512ab1f99bd8c4d499be7eec8e2dff3dda2ae6ca7af2746dcf48781570a923cc83e1cd96108af21d3465c91c535d4f57746b1356be31f4807f6e1396b91bdb30cdc
-
Filesize
802B
MD5894301078150133aa6b9ca32bab81682
SHA1c099a3ff7075d6f98ce6d930354a6da7d3d6d076
SHA2565f42b6795472a4d85c6d98ee736674010b95146d312764472667cdc658973a48
SHA512f3d5682c217519c3693f8c037c61b351bc1c6b54067d5fcc0ad0faf8579dbeee714926a9383ab710d846056d26b8505ba9426d9dc8ffb81426cc81681e6f83a8
-
Filesize
312B
MD50c04ad1083dc5c7c45e3ee2cd344ae38
SHA1f1cf190f8ca93000e56d49732e9e827e2554c46f
SHA2566452273c017db7cbe0ffc5b109bbf3f8d3282fb91bfa3c5eabc4fb8f1fc98cb0
SHA5126c414b39bbc1f1f08446c6c6da6f6e1ceb9303bbf183ae279c872d91641ea8d67ec5e5c4e0824da3837eca73ec29fe70e92b72c09458c8ce50fa6f08791d1492
-
Filesize
424B
MD58e55b0e437d6deb048fbc4ff6ba44376
SHA1e79a87637647a9b619f8df1510b6eef36a76f2ec
SHA256b7e777a9f23b717cf50c21377150e14d0384593a286a1ef4d42d47122d658e36
SHA51284cd5f0ae859dfd015266f26348454ba96f3b9cabf52c223b792052118d6ad3962f7f9d92e4dfacaf142c665ba3ad12f53520dcdf0f4c993dd62e84bd20efe4e
-
Filesize
424B
MD54758e24312b6739df8a2b4e53834b1fd
SHA1baea6a8087959e057ebeb1fe5fec67bb53e2927f
SHA256fbb4544eebcb827ae216bb230cb0d3119248715023d929921bb18702a06c517a
SHA512fb85f5d30e33ce4c0a7757d57eb84c90caefb4a46f379a653c621e62f1b25b0ad9bba5a8a468e087488e422aef06d41556e2c45f35167b46974ff5a6de6ef011
-
Filesize
2KB
MD52c24392a5e5fa8a26637d43ee1a8300a
SHA10a8df0234461a28c94f8a190514b9dd1b77ac931
SHA2562851f55d07667dcf037dc8836fc574dc61c255024be01794491df8d319edb9e3
SHA51225d31a8e50a27d1aef2ac979bef483e3a30d2e038c85623f40e6864b883bee6fb641895ac4ca9097b16e260cc26e590be30d8fdf5900f2a443b07d35f96785d9
-
Filesize
2KB
MD596bbfeb45c1bedbdf9a15bbf54fc40e7
SHA1ca476a2bb98d52331221603b86757aa2cdca8598
SHA2563d65faa9eab4185387530756c3f28890309150f32b0eff462bcf40003dc7dcf3
SHA512516126ba1d61c72e45236f335e86f2de063f97e434eb87904ed9986795d09b8b36b279d236c05d18e00e3bb4a0f3011e9ba09b62b5d63674fb31cf4006b522f7
-
Filesize
3KB
MD5371ee7c687a09c71725a576a6e714712
SHA1e0e71df6116e36176aa5d8c6e07fcbf5b70015ae
SHA256095da621d290fbc560a1fe102678ff1957f4eb34f3d12d054ab52c235781362b
SHA5125c457c7926d8ee8eb2fcf8f1c2bb3cab2e8113c7af0832e449c92fea5a1f4ab19bedfd7c6b326da7ee54d6266ab1f0eed0a43f663a69599eff2ba981d28a327b
-
Filesize
3KB
MD5e27fc320461c8f9061b5992a7fce9b7d
SHA1cda5526f33e0c30a10b5835988977d9c3d34eb08
SHA25623f2f414eddbac2208e2cb21c56e686f6d18dc4622fee9e573c9cef9c7a121bc
SHA512fe89cb972ead7097c8c93eca3f6f3381d86d0a28df01eeaa2ff40403e17ecbb347ee13f15fc9d1226ee7c362acd399da9ffc1a5722e123cc35f8a7c8cfe5a0d4
-
Filesize
6KB
MD53890a38752e166cebf60d24c548113a1
SHA142d7de5b3a097a8df1504362c9aad4e9aa9bd9d8
SHA256d41fa0dbf3d2a789bb1aa919a2ce20111b9d90650d480676e07c73efd3c83590
SHA51275ba4e89c7c939dd20c86bc623cb3c397742d646bf9bcc709cf50f330daa2557c9ea6ecc925f834bf6740bf455fbc99ab5d1f4f124a76e477ca4c93e6321ea6b
-
Filesize
6KB
MD5e2f1fa3975366f8ab59629b5d4413561
SHA12a27100b9d06eb13db43f3846cba917b8523cc4a
SHA25698474ec17ca4e33a796d3f1e5ae87d9aaa3a08a3bdf7263f1f0646af9f2087a8
SHA5128829d00fabebb6605396c4641c8b42c3aa2902bceb82438520b2c5beb50860d57ae21454fee7e4b130cbd572f3f82e1618c36886f227aab0a785254b6328ceea
-
Filesize
1KB
MD535d5cee39bc87855dfd95e403128ed79
SHA1a829374dcecb2034be03ddfdc5f453b4bf4bc24d
SHA2569af887aa45d84d3c31bf03e140694a811f3114589b1d89918a7c7848030603ff
SHA512d00e1866cdc7d7c6b3cab57a0d946ed2a0192c4b72687ea29c703a24fd07dca0263a731b947f0afddc3f99e771289bf6ff4ca7282da578acc38581bf683c575d
-
Filesize
6KB
MD57c08f0856d46f4109db3588c316e2080
SHA1722cb58f5dc2812efb5eedffc88e8ff5534369b5
SHA2567db98b1a3541332912f5b4be0224d6d7f2cca804a4daae206abc022efed44a1e
SHA512432cd3854af07fb23f62613a075c8c2bf05c7a74de444f576ac0aaf3768e1fed8dae911acb972c313df86febe804468736eaf22d18705ab234e9c7980317fb63
-
Filesize
6KB
MD50baeb7d1d541624768a80338562ea9e7
SHA17189f4ae9c70207b5d8d8c3444cfa3abfc55bd37
SHA256988a2aecfd6542f0c57f881bfb70a8a6abff29dc83a14160d778055b9271a44d
SHA5129a66cb53885bb53ef45ec164625f967130a95432e5ba442c310203d3464da1f54dc83a9b5be450cbfac970f55795ddca57dd4f8961a0cb97a95fecc3bd7986cc
-
Filesize
1KB
MD58a8217840ad7010541126dc7a7a4203d
SHA1b09f149d919291ee79bfbff4e5e2ca1b707bcb23
SHA256e50185c46d74453e9102a6fa3527cc393b1f619538260f35d0109188ee1cfe64
SHA512147bd21022d22234ae3d05c639892c7c9ba5bcb5e1051e41a4e6f1c599618a3f189846f69b0d30bfb51d99f3c574430bf902b0a87437de92d5d3afea6d79f5b6
-
Filesize
1KB
MD516931007e7e4cf6874cf4e25c62f714c
SHA1913b60fc2e28f1ade3ba85c5c9a3d3b4684beb79
SHA2569586441f47c220f80868c35d2644e87646d2ebe46e8a77b0b551803f7e621e31
SHA5123c3bd30e782933eb4efb2e1ae0e8476553d10f98fba120e6b352fdc2faa1baab76a226b7616f36ad18357acd83a5fc9ffcd8b262e48a0089ce8b093f9639a9f4
-
Filesize
1KB
MD5f63a9be57dfded08764250b961457ced
SHA1fc4a65d64202f8af1d8d2904922e116d207278ee
SHA256fc89ae7f10aadf3dd0d6aaae017b319b08e8af54273b0297d3892b5c092d06e9
SHA512addb3511ddfc058752ef9b4c6388436c745091f8564cc79042b3605b1f8ddc5df677deabf4bd8491a1c2b982fe9365e33f5ecaa740195003c0c3ebd547f0ce70