Analysis
-
max time kernel
186s -
max time network
193s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
17-02-2024 00:02
General
-
Target
AnyDesk.exe
-
Size
5.0MB
-
MD5
a21768190f3b9feae33aaef660cb7a83
-
SHA1
24780657328783ef50ae0964b23288e68841a421
-
SHA256
55e4ce3fe726043070ecd7de5a74b2459ea8bed19ef2a36ce7884b2ab0863047
-
SHA512
ca6da822072cb0d3797221e578780b19c8953e4207729a002a64a00ced134059c0ed21b02572c43924e4ba3930c0e88cd2cdb309259e3d0dcfb0c282f1832d62
-
SSDEEP
98304:NzTZ3cINQscs0m++LNkT6OpwDGUUH57yvZ/49Mr8EO3QhA9Kq:Nzt3cINQscNmvLCwDkHEvZ/4R79x
Malware Config
Signatures
-
Drops file in System32 directory 15 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 10 IoCs
-
Suspicious use of SendNotifyMessage 8 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"1⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-service2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --backend3⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-control2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3ac 0x4c81⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
385KB
MD51ce7d5a1566c8c449d0f6772a8c27900
SHA160854185f6338e1bfc7497fd41aa44c5c00d8f85
SHA25673170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264bb8ffaf
SHA5127e3411be8614170ae91db1626c452997dc6db663d79130872a124af982ee1d457cefba00abd7f5269adce3052403be31238aecc3934c7379d224cb792d519753
-
Filesize
8KB
MD52f64b4d5fe97306774d3c84a365c7a39
SHA1f8d27914c471325de0b4b3cf2795730a6d3b875e
SHA25676709ca0ea254649b495b815c32aea50ee9bd4a18a11814eea7e389ccd038975
SHA512c8365f56166901f417bdfdc426800c46922c201f383624e244f965674f9031d12872ff49c90ab8a9d42ac84d10a40c40619f64d6795c7dd28ac013c8958570a6
-
Filesize
9KB
MD54afbb7b5960ecea7c3eafb1447613ebd
SHA1219cdd996aa09ee95b1689fda2760464b2cc7c86
SHA25682a953551e535a6892f2cdb7387d4af704834a212cc3f101a75a023a9b658cc9
SHA5123babe3f8bb8beb9783396a8995b9e4daac61dd1baa3527f30a0f67efcbbbb9b5e9a078dff3195d3d7df4754163dccb9fd5906d0312449fcb9687bb79ac3450e6
-
Filesize
36KB
MD5da8f77de467487ef26981709ce0362c5
SHA1db386b6988c8d4a7d150c6e603c3628061832e39
SHA2564f8eb00ee98b1b13825b0e735628755590b37843d3c8be10fa4b2dbece6b30db
SHA512aff5dccce5edfd32747af97048c3289c2ebf0df35f8892e4eee3fbbedde3fe6ad23a8f2072b2cb2b5575e8aaee039c2f01de86f9423b74fd73bebe46e165fffa
-
Filesize
2KB
MD500a49c250852ec94c8e1062b70913463
SHA104c38e3486395d9b485eed83d9ffbd01aeaad251
SHA256543908374c22013683c9acd47825d95297a6bbe8e87e8b35a0df94744aad4177
SHA5128f67ac28e9e38847474898d02dda64409640b1ceed81cdb4264804d2419733bc51e0392f934d33889ec1b096331ca577a6b02032358a97f2a6345dff9d9b2d4c
-
Filesize
2KB
MD59ffd04d022a8ff3f6ddc6c0dced5a194
SHA19fe01f9170376cd2db27a74528f807c27052cadd
SHA256e3dc2da3b8212463d90533757d4906daf57758f2c296add9ac6894bebb3c3e9d
SHA5121238ddc390d476f66e29293b44f1c7dc7db6d60a4781c7e368fd7869052830854b6f4c848ae84250fbfe0fea8f16c32624975f1fa35fd23a24705184965158f0
-
Filesize
612B
MD5ffce89f2d825ac587c6bfb0bc09c44c9
SHA1cb1366dfa064385e7671aa5b76aecccc18ffdb75
SHA256a4e8b9c5d34ba78a771a64b666d427b5c1d4b98bb38435d7fcb72508aea86610
SHA512790dd82cfa3389792bbce2e08e4788983ef09ec097d8fba342434c530e253ae67535f2192485b02e4916252923c00817c21d6ab5237098fab0dd275f6578c75c
-
Filesize
676B
MD5855c9c941a3da0136ed6877e91169a01
SHA14627a3266247cba35d13fd58c02520fdc58bf227
SHA256e68661bef59c30b7cc9d2c44ff4390851b3b4fe82a7b4d2330f95cdc130084ee
SHA51249cbeb6648d634211bda464c30585a213ea78b0cf0d33d43548a132a2df8c2f6754b4d8f6a8276d02e8c3b0ee385749cee0cd6f3b6f098b0859eab7a6fa8b891
-
Filesize
733B
MD5038f9fbcf2356fe262fc5ac16fa4476f
SHA10811542d5b14ac47506229658553ebd71fc84b66
SHA256c8ae4e6226d1808f073343e1c01ca75106431bbcb45a3ec48e05f2666e5b73e6
SHA5129e00a5f2e70194f48ae424da0f6c6619f7f14a371f50babf95cb8604b6041b1edc72b18e04fe02cabefea001be3bfcc730eedfa4288666a9a4025421fb64aebf
-
Filesize
802B
MD5b7b8a7366e7f5c2e183d14728d937c08
SHA18047de12953e8dee8b1792c0835c99c7c997b32b
SHA2568342fff6d8bd1ac91fa5374fdb8d0e8981000a265ae55e88127c5d9cb88268e7
SHA5125cefb7cdd2b311da527f85837f9ffa4b53c6db1ca4ed4eef359fd55f822b960696c04318d5db37ed4b68d25cffbb5c8b09defcddcf800583d075d435716bb8ed
-
Filesize
424B
MD5dc27cf64da17a44da11eb98406cf487e
SHA1003350eba05bdf4866289c9c0703170251b97864
SHA25678ec05c4019ae1f1f0f8e041acc4ac8ceb677e1354d4544d5115a45270ca3da4
SHA5126b46f57b3bcdb821991c6bb04f21c5c98c91518ec05a330bf3966004f96e55ed1c4786c559abfec236b624603117b59c40fa746d9db0918954828b9a4bfdad70
-
Filesize
2KB
MD5f38e14423796b701de2c27ed9f3f3b56
SHA188fab420f7c5a27b0e9b1a179c5297816719900f
SHA25650a1971074f61752dd59e675da27430ef7efccdaa8da184b716bfe119c405994
SHA512aaf380135d0d7baf06f7b150db680fcab7373c7db23c309ceb3fbd5c45e9d4d5dd074bcf8cd94793b2287a60dcbe2205a15bc6f6c8ec60a5ac1a9b88af2a74fc
-
Filesize
3KB
MD5a4ddd7ce62574d1caa88a9f4ac8477b2
SHA17c917713886fa020debc2a050d65bf9369fc9e4b
SHA256fcb2468d2fa4b63109b8126d0bf38fe5c575e3f3b2d8584ac1ad4ffc0b8af8c8
SHA5129f48b7550833bf14aaebd802854db1242ab12a78a1eea2ea183376ae35ef916c438cf76136b677fb80d22a0f274b846a0e1e7786ce05fbebb8a72a1241fcf1b3
-
Filesize
1KB
MD50c4af80d0324e844a0991c5de4a395ac
SHA13a051c8142305bef2f8b165a53f17032e62ca650
SHA2566c03c5d0cffffb9408d5065a22948a5a4ada03f67e94f6d2c8e23fc687dc9b77
SHA51219761bab158baf5a797b4184ecd5a604684c4cb98b03d6aba8227a870522745fe0e8c645d50068e75298eb76a24b7d66463cf37ef9b6a0b0d0bf61a1d78a38b7
-
Filesize
6KB
MD5eabe6dd7e1add8de65137edf68512c8b
SHA18fb9de9b80d4715629f15614e8f34f061f059347
SHA2564bc39d39ac109c85cbb5858c716a48ca09c4bb0d7e8a2ab40dc1b3c5ac79583c
SHA5122e6cf2b18282395d7c009e32d76f0b812049fdd9383a0ed8384be4a4973e999fbae5aef24151a8d525abaea67f00fe02754644f3478216b7d4620f11762e90d8
-
Filesize
6KB
MD548f53d7d7b0da2726d62aeefe981c65a
SHA1cfd29c10db174091c141b5894370ba43c3e7b3f6
SHA256ab0ab55ba1d7bbb10737e822822af8ed6b1e608666d96403a989f1c5a55dbdda
SHA51214fb0911d3801666ee19a0fc0178128d449279c0736110879380f0ad4485a8336125fc3a2e71fa1a9afa1e1d79eb4f2fbba691cc7914579ad73155d8a684d368
-
Filesize
1KB
MD5aa68ec088a8d2786cc52135654165404
SHA17b3c2901ae2dd1c1f7655534120988e1632f029e
SHA256a0c09443996ad5b219043625ced780e16d18170cfa0ccba1aee254d4b6b42130
SHA5123afbc40718a3023cda41f86dee8a3e9fdc818e484339add4df6b4ef3763bb04e017a9857abfd5b246a777f7c670c106dea28e6a249aaff250c4722d9d81a00db
-
Filesize
7KB
MD5ec9169545ef3165fb24f399ee0ef2d5c
SHA18f61ee8f77f5a1f9d6bd0659f3b84c6b14db17c6
SHA25651a257b589a252b7a674bbaad45575f6141a115d1ee5a1bbbe78351e99349586
SHA512625cd1bae33b32af2b75ee97b6fc2e276ebc2c29aa61a97d5ccaaebcb93eb0328341c62ca8f33dc91ddd40cab3ccefe64ed59d9de3e0acfdabc4fff824db6837
-
Filesize
7KB
MD5d5aca0e0184ce8daaf0f89b620d64dd9
SHA1b0dd6d38eaf1d3a9363ae85b3ad2163d6cf1d3c5
SHA25618d458941b140680c3da6ea118e9cbe41636bba98746934560146edca9cad3d6
SHA512b677394d04b6da84d69a7ea25099fb24f381ecf8f02e0446615480c247c9b41603fc23fa01bfcca44e2c07ab5b9ea7072ff314490804792f728ba4bf31bb1b4e
-
Filesize
1KB
MD56443b927b96b28c5f541d27d88e22fff
SHA10afae4e3d9fd054663e665bffd9fc96b611f61d4
SHA25606425360055a30ab088ad943f77183bea47d317b1da1431c1166bf805f238301
SHA512a544cd628f8ffc78f073edf166635d4508bad7642ad6d709620fceee8ec67b6e96688d55da0374f99eef48d0868293f54924f20f869561f06677422f2196c9ee
-
Filesize
1KB
MD5e52afb0ea872c89e462dcf43f85b4c75
SHA1f6f879b104830bad5705c5b135dd8fa83a49f57f
SHA256be23e9f3882b61892286c95f11d37605f5b8d28a92d106ede844be3668c8e9ca
SHA512fa4ce9863763255a238b83f6629f8ecebe4de7ddbd6e26d4b564c6989f39fe1393e4eedfdf04e8c7591e56ece85effa203961b5d7df161e2c3eee478a639e6d0
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB