Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
160s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
15/02/2024, 15:01
Static task
static1
Behavioral task
behavioral1
Sample
AnyDesk.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
AnyDesk.exe
Resource
win10v2004-20231222-en
General
-
Target
AnyDesk.exe
-
Size
5.0MB
-
MD5
a21768190f3b9feae33aaef660cb7a83
-
SHA1
24780657328783ef50ae0964b23288e68841a421
-
SHA256
55e4ce3fe726043070ecd7de5a74b2459ea8bed19ef2a36ce7884b2ab0863047
-
SHA512
ca6da822072cb0d3797221e578780b19c8953e4207729a002a64a00ced134059c0ed21b02572c43924e4ba3930c0e88cd2cdb309259e3d0dcfb0c282f1832d62
-
SSDEEP
98304:NzTZ3cINQscs0m++LNkT6OpwDGUUH57yvZ/49Mr8EO3QhA9Kq:Nzt3cINQscNmvLCwDkHEvZ/4R79x
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2F6E8081-CC13-11EE-979B-76D8C56D161B} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 10 IoCs
pid Process 2224 AnyDesk.exe 2224 AnyDesk.exe 2224 AnyDesk.exe 2224 AnyDesk.exe 2224 AnyDesk.exe 2224 AnyDesk.exe 2224 AnyDesk.exe 2224 AnyDesk.exe 872 iexplore.exe 2224 AnyDesk.exe -
Suspicious use of SendNotifyMessage 9 IoCs
pid Process 2224 AnyDesk.exe 2224 AnyDesk.exe 2224 AnyDesk.exe 2224 AnyDesk.exe 2224 AnyDesk.exe 2224 AnyDesk.exe 2224 AnyDesk.exe 2224 AnyDesk.exe 2224 AnyDesk.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 872 iexplore.exe 872 iexplore.exe 2708 IEXPLORE.EXE 2708 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2740 wrote to memory of 2440 2740 AnyDesk.exe 37 PID 2740 wrote to memory of 2440 2740 AnyDesk.exe 37 PID 2740 wrote to memory of 2440 2740 AnyDesk.exe 37 PID 2740 wrote to memory of 2440 2740 AnyDesk.exe 37 PID 2740 wrote to memory of 2224 2740 AnyDesk.exe 38 PID 2740 wrote to memory of 2224 2740 AnyDesk.exe 38 PID 2740 wrote to memory of 2224 2740 AnyDesk.exe 38 PID 2740 wrote to memory of 2224 2740 AnyDesk.exe 38 PID 2212 wrote to memory of 1644 2212 chrome.exe 46 PID 2212 wrote to memory of 1644 2212 chrome.exe 46 PID 2212 wrote to memory of 1644 2212 chrome.exe 46 PID 3044 wrote to memory of 2560 3044 chrome.exe 45 PID 3044 wrote to memory of 2560 3044 chrome.exe 45 PID 3044 wrote to memory of 2560 3044 chrome.exe 45 PID 872 wrote to memory of 2708 872 iexplore.exe 48 PID 872 wrote to memory of 2708 872 iexplore.exe 48 PID 872 wrote to memory of 2708 872 iexplore.exe 48 PID 872 wrote to memory of 2708 872 iexplore.exe 48
Processes
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-service2⤵PID:2440
-
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-control2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4076 --field-trial-handle=1296,i,13230403372960123811,13493795791215324988,131072 /prefetch:81⤵PID:2228
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xbc,0xc0,0xc4,0x90,0xc8,0x7fef66f9758,0x7fef66f9768,0x7fef66f97782⤵PID:2560
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:872 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef66f9758,0x7fef66f9768,0x7fef66f97782⤵PID:1644
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD597f69675053d3ce264741b09f2a09c04
SHA1b2db2391b2f8ddf685153c8e2a9c68987e07abf2
SHA256e7b710d6c311cc49eb554aa7dc72c565560232f8982d575efefd5543ae198d7d
SHA5122425db94d31e12dab2d8f802a2eeb021348c27a803044bb04f6e7d7631ef8a5e98d444ccc17b8d0ebacf4fe2b5f2eebd979275002f08e920f8d89781bbc15373
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50d57cfb2d469eef1264337ce7ef88b8c
SHA1f35d2a3a5f8706a0726576a45b5cb9fd2176706c
SHA25670d52749e05d0f12eb91cdc29237ac317784bc2a8c17968109618b05aeab7d96
SHA5127a92b9ba02168fe5ff8bb1d5db02d96c3f2275aab1161d26e33e9a2531f058e058213dac21291ea4cdc7a24815904635f795a8faa958ba4ba4909bbfa368a32b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56dfa67d5cb42aa773879f5682db56e7f
SHA18308cd2305c6175922413ea925d81f247f08256b
SHA25669d412fca4a23f1e6c3667c7493d393416d1b388d47d891f2040fd7f64b91d23
SHA512f597e56e5f1ee3a57cd943baef4a2702b6d5ad5a0b41859e7a2aa4aeea3ef0077348c527bc503a8e34b10a5c3906553481027c36e8dd975cce6604ca94e6e9e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58e90d3ad765aeebad1efa4dbec360549
SHA11bd0698f5ce1e5ed73b7e5c403e21cdf2a93a269
SHA25664b50ed2f2757e5e1d9fbcd55bb3b237e33117549d68e96bd272439b2f3c2a29
SHA512b82e2bf45898a2f8f7b5e6b39a933f569090ecc86c55c57a9e8f884175b3e90e371e8659d72756a90a4e8f82abaa2c1c8c3c1024f58a82769038044ebe2b0ba1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5559589ba8804731e963041a32de5ee59
SHA175d1abdbc891f4f09e396f376165f19d965a896d
SHA256c30fb583c3e6e31c9a9a3ec22339963c24fa0acf94166341278a7e8e86180bf5
SHA51213bd828b11fc33b6bbe3d6b58fbfc5e8e83d4c6c495a4c34d05bcd3d61a6de5fb5877a569e0b813bc741bd8ec66ed1eb53acca5d65eba15250e6bddb959ac3fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD566a156780e4ddd7141038e1362e6ed3b
SHA18b0aa62da83a7c3b7bdac52d8eb8a50cf20cb678
SHA256983afea018f4d578aaff0ec961faf3bde8d263a4a310652a8bd6b16382063b25
SHA5128f4e17102e9e6d920bb36642bb495c28d10efdd26222cb0810355f225b7d2c236ded92d3f5cc6ab2b5f83d56e3f08992d04c37ce269d2d687b1541ff1a6cc780
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e52502ef8e7b3b509b58aeb7a0d4b874
SHA111212c6da36fac4f51526f1aa290b812120c14c3
SHA2564a1d94e975e083f27f8197c71175949cc18f53c8caf23687d0d7aa8b28d1f39c
SHA51213ebb66049d83bb7f119dab2d80b60b5f51ca5b9948f57947ac0d85d56d865f6f79fa6897dded9907cdbab85ccf8a5ce14a3777ccdfe74419bec05eb1cf00f53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d0053fe8141a8eb74d6f4cdb731ab16
SHA12826062267e80365fbe82f5ad7a7873c208ebaaa
SHA2564e3932e669346e84e3368c8a9f14b0995aef5e6cb0cb14128b575eca5585c0f4
SHA5127e7ef229283a43259c605b211e0131227174783db75013c39efc05df38258f3b62a4e06585541922e2cf38270a64746e75cb5fb7235f6c8f3b3500d35befedef
-
Filesize
40B
MD511b9ef326a4851ce75c5768187b8d574
SHA1ebec9cc2871219a70441db5dbab6d6c1e73b70fe
SHA25692e236809af52434ee84e9dd0494b4748b40d3b6729a76c9f5d456dee9e6c7bc
SHA5120e8f39bcb557a7ab92db8e26c3d913f722ca84d2e7ba6bee706eb3aa21ae86a924e6abf529a62b6f7dd7104bcfdade25fe7b364d138fb2da60e71399eb79304c
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
6KB
MD5497f7c3ea0dc093fbf79f8454be7bd22
SHA1c3971fde83030d2657215088be92df13dd69cc5e
SHA256040328c895c77f0441bc79fe0c433afa58c7f06b2e1535ba5ada88158772bae6
SHA512d8df79e59aef203a4704d92eebab832497d4b54d55250039d8f5fe0012a70c960840e509dc2f34ac18cda10cfa518a09d56dda2ddd51963a4aa0a0552d027276
-
Filesize
312B
MD50c04ad1083dc5c7c45e3ee2cd344ae38
SHA1f1cf190f8ca93000e56d49732e9e827e2554c46f
SHA2566452273c017db7cbe0ffc5b109bbf3f8d3282fb91bfa3c5eabc4fb8f1fc98cb0
SHA5126c414b39bbc1f1f08446c6c6da6f6e1ceb9303bbf183ae279c872d91641ea8d67ec5e5c4e0824da3837eca73ec29fe70e92b72c09458c8ce50fa6f08791d1492
-
Filesize
1KB
MD52f9d5a56e086898fda51654530d93e95
SHA1af9e84246bfdebda34cda2f392082cbf405095ad
SHA2561fe02213e94f76d03c8871120eec5a6aabbb1c58c0f0cbd0aa21ab0726721e2b
SHA512a70af1086d296d1c029b683039b2c7c781684e1c52a725ff18b62043dc63b337c39fb9c8fb7b184a25ba5654512fe28dee4a4000aaefc06c2dda0641e7cf9e39
-
Filesize
1KB
MD554fa4f14edfc915fe9b3d777206af140
SHA108488d17639063dbed968497cf12039684c6c635
SHA256457b224d515ab69af9786c8592cf9fcab2a33147cab7daea8ee8f88e8c02f073
SHA51249dafaf95a9dec295856195b8a45840b897300a92e4fbc5d10e9da2b951ed2ecb079d6aa25861d51741ec6c70356aa2c6dbf3ef164b371deb2b662efd4ecb105
-
Filesize
1KB
MD5d6f0c009282697347c8d6fff7182406d
SHA1169c29e78fec80c150f64f137744f1dedc265b4c
SHA256919c00b7125f240bc3c61552fbc3d1eed2db4a831a4fbfd3bf9257b0dcc52e51
SHA5128df388b3aff5878717b272f21470f398b6de64d1870c014587e5de6be6c61ff67c2530799812cbc307386faf899b4ab4850d780cd16873b4c222ee6d887c3048
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms
Filesize3KB
MD5d0710443526a8d0d69efa5e18baef4d1
SHA1092a58e070ed21a366d8e47faeece903f76590cd
SHA256c999ce80a7e700176e31a694fe228264c0536107f4c811efd9de1a4fa6c1e4ba
SHA512edf632a71e57120f61567bba9d2d669d5898db7a10aed878fa2ebab91710f6b736372517607d1f3feb924be33b556ab4fadfc5e25cbd1c8634e440d6e956c74b