Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    47s
  • max time network
    88s
  • platform
    windows10-1703_x64
  • resource
    win10-20231215-en
  • resource tags

    arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
  • submitted
    10/02/2024, 22:29

General

  • Target

    AnyDesk (1).exe

  • Size

    5.0MB

  • MD5

    a21768190f3b9feae33aaef660cb7a83

  • SHA1

    24780657328783ef50ae0964b23288e68841a421

  • SHA256

    55e4ce3fe726043070ecd7de5a74b2459ea8bed19ef2a36ce7884b2ab0863047

  • SHA512

    ca6da822072cb0d3797221e578780b19c8953e4207729a002a64a00ced134059c0ed21b02572c43924e4ba3930c0e88cd2cdb309259e3d0dcfb0c282f1832d62

  • SSDEEP

    98304:NzTZ3cINQscs0m++LNkT6OpwDGUUH57yvZ/49Mr8EO3QhA9Kq:Nzt3cINQscNmvLCwDkHEvZ/4R79x

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 15 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 17 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 36 IoCs
  • Suspicious use of SendNotifyMessage 35 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AnyDesk (1).exe
    "C:\Users\Admin\AppData\Local\Temp\AnyDesk (1).exe"
    1⤵
    • Checks processor information in registry
    • Suspicious use of WriteProcessMemory
    PID:4788
    • C:\Users\Admin\AppData\Local\Temp\AnyDesk (1).exe
      "C:\Users\Admin\AppData\Local\Temp\AnyDesk (1).exe" --local-service
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3336
      • C:\Users\Admin\AppData\Local\Temp\AnyDesk (1).exe
        "C:\Users\Admin\AppData\Local\Temp\AnyDesk (1).exe" --backend
        3⤵
        • Drops file in System32 directory
        • Suspicious use of SetWindowsHookEx
        PID:4248
    • C:\Users\Admin\AppData\Local\Temp\AnyDesk (1).exe
      "C:\Users\Admin\AppData\Local\Temp\AnyDesk (1).exe" --local-control
      2⤵
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4716
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x2dc
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2376
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3116
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
    1⤵
      PID:4296
    • \??\c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s Netman
      1⤵
      • Modifies data under HKEY_USERS
      PID:3544
    • \??\c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
      1⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:1456

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\gcapi.dll

      Filesize

      385KB

      MD5

      1ce7d5a1566c8c449d0f6772a8c27900

      SHA1

      60854185f6338e1bfc7497fd41aa44c5c00d8f85

      SHA256

      73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264bb8ffaf

      SHA512

      7e3411be8614170ae91db1626c452997dc6db663d79130872a124af982ee1d457cefba00abd7f5269adce3052403be31238aecc3934c7379d224cb792d519753

    • C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

      Filesize

      38KB

      MD5

      c1e4515617374dbdef5637b33339c0aa

      SHA1

      124d00d87042e5e96a9ddd613c783708184e5915

      SHA256

      5ae58f6f36f2a66c896584c8ae8f017caa0476b23631b2ccf97ea093fb8cc94c

      SHA512

      2050785abe92afd45ec5372fd97b0e8f8f6c7a1ab91b319f4763051f7fe733917f7b137602decf4e0b379e969283a86f43558703e523700bf0a7b57dbc9a4d44

    • C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

      Filesize

      5KB

      MD5

      07bb052086fcfc7db34c5d53a06ac60a

      SHA1

      72a59b11ea3b99ade7c46794b2fb8645bdc4dce8

      SHA256

      84bf662243a22e1edb9116037c2a3a80d785869a7c36d33e0bcd88fbda477201

      SHA512

      c56dd2de7440356369c45d0985140352f65ffb342a678f3fbd2e37d23bd819aa3d81a8448a2c9d61173d8eb38ab6b41bd8c3f63fb4783eff7ffb19116d952d23

    • C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

      Filesize

      9KB

      MD5

      9ed0083fd89b2f8b90acc15aba72ef5c

      SHA1

      801d7d509349eab19bf979abeeb1755a01ae7c4a

      SHA256

      ce804357605933af881feafc35b60491028c28fcff8fe4ff4e5b65f7ffa14cc2

      SHA512

      54c32b49148977a937cb8e30c46c8649087cb1a8a5aa54de12ab198675119154678cc19145ea29966f2391fec8818df896bddba8828f9d31fadb894bf3ea3f7a

    • C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf

      Filesize

      2KB

      MD5

      d1a76c31e39147d586f262d8365267a1

      SHA1

      078e1c1f76770b29f004a70e9a4cd56685901b3b

      SHA256

      086647815820cb206a1bef0878285aff7b9d7480aa029f09113cf1afead21d7a

      SHA512

      96e21d758e980e29f1717d9111a9d86f005a421c5ba8371384cacbabc2492d4a125a4906343e918eaeed9bf7844537bd09a2567e2fe125027217cd936edf578e

    • C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf

      Filesize

      2KB

      MD5

      0f4b89306c27546acae9207429f3a74c

      SHA1

      a2f2fa94d463dc60de0c16392c645f58c6e4ed55

      SHA256

      a19c185815988177c554552fd6e93405213b0a11de4ec19bb6fe07a17db09046

      SHA512

      99765311673f7d7c887fc35ae92ef01317dfa85c9d772cbbcb4f0d275452013188ce5e9bd97dd435d36ede91ec182e633acfc34ed56c739cf816ae8ce1d0b1e8

    • C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

      Filesize

      680B

      MD5

      53686f6776ecd3637e7f007518eaa4e0

      SHA1

      34eb92d8c576d32b13f22641ca463d9b3e8c8d0c

      SHA256

      efeb2167c954b1f3e7a123f9b5c392238bd1555cd8897eb73fd1b1588f19756b

      SHA512

      4b467826e748199bd02fe309322ffdfedd77aabbea3a0515b4e133f0aea14dbc53602ff287f21511a9bf9b1ea9cfefcaa067c821451236b61527dd7b164ed8d4

    • C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

      Filesize

      801B

      MD5

      a0b90a5daeb9b95fc49d1b07b9908d86

      SHA1

      6da439265033fa25143beab824a79666aa8fd9e4

      SHA256

      47bd3ecf1c871561d0d451b3283b2a74fac75e4fd5b5a5c31a5486b4ec331e06

      SHA512

      6506b26b311d9dc2e7fec86f71c73fb0a0dd09b4ce4753417219f99df5af52ccf2fa9877905affd2c1c6b807364d8d1c87c3db881c91e4bb66939a7e38e45c79

    • C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

      Filesize

      312B

      MD5

      0c04ad1083dc5c7c45e3ee2cd344ae38

      SHA1

      f1cf190f8ca93000e56d49732e9e827e2554c46f

      SHA256

      6452273c017db7cbe0ffc5b109bbf3f8d3282fb91bfa3c5eabc4fb8f1fc98cb0

      SHA512

      6c414b39bbc1f1f08446c6c6da6f6e1ceb9303bbf183ae279c872d91641ea8d67ec5e5c4e0824da3837eca73ec29fe70e92b72c09458c8ce50fa6f08791d1492

    • C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

      Filesize

      424B

      MD5

      b5b6382d9a42c792dda2787b92f36c09

      SHA1

      0c0f1e22a53562087128a7bb717c45d498583487

      SHA256

      5df3158e0a9e1c9ca3f32b7d975bb632c5a1f07e5c40fda699ee26901e91560d

      SHA512

      f531a80c5e11d2e284887ace3e657aa18846ff9a213d1e4cbb422604db11b248a4eeee6dabcacfd0f794ef9cc4d05f538710d73ad736d838ef05f88243bbdc4f

    • C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

      Filesize

      424B

      MD5

      bc65265be45cb2e26cb875e0d51e394e

      SHA1

      a6f8f3ea607bcd77e24ac86ab988dab9d2fe83d9

      SHA256

      467791ef816d7fc811e27c175e9d54a03bc1f46cbee07d9d140c94ac0b7f0d2e

      SHA512

      ad812c8d897edc4901d8eae404d65dc7b1bc58a984aae9d30960e1a846d140f5a6a8d2ad282cdd4d165075127575ca659103a5256842e66a7ddc57ba29488c16

    • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

      Filesize

      2KB

      MD5

      276c5aeba54a8c86276ce24116267a87

      SHA1

      02316dfce05bf9f663e2263c3ccb351348725e4d

      SHA256

      e16bfd10cfb787b07e62a12171e3f3be3cc954306d8adec2351e5aa48529b95a

      SHA512

      69d529fe4284401d47b69334fa763f26d888d623e749b3baa83287a90c2d2636fca5a9df42abc8c2d4adbcad9389876fe8632986074a307a11d5fbc3022200c0

    • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

      Filesize

      3KB

      MD5

      7723fd5666d76771f1feb302aa42eed9

      SHA1

      b4b4fd3b450e61919b9f181ed09dfad5f03c995d

      SHA256

      7b30ede2e391cca3753cfc95b19192bafbbb86801bb0e2e585ad811267d3293a

      SHA512

      107fdf1434138b33d53e2ecfbbf49313fb3a4b928cadc32a0298c28fea34c69e3b5abdd496aad881fe5137cca187abec55420dec3b9cc5e7ffbc456574eca640

    • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

      Filesize

      1KB

      MD5

      29daa2b7662e7cd27d27dd5d56075b2c

      SHA1

      869f66e30958d4c0dd0adb7337a5c31989f9b252

      SHA256

      232771d982022f0dbd4022664fd5620ec58e07a78736c60e05c8894e93226776

      SHA512

      2f3c4e370d480323d30ca3879e9bbe6f400c781e83f96121cba6f9e74df533f7128b6844143fa6ee5bb120dfa4feb8dd76398c641c7b34b357b61e33b61f82ef

    • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

      Filesize

      6KB

      MD5

      cd6831faa2903526aca96adb34002ff7

      SHA1

      4a228d6e92a13243a642177af368c7c3c2004187

      SHA256

      f96f1fd2b88b5cdc2bd2194ea9153a2c3f984d00c77b82cc15ebd689cb9d27f9

      SHA512

      306944bb713f1c109176e5c5e256e0c9e5cc82039c7dc30b3862af6856931b7b6b9b3bc299f404c40ed5f9fe6af160ba2bdcb30d2fec2ddb5690cf8024da6580

    • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

      Filesize

      6KB

      MD5

      6094e645552b332b7186ab4b744c0cf7

      SHA1

      ee6e90bd42ca25153a85f3fbd599299603b734d5

      SHA256

      d64d3df556b28ebd270fe38f7d924f4e3a29ccaa3f9b84fba75b323640143545

      SHA512

      85d79e8995e57742366b1f6817df3318edf9101055c2635a82b5af7fb536a3301236741b83f3049ed0f71b03bdbd27089d5902d2916c33c50f82208c88e9ba1b

    • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

      Filesize

      6KB

      MD5

      5a3b7c5b89c5cb1ad7630f0176e1f327

      SHA1

      2d64bc8e2483a00230e164ba9147ba114d33e4f3

      SHA256

      408b26a61dbf3e0cfd9bb42872fd163fad833d4eb03f8fc449ab355e34e79e8f

      SHA512

      87e2a215e921601bb41a58cf6bdff17232821e4dc1ce69a81680d6b7a94dbb949febba6a5d56b06236961bdd483967d5ceebb52c6e2abfb63cc5bd67b198e794

    • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

      Filesize

      7KB

      MD5

      83cc73ceb018af851edc626c8187ad7b

      SHA1

      fd92ce716c9c9fe969947d74e89cbdd0bb0fb002

      SHA256

      11304f39e3143de36c73c3f8139805d9e0eec7bdd7078a368ec706b1a467c103

      SHA512

      addbed560d0f4243e3a5d4bddf140909571e511360c66e902bca3662b11812f2698731074b00cb2bb21a41b94eecc46d88a6d126165a64ee072dd32fb84d1734

    • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

      Filesize

      1KB

      MD5

      650fad86c1875ec25b44a28a535ae4e1

      SHA1

      cceed55bc23b7c59ac285a57a58fa12fbf8057be

      SHA256

      aae79902ae3e323b5371096fb47a14a47b816a48aba0f2df3d42802c26d8dd71

      SHA512

      fede429c64401a0df618ef60792d481ddea3f0d181a96f8a8c13882015e7d1fdef5ce28418a30d63da36eabdcf0dc02e9eb82603ef019563140c27153bd56cef

    • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

      Filesize

      1KB

      MD5

      506c1028c0a8e83a60cf252a91722d93

      SHA1

      1f4aee3a1e3b2c89451a25b2a897fdda9a5157d8

      SHA256

      7fc2c11454b82684c290a2b61091de519d91262625d98e449c2c4fd15cee96f9

      SHA512

      0c12c36300ebeb0b73c81bab3b23927e8860bfe00d1b467f8e77e2cade8b2516b3c91fbb093a2c2d47f349af60109cba89690ac77050f586174be290a2c58f7d

    • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

      Filesize

      1KB

      MD5

      75ecb1fb6aa587efc413ff49fd5a61ff

      SHA1

      9bb65da2d0e898f85ad00e3487b02701eb78614d

      SHA256

      25807f5704f276cf64ceb03ce5867efb029c4a79b666d8fd1c822ee9604e85b1

      SHA512

      4e400d9bb5e418c8f6a4a6652cc3cc6da96e640ef7d4b06cb752e2fcf2a14431d99ede0ae4b1c8cb778952be1918f78ce4b393985d5bc0c23a23dc3aa6e4deaa

    • memory/3336-27-0x0000000002260000-0x0000000002261000-memory.dmp

      Filesize

      4KB

    • memory/3336-19-0x0000000000A90000-0x00000000021C7000-memory.dmp

      Filesize

      23.2MB

    • memory/3336-275-0x0000000000A90000-0x00000000021C7000-memory.dmp

      Filesize

      23.2MB

    • memory/3336-265-0x0000000000A90000-0x00000000021C7000-memory.dmp

      Filesize

      23.2MB

    • memory/3336-221-0x0000000000A90000-0x00000000021C7000-memory.dmp

      Filesize

      23.2MB

    • memory/3336-12-0x0000000000A90000-0x00000000021C7000-memory.dmp

      Filesize

      23.2MB

    • memory/4248-223-0x0000000000A90000-0x00000000021C7000-memory.dmp

      Filesize

      23.2MB

    • memory/4248-255-0x0000000006280000-0x0000000006281000-memory.dmp

      Filesize

      4KB

    • memory/4248-268-0x0000000000A90000-0x00000000021C7000-memory.dmp

      Filesize

      23.2MB

    • memory/4248-267-0x0000000008A50000-0x0000000008A51000-memory.dmp

      Filesize

      4KB

    • memory/4248-264-0x0000000008900000-0x0000000008901000-memory.dmp

      Filesize

      4KB

    • memory/4248-263-0x0000000000A90000-0x00000000021C7000-memory.dmp

      Filesize

      23.2MB

    • memory/4248-256-0x00000000061C0000-0x00000000061C1000-memory.dmp

      Filesize

      4KB

    • memory/4248-254-0x0000000006270000-0x0000000006271000-memory.dmp

      Filesize

      4KB

    • memory/4248-253-0x0000000006260000-0x0000000006261000-memory.dmp

      Filesize

      4KB

    • memory/4248-252-0x0000000006250000-0x0000000006251000-memory.dmp

      Filesize

      4KB

    • memory/4248-224-0x0000000000A90000-0x00000000021C7000-memory.dmp

      Filesize

      23.2MB

    • memory/4248-227-0x0000000002680000-0x0000000002681000-memory.dmp

      Filesize

      4KB

    • memory/4248-251-0x0000000006240000-0x0000000006241000-memory.dmp

      Filesize

      4KB

    • memory/4248-233-0x0000000005F50000-0x0000000005F51000-memory.dmp

      Filesize

      4KB

    • memory/4248-234-0x0000000005F70000-0x0000000005F71000-memory.dmp

      Filesize

      4KB

    • memory/4248-240-0x0000000005F90000-0x0000000005F91000-memory.dmp

      Filesize

      4KB

    • memory/4248-239-0x0000000006170000-0x0000000006171000-memory.dmp

      Filesize

      4KB

    • memory/4248-238-0x0000000006160000-0x0000000006161000-memory.dmp

      Filesize

      4KB

    • memory/4248-237-0x0000000006150000-0x0000000006151000-memory.dmp

      Filesize

      4KB

    • memory/4248-236-0x0000000006130000-0x0000000006131000-memory.dmp

      Filesize

      4KB

    • memory/4248-235-0x0000000006120000-0x0000000006121000-memory.dmp

      Filesize

      4KB

    • memory/4248-241-0x0000000006190000-0x0000000006191000-memory.dmp

      Filesize

      4KB

    • memory/4248-242-0x00000000061A0000-0x00000000061A1000-memory.dmp

      Filesize

      4KB

    • memory/4248-243-0x00000000061B0000-0x00000000061B1000-memory.dmp

      Filesize

      4KB

    • memory/4248-244-0x00000000061D0000-0x00000000061D1000-memory.dmp

      Filesize

      4KB

    • memory/4248-245-0x00000000061E0000-0x00000000061E1000-memory.dmp

      Filesize

      4KB

    • memory/4248-246-0x00000000061F0000-0x00000000061F1000-memory.dmp

      Filesize

      4KB

    • memory/4248-247-0x0000000006200000-0x0000000006201000-memory.dmp

      Filesize

      4KB

    • memory/4248-248-0x0000000006210000-0x0000000006211000-memory.dmp

      Filesize

      4KB

    • memory/4248-249-0x0000000006220000-0x0000000006221000-memory.dmp

      Filesize

      4KB

    • memory/4248-250-0x0000000006230000-0x0000000006231000-memory.dmp

      Filesize

      4KB

    • memory/4716-11-0x0000000000A90000-0x00000000021C7000-memory.dmp

      Filesize

      23.2MB

    • memory/4716-33-0x0000000002650000-0x0000000002651000-memory.dmp

      Filesize

      4KB

    • memory/4716-222-0x0000000000A90000-0x00000000021C7000-memory.dmp

      Filesize

      23.2MB

    • memory/4716-266-0x0000000000A90000-0x00000000021C7000-memory.dmp

      Filesize

      23.2MB

    • memory/4716-26-0x0000000000A90000-0x00000000021C7000-memory.dmp

      Filesize

      23.2MB

    • memory/4788-104-0x0000000007960000-0x0000000007961000-memory.dmp

      Filesize

      4KB

    • memory/4788-220-0x0000000000A90000-0x00000000021C7000-memory.dmp

      Filesize

      23.2MB

    • memory/4788-219-0x0000000007970000-0x0000000007971000-memory.dmp

      Filesize

      4KB

    • memory/4788-23-0x0000000006300000-0x0000000006301000-memory.dmp

      Filesize

      4KB

    • memory/4788-4-0x0000000002B90000-0x0000000002B91000-memory.dmp

      Filesize

      4KB

    • memory/4788-22-0x00000000062F0000-0x00000000062F1000-memory.dmp

      Filesize

      4KB

    • memory/4788-0-0x0000000000A90000-0x00000000021C7000-memory.dmp

      Filesize

      23.2MB

    • memory/4788-99-0x00000000087B0000-0x00000000087B1000-memory.dmp

      Filesize

      4KB

    • memory/4788-2-0x0000000000A90000-0x00000000021C7000-memory.dmp

      Filesize

      23.2MB