Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
16-02-2024 05:09
General
-
Target
AnyDesk.exe
-
Size
5.0MB
-
MD5
a21768190f3b9feae33aaef660cb7a83
-
SHA1
24780657328783ef50ae0964b23288e68841a421
-
SHA256
55e4ce3fe726043070ecd7de5a74b2459ea8bed19ef2a36ce7884b2ab0863047
-
SHA512
ca6da822072cb0d3797221e578780b19c8953e4207729a002a64a00ced134059c0ed21b02572c43924e4ba3930c0e88cd2cdb309259e3d0dcfb0c282f1832d62
-
SSDEEP
98304:NzTZ3cINQscs0m++LNkT6OpwDGUUH57yvZ/49Mr8EO3QhA9Kq:Nzt3cINQscNmvLCwDkHEvZ/4R79x
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SendNotifyMessage 4 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-control2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-service2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4f8 0x5441⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
385KB
MD51ce7d5a1566c8c449d0f6772a8c27900
SHA160854185f6338e1bfc7497fd41aa44c5c00d8f85
SHA25673170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264bb8ffaf
SHA5127e3411be8614170ae91db1626c452997dc6db663d79130872a124af982ee1d457cefba00abd7f5269adce3052403be31238aecc3934c7379d224cb792d519753
-
Filesize
5KB
MD5a4c797c34fc04e27ce13693938df48a3
SHA114a3515bf3c4933b8584bfdbb479737f31eabab0
SHA256328b93b7805d5d020eeda13e3bcb9eb2c55a666988aa1ae15d7610b78a537644
SHA5120a27d7850d52106b07af2eda3a4200c588ad49817246381f3642574063248cb0e3c4df13fb1c5acb4381eed687b098813bcb2122a00043c9178b15728fde3165
-
Filesize
6KB
MD5ab7c7884ca161c5da6a08fb84cdbb52c
SHA107e076d491fc366e1e00fac2d028e4e7b4eccdc4
SHA25611b360b3bc0904d357af9a965968774bc6dd9527b4a1315fc895f47dd493add8
SHA512a8b13c0f4fcb74abf33ebb789f5eb7c161e22e723ff731c61d7f8e92964c970b55ee639f79d051946324ad7ca7ab3340ea1311970b4ffa5798c2578d54427982
-
Filesize
2KB
MD5471d21eaaed2de17991a60d72d3102f5
SHA12117733fe9ad65751bbee8f9ba9959ff6461a050
SHA256509756c23e581dc1f6f3421b7f5e8914e3de285c15a9e6bcafd355b48f096f00
SHA512381293cd395a9d180e4553d27a3ed6551da97b1c76a34db6eaa8fa2a1735d3fc765ff9c55db238854d5a689963ac5eff290de04a9d161cfb9b69fba312b873ca
-
Filesize
2KB
MD55fd808450cb4cfac9d519aeafb17e375
SHA196df6837a217bc6fc8843860df28eb9ca1ff981f
SHA2563d1ae990d518b58bd8874cdade41c73d332e80beada22e4f460f69a570a1672d
SHA51259c908419cdb0ecf8598a1bbbeec8b27d2f0e5e0ad444b5a135c22c26a563fc854b32ab2f062db737153b9f5595645c37e107a2ba95c4f8e35d8ebb1d99eb358
-
Filesize
676B
MD5b888a62fcf16f9e6c18d8cad0c866e58
SHA1304b6ab2fb6a0ccee754fcbe21fa1d9e4355468d
SHA25687e03ec2874bca51e1aa56d6defbbcd7629aa464b089b23c2e6cc57b3de44a63
SHA51213f0d18703ec7b9734242dcd96ef1f411efc540164d053fc79e22ea47e32ea5c34c0f7536a18ab61640078db4dcdbd77b3a9e8d3aacabfcef04e33e67c58f814
-
Filesize
733B
MD59a0725af843c249bd6a43b9638ab85d1
SHA185bcd8363cfbbba7d28a992f74e249af18c1d1ac
SHA2561abfab581b1730e145f6517b6797b007573b385a2c0fbcf1f32b91ad0616b4ca
SHA512e3c9a49a0a6ea66972d81b32a0d3cf9ad68b0a40de7d75e5a8e7a16d6135dca517bb643c6a489ebe573f88e63fc9542b4b3b6544b4e061d5ea6a4d959d57f36a
-
Filesize
802B
MD50aa8c06f0522b77dcd9932ba2b072a3d
SHA1ee9cc3de12b8876922d54ddde268a2f94b84693e
SHA2564ea1724a02e4638ba330970f68c57d70a388f054e023eb0e1f970137a384f881
SHA512e652e3893110a9dbdb7b6e8c751c45dced6cc5b81c5cc2151f204ff22bf0e1bf1c70f73ed5645b5e4ebc1d2dde438016e23d025b97e4f063856aacbad35043ae
-
Filesize
312B
MD50c04ad1083dc5c7c45e3ee2cd344ae38
SHA1f1cf190f8ca93000e56d49732e9e827e2554c46f
SHA2566452273c017db7cbe0ffc5b109bbf3f8d3282fb91bfa3c5eabc4fb8f1fc98cb0
SHA5126c414b39bbc1f1f08446c6c6da6f6e1ceb9303bbf183ae279c872d91641ea8d67ec5e5c4e0824da3837eca73ec29fe70e92b72c09458c8ce50fa6f08791d1492
-
Filesize
424B
MD5350de5e243c70922811c614a07f1ec41
SHA1fb091c9be75ec9e29c394f550adffe0733e2a397
SHA25647b8424dd30fcfcfd47f05889ef7e809420a9c3fc3c2f3d834d5bbcc6211825d
SHA512a7dec4c6a2449956e19eea8e8e147314c9e1403964a83e291feba6ca76198cdefa0086cb46460894bec86b1d1ee60251a7735ae9f6c6e076e9399ee3b75aba70
-
Filesize
2KB
MD50d81df93257ffd1fcb59473fabbbb0fe
SHA186c0e4595ba93d5c0c0ba69f75d927328bf72c3e
SHA2560c3f827682477b9533c39f6c256ef074647bf76e36ec29d4a5831de186ecc912
SHA5121b13ae6da60263a68b63f006d0cce9ac3ab24953b63120b15031591caf333552d8f8307cd58fa0dbf0d75481607b6be867dc55740beb98ceb50c9a825ffb11e4
-
Filesize
1KB
MD50b39d1d5c85a7e5588b9b357ce375f2a
SHA1cebceea43161545530118ff87dc03c567580fa02
SHA25656e3e8899a8f04aa013e1cf0f135175589015248a98960a43e62cee494005cce
SHA512f6309abff81020821c3d8374fa781ac1971d78a807b3fcd90205eb559c704094d027168a6ceb50e97bfc3b7d27ac233f64ed4ee209a3bbde6e5c743dc471ab1c
-
Filesize
3KB
MD51cc402f5d03af521e70568a9d69025ed
SHA163e005915723c88ae4b311a7c1ac48be3d4ec0c1
SHA256d7daac27e41d4ca5da2f8dc7313ca80d3c83fadc8f07cb9895c2836cfeecf105
SHA512ba648642403bc238b2cd297ca88c78df005983ac1f7771dcb03e792e8efe30c70f04743e069b38b2f7420915a3bc07f884055365638baf8b9051cd6684045b2b
-
Filesize
6KB
MD59fbea66b9a6c059a0188414882aed26b
SHA135e07aee646cde6fc3aa1dd21fa2944131eb7f2c
SHA2560f5a286b26f0fdd9aab36cf92c1807d2a0da0168afb94ecf05acc9bc7a75e6be
SHA512483fc0cdedfa447e730f86185e73f32775030f967f026108493b584a7a9a9936ab43c118aeddb37ce21a4f2bb5e89c8dd55eec45814282cdd46429bb8262ffc4
-
Filesize
6KB
MD577b11b55ff5bfe5dc2aad2da3e8413fc
SHA1ab8c6f6b9c003524c45f5095772f7e69742c9d59
SHA256d7e1742141214939d366ea4b02f9ff6ba4e8a826eebbc23d8ccc2d1a5b3c6b7d
SHA5120b22abc013b5a98e242c94aa5aab3e3523fe4a8a7178d71b1ccffc55782bedb678cc933351697d68c1ffabf6b84764871428075aeb06c63b2ca115f057a5f819
-
Filesize
6KB
MD5c68e23a522c939f0d44821dd545f7c75
SHA14eb5c5572ba31d99ead6e66b42c6b3be1d76988b
SHA256b075a3dc34ed08fbe35052ebcd942ddc701090af08a46e1786ea21db7cdb01d3
SHA512ba2a61d27bdc6a235f93cf28f1bf73d82bca3db9cab16c2606e380a2fb3eee9a55cff2a89481b9ec9d218e415b7409313f4d22f8e94f86fa943d76a87b0c2f91
-
Filesize
1KB
MD5188d56b1ef37adcba41263073d36873f
SHA1a5a4bcd9e7d1fb0e582f73cd125e4ee3032840cc
SHA256a7144a8e4aed7b5b7d3e3c725386f638f5baaf52ca553cc474ef7e8f01f8ff62
SHA51243594b4b7f430f4b92ba8c5624d31dcf7695a6972fe5b86977693f1ed4c759727126c3c4ffa8ee1d60db7de2ef360da07d578a9936d15aea8aabc3fd107ed822
-
Filesize
7KB
MD5ee9ba9d3bd9ca4c5f9f607af1e195356
SHA1b1109b788f29920ec219a998210f493754af8900
SHA256fca09c8a0108e6e94faca79ceb5ad361e3ca01359030192436201c23bca7093e
SHA51269bd1bc53da79e8a127f7491c687ed16fd67e3d622fc4dfc972f5e217549addf681b2d01525afb191039517e86f7c3e0a1a45396cf44a77c689d68cbbd144d7a
-
Filesize
7KB
MD5126bc6ad8dcb1f2402fcff4a6f984ae8
SHA14e2c17c957d3bfd02a421ba59ca1ec2549df9d1e
SHA256712b74771ab57554b31e22ff7defb47e498fa53cbaa6ad2f575bb208e8599752
SHA5126709b5cddb2ccc7f3d215cb991786f8412d4070b27c3c404fc4ada653418599e3df15a10a883e5de83224ff2365720348d0fc4c4615bde5ef15b431fb28ab506
-
Filesize
7KB
MD56c5d529b2d56f114838b0bfab6d030ba
SHA17fb35ad479b1b5df3a7e7b83a13977059483c1f2
SHA256eb0d85f7b88c3c8eb95a4d101fd8009b898ab670a7a84a9a6010629df7e413bb
SHA5128f99f30b718a1244f86c99135dd1e3b3e595484420687cee8523acf75f85df5f0926a81b690e04704093d0c87a3a5cab0e64e85a5d0a062e0ba288027e93436a
-
Filesize
1KB
MD508910b1c096a6bc4d16e2fa10e91aca8
SHA11ddd2622825fc9b16487ac55dc10024eeb1aa44e
SHA25672450d931db31179da1f59d0f762126e83a2903fe4e58d5e3daff80163e0cfdf
SHA5125885c37c3265f595bdc26c725385a6cbb7ce74cfc778a7b66a1b95d3e46cfb788db1adc192703c4bc43d9c0183385530799509e00e3eca50f685657887f16b8f
-
Filesize
3KB
MD567bc6d6041887958e481052873811118
SHA10346400b08d37384773d762e28ea351eee3b0343
SHA256792c104784b33013216fc5c73b6950db14c619878da197c2dcd8433cb64f453b
SHA5129db338c3614dffdc97ec74ccb0ceb8cf5e124582b9a85ed9a24511cf95cce48227a3c38a8c83e6fe7a8162911469fdf85952c1fe6939d91fb3e1ac27f67ca46d
-
Filesize
3KB
MD51b55df6951dfb081d2cc05061b893df6
SHA1dac4ec7c975c6c13688ec3a38bb7e3577185adc8
SHA256e4a0139d149102f5261d700cd290398e210a1f169a80c5a334d105da9b0d359a
SHA51299be1ac3b1d140919bd6ed0ce860a5d2bf3d2bc40446562f5e8233438aa790c3f1516a4f6dfb08ed866dca7dc2b566d7ddb8a87cf204f8bb894c3a8099fbad58
-
Filesize
5KB
MD53cf54fe0a95001964c31fee87759f749
SHA183968b0ba2c28c2dd99002c022d663a45df9b04c
SHA256ebacf4cd0900e67eb414b59d4e264da1fae78a76795f77dacedac9ca2387d15d
SHA512a0f8875820eda68aa72680f0089f6bb4cc00e4c920c4eb6f40240fe2452eac93d5602c377933eef8a03425c1270d2acc0a69b8bef98660c8433539c1c3a0372a
-
Filesize
5KB
MD55ab0c1185ef8feca70c8ccc0a8cc9d95
SHA165592920dc9e364fa6003c58c06d087e0ee71fd8
SHA256404227ff0ddf2e3f61867b36744ada05daafe0a6c50fb2fa9fce73e59d134392
SHA512e5b0b3601a39158ad0ca1d0642ff438e9e972941d7279179162119549d93455751ed4ed80690f1e7bf228d5fe0d414fc919338baa54b105d8e0e63c740b4b7f9
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
4KB