Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    139s
  • max time network
    160s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    15/02/2024, 15:01

General

  • Target

    AnyDesk.exe

  • Size

    5.0MB

  • MD5

    a21768190f3b9feae33aaef660cb7a83

  • SHA1

    24780657328783ef50ae0964b23288e68841a421

  • SHA256

    55e4ce3fe726043070ecd7de5a74b2459ea8bed19ef2a36ce7884b2ab0863047

  • SHA512

    ca6da822072cb0d3797221e578780b19c8953e4207729a002a64a00ced134059c0ed21b02572c43924e4ba3930c0e88cd2cdb309259e3d0dcfb0c282f1832d62

  • SSDEEP

    98304:NzTZ3cINQscs0m++LNkT6OpwDGUUH57yvZ/49Mr8EO3QhA9Kq:Nzt3cINQscNmvLCwDkHEvZ/4R79x

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 26 IoCs
  • Suspicious use of FindShellTrayWindow 10 IoCs
  • Suspicious use of SendNotifyMessage 9 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
    "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2740
    • C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
      "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-service
      2⤵
        PID:2440
      • C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
        "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-control
        2⤵
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2224
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4076 --field-trial-handle=1296,i,13230403372960123811,13493795791215324988,131072 /prefetch:8
      1⤵
        PID:2228
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:3044
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xbc,0xc0,0xc4,0x90,0xc8,0x7fef66f9758,0x7fef66f9768,0x7fef66f9778
          2⤵
            PID:2560
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          1⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:872
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:872 CREDAT:275457 /prefetch:2
            2⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:2708
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe"
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:2212
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef66f9758,0x7fef66f9768,0x7fef66f9778
            2⤵
              PID:1644

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            344B

            MD5

            97f69675053d3ce264741b09f2a09c04

            SHA1

            b2db2391b2f8ddf685153c8e2a9c68987e07abf2

            SHA256

            e7b710d6c311cc49eb554aa7dc72c565560232f8982d575efefd5543ae198d7d

            SHA512

            2425db94d31e12dab2d8f802a2eeb021348c27a803044bb04f6e7d7631ef8a5e98d444ccc17b8d0ebacf4fe2b5f2eebd979275002f08e920f8d89781bbc15373

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            344B

            MD5

            0d57cfb2d469eef1264337ce7ef88b8c

            SHA1

            f35d2a3a5f8706a0726576a45b5cb9fd2176706c

            SHA256

            70d52749e05d0f12eb91cdc29237ac317784bc2a8c17968109618b05aeab7d96

            SHA512

            7a92b9ba02168fe5ff8bb1d5db02d96c3f2275aab1161d26e33e9a2531f058e058213dac21291ea4cdc7a24815904635f795a8faa958ba4ba4909bbfa368a32b

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            344B

            MD5

            6dfa67d5cb42aa773879f5682db56e7f

            SHA1

            8308cd2305c6175922413ea925d81f247f08256b

            SHA256

            69d412fca4a23f1e6c3667c7493d393416d1b388d47d891f2040fd7f64b91d23

            SHA512

            f597e56e5f1ee3a57cd943baef4a2702b6d5ad5a0b41859e7a2aa4aeea3ef0077348c527bc503a8e34b10a5c3906553481027c36e8dd975cce6604ca94e6e9e8

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            344B

            MD5

            8e90d3ad765aeebad1efa4dbec360549

            SHA1

            1bd0698f5ce1e5ed73b7e5c403e21cdf2a93a269

            SHA256

            64b50ed2f2757e5e1d9fbcd55bb3b237e33117549d68e96bd272439b2f3c2a29

            SHA512

            b82e2bf45898a2f8f7b5e6b39a933f569090ecc86c55c57a9e8f884175b3e90e371e8659d72756a90a4e8f82abaa2c1c8c3c1024f58a82769038044ebe2b0ba1

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            344B

            MD5

            559589ba8804731e963041a32de5ee59

            SHA1

            75d1abdbc891f4f09e396f376165f19d965a896d

            SHA256

            c30fb583c3e6e31c9a9a3ec22339963c24fa0acf94166341278a7e8e86180bf5

            SHA512

            13bd828b11fc33b6bbe3d6b58fbfc5e8e83d4c6c495a4c34d05bcd3d61a6de5fb5877a569e0b813bc741bd8ec66ed1eb53acca5d65eba15250e6bddb959ac3fc

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            344B

            MD5

            66a156780e4ddd7141038e1362e6ed3b

            SHA1

            8b0aa62da83a7c3b7bdac52d8eb8a50cf20cb678

            SHA256

            983afea018f4d578aaff0ec961faf3bde8d263a4a310652a8bd6b16382063b25

            SHA512

            8f4e17102e9e6d920bb36642bb495c28d10efdd26222cb0810355f225b7d2c236ded92d3f5cc6ab2b5f83d56e3f08992d04c37ce269d2d687b1541ff1a6cc780

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            344B

            MD5

            e52502ef8e7b3b509b58aeb7a0d4b874

            SHA1

            11212c6da36fac4f51526f1aa290b812120c14c3

            SHA256

            4a1d94e975e083f27f8197c71175949cc18f53c8caf23687d0d7aa8b28d1f39c

            SHA512

            13ebb66049d83bb7f119dab2d80b60b5f51ca5b9948f57947ac0d85d56d865f6f79fa6897dded9907cdbab85ccf8a5ce14a3777ccdfe74419bec05eb1cf00f53

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            344B

            MD5

            3d0053fe8141a8eb74d6f4cdb731ab16

            SHA1

            2826062267e80365fbe82f5ad7a7873c208ebaaa

            SHA256

            4e3932e669346e84e3368c8a9f14b0995aef5e6cb0cb14128b575eca5585c0f4

            SHA512

            7e7ef229283a43259c605b211e0131227174783db75013c39efc05df38258f3b62a4e06585541922e2cf38270a64746e75cb5fb7235f6c8f3b3500d35befedef

          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

            Filesize

            40B

            MD5

            11b9ef326a4851ce75c5768187b8d574

            SHA1

            ebec9cc2871219a70441db5dbab6d6c1e73b70fe

            SHA256

            92e236809af52434ee84e9dd0494b4748b40d3b6729a76c9f5d456dee9e6c7bc

            SHA512

            0e8f39bcb557a7ab92db8e26c3d913f722ca84d2e7ba6bee706eb3aa21ae86a924e6abf529a62b6f7dd7104bcfdade25fe7b364d138fb2da60e71399eb79304c

          • C:\Users\Admin\AppData\Local\Temp\Cab4167.tmp

            Filesize

            65KB

            MD5

            ac05d27423a85adc1622c714f2cb6184

            SHA1

            b0fe2b1abddb97837ea0195be70ab2ff14d43198

            SHA256

            c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

            SHA512

            6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

          • C:\Users\Admin\AppData\Local\Temp\Tar438C.tmp

            Filesize

            171KB

            MD5

            9c0c641c06238516f27941aa1166d427

            SHA1

            64cd549fb8cf014fcd9312aa7a5b023847b6c977

            SHA256

            4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

            SHA512

            936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

          • C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

            Filesize

            6KB

            MD5

            497f7c3ea0dc093fbf79f8454be7bd22

            SHA1

            c3971fde83030d2657215088be92df13dd69cc5e

            SHA256

            040328c895c77f0441bc79fe0c433afa58c7f06b2e1535ba5ada88158772bae6

            SHA512

            d8df79e59aef203a4704d92eebab832497d4b54d55250039d8f5fe0012a70c960840e509dc2f34ac18cda10cfa518a09d56dda2ddd51963a4aa0a0552d027276

          • C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

            Filesize

            312B

            MD5

            0c04ad1083dc5c7c45e3ee2cd344ae38

            SHA1

            f1cf190f8ca93000e56d49732e9e827e2554c46f

            SHA256

            6452273c017db7cbe0ffc5b109bbf3f8d3282fb91bfa3c5eabc4fb8f1fc98cb0

            SHA512

            6c414b39bbc1f1f08446c6c6da6f6e1ceb9303bbf183ae279c872d91641ea8d67ec5e5c4e0824da3837eca73ec29fe70e92b72c09458c8ce50fa6f08791d1492

          • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

            Filesize

            1KB

            MD5

            2f9d5a56e086898fda51654530d93e95

            SHA1

            af9e84246bfdebda34cda2f392082cbf405095ad

            SHA256

            1fe02213e94f76d03c8871120eec5a6aabbb1c58c0f0cbd0aa21ab0726721e2b

            SHA512

            a70af1086d296d1c029b683039b2c7c781684e1c52a725ff18b62043dc63b337c39fb9c8fb7b184a25ba5654512fe28dee4a4000aaefc06c2dda0641e7cf9e39

          • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

            Filesize

            1KB

            MD5

            54fa4f14edfc915fe9b3d777206af140

            SHA1

            08488d17639063dbed968497cf12039684c6c635

            SHA256

            457b224d515ab69af9786c8592cf9fcab2a33147cab7daea8ee8f88e8c02f073

            SHA512

            49dafaf95a9dec295856195b8a45840b897300a92e4fbc5d10e9da2b951ed2ecb079d6aa25861d51741ec6c70356aa2c6dbf3ef164b371deb2b662efd4ecb105

          • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

            Filesize

            1KB

            MD5

            d6f0c009282697347c8d6fff7182406d

            SHA1

            169c29e78fec80c150f64f137744f1dedc265b4c

            SHA256

            919c00b7125f240bc3c61552fbc3d1eed2db4a831a4fbfd3bf9257b0dcc52e51

            SHA512

            8df388b3aff5878717b272f21470f398b6de64d1870c014587e5de6be6c61ff67c2530799812cbc307386faf899b4ab4850d780cd16873b4c222ee6d887c3048

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms

            Filesize

            3KB

            MD5

            d0710443526a8d0d69efa5e18baef4d1

            SHA1

            092a58e070ed21a366d8e47faeece903f76590cd

            SHA256

            c999ce80a7e700176e31a694fe228264c0536107f4c811efd9de1a4fa6c1e4ba

            SHA512

            edf632a71e57120f61567bba9d2d669d5898db7a10aed878fa2ebab91710f6b736372517607d1f3feb924be33b556ab4fadfc5e25cbd1c8634e440d6e956c74b

          • memory/2224-27-0x0000000000160000-0x0000000000161000-memory.dmp

            Filesize

            4KB

          • memory/2224-67-0x0000000001290000-0x00000000029C7000-memory.dmp

            Filesize

            23.2MB

          • memory/2224-531-0x0000000001290000-0x00000000029C7000-memory.dmp

            Filesize

            23.2MB

          • memory/2224-101-0x0000000001290000-0x00000000029C7000-memory.dmp

            Filesize

            23.2MB

          • memory/2224-57-0x0000000001290000-0x00000000029C7000-memory.dmp

            Filesize

            23.2MB

          • memory/2224-542-0x0000000001290000-0x00000000029C7000-memory.dmp

            Filesize

            23.2MB

          • memory/2224-21-0x0000000001290000-0x00000000029C7000-memory.dmp

            Filesize

            23.2MB

          • memory/2440-54-0x0000000001290000-0x00000000029C7000-memory.dmp

            Filesize

            23.2MB

          • memory/2440-30-0x0000000000260000-0x0000000000261000-memory.dmp

            Filesize

            4KB

          • memory/2440-19-0x0000000001290000-0x00000000029C7000-memory.dmp

            Filesize

            23.2MB

          • memory/2740-68-0x0000000000260000-0x0000000000261000-memory.dmp

            Filesize

            4KB

          • memory/2740-18-0x0000000000B40000-0x0000000000B41000-memory.dmp

            Filesize

            4KB

          • memory/2740-17-0x0000000000B30000-0x0000000000B31000-memory.dmp

            Filesize

            4KB

          • memory/2740-0-0x0000000001290000-0x00000000029C7000-memory.dmp

            Filesize

            23.2MB

          • memory/2740-4-0x00000000000B0000-0x00000000000B1000-memory.dmp

            Filesize

            4KB

          • memory/2740-95-0x0000000001290000-0x00000000029C7000-memory.dmp

            Filesize

            23.2MB

          • memory/2740-69-0x00000000046A0000-0x00000000046A1000-memory.dmp

            Filesize

            4KB

          • memory/2740-32-0x0000000001290000-0x00000000029C7000-memory.dmp

            Filesize

            23.2MB

          • memory/2740-1-0x0000000001290000-0x00000000029C7000-memory.dmp

            Filesize

            23.2MB