Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
19/02/2024, 19:06
General
-
Target
AnyDesk.exe
-
Size
5.0MB
-
MD5
a21768190f3b9feae33aaef660cb7a83
-
SHA1
24780657328783ef50ae0964b23288e68841a421
-
SHA256
55e4ce3fe726043070ecd7de5a74b2459ea8bed19ef2a36ce7884b2ab0863047
-
SHA512
ca6da822072cb0d3797221e578780b19c8953e4207729a002a64a00ced134059c0ed21b02572c43924e4ba3930c0e88cd2cdb309259e3d0dcfb0c282f1832d62
-
SSDEEP
98304:NzTZ3cINQscs0m++LNkT6OpwDGUUH57yvZ/49Mr8EO3QhA9Kq:Nzt3cINQscNmvLCwDkHEvZ/4R79x
Malware Config
Signatures
-
Drops file in System32 directory 15 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 7 IoCs
-
Suspicious use of SendNotifyMessage 6 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"1⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-service2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --backend3⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-control2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x320 0x5181⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
MD51077fac63a246cfc5efbde46dab16f78
SHA1ce1fb969d7f17640a5e3aa483a58ae32af644ac4
SHA2567bc1c25ff3c29801251e465f2bae31f342217ddc36dc8cb275e7a80b51b816bc
SHA512dc392f32bf05cdf2a47344971943e2339cdaa0c81605a158f6976604f15425739e5c22b304140459821b3fc92308c4321a05c794fc785225d40626ffc942923a
-
Filesize
9KB
MD57eaa6da01db8108a9e4f61542c0b06ce
SHA16d945fea6a6ebf3f3ed665dc074de5f333576f54
SHA2569343fbb6745fe96b0d034196d93548be400b888fac40f4972af0bf370b09cca0
SHA5127ee11b2ada6d9f4540d68896ac68d4d82553e9856aea55ea236921c53d786646dd839b2123093fe42971779e6d85d431c6dfb9f9a503f71ebf43989a96508b6e
-
Filesize
36KB
MD57a351d89e7ade2575cce0e9ec55d00d0
SHA1953d8439c62c8a8ec93ca8c72d9fc23e0f9b23f6
SHA256f04e33089408ea13c9dbdd8159bdf63c51eae33ba49cefe9b17cf66349eabaa7
SHA51256510b8feff9b5005f380079342e98f4057cfbd8c75411c491dcf05b1ff217ad8a32c8b5145f19bd88023fbbe52583dcbbc4238fdc38021197600d8a3a6ab55e
-
Filesize
9KB
MD5121451c8f49286638c3f42f25bdac074
SHA107612a4b9491afa7bbefc3d036cb50e550c1c85d
SHA2562dcb95783b90a7a915a80589e14b629dc8fdc769b42a870fd835889ccb297f03
SHA5129ec9888abfe25644659fce284f5d2f1768cb5c66e8bac05963e61ef9e7aa6f170e8213052b48e966d72235f88385ffc8f8359ed3d383fddb75f4b2bae715c1a4
-
Filesize
2KB
MD5409bf40a6b850e67d8db90d25b25c49c
SHA1b8546b3d4700b83b627b9987479f69ee345b87ee
SHA2567205c58b0ce384778693055ea65ce0616a57d9f94c631fc0518978eda3796849
SHA512ea3771f4ec222f27eb0b23a2aa4c145fec80dc3157eaa7616817e3f470fc4efbaee8c916666c4db444668a4c7bfa7a1d6d36b09452da522bec404a7962fd3e4d
-
Filesize
2KB
MD52063188d342e637620efb24c04baa9ca
SHA1ae4a6b99ca1f35ff9666f01717d9cec8cc883a99
SHA256ec42d7d7f4d4ec25f05e56cc8a23882e7db68fe2fcce611355ee21609b2a99eb
SHA512adf0c088a426589d3aeab21fde281c05163e1456fea94e41f7d54200114324e1bb27689bd1f39b689aac963b34beec528d0bec28c34b9d2736f7db7e1c3ec5a8
-
Filesize
681B
MD5fa31c2b216d4f494fd71d1c03954a0b8
SHA192907183276a560bf9104fc5d77391c635c5135d
SHA256c26766c601ef6363de4ff9a26a03dfaedcd3d341a3e6192d13c882734c76f4fd
SHA512913eb3780995cb1ceb2caf1df54152a2098e1375c81c432b4e6dafa51945c0fc9f00372eb7ca910416e7dda58c037b7e674ae554034c9275ae1e0b76eacc7bd4
-
Filesize
802B
MD5d841d714400d86672a194f6234c478a2
SHA188587f898a8f8988e584cde7e41af204090e767c
SHA25671b6de78ff4a9e7a9c773ad24ab02f863ed86070da5be5e58c1a5dbcf85a2e42
SHA5121ff3720a5e547bf4443b8fcbe797d9accb0355f0097f25ac9690d98d4a606cde4cbf87240e616f5b208fdbbe44c263a2af3ee1548245575e4c6e0f88595493cc
-
Filesize
424B
MD569c076a2974d4054289f5c3a02027f7d
SHA12ab01381c7501dda7b45b3f932460f3c52b651f3
SHA256f73b1fc06b994548a914cd22ada254f5378051717ed0727df2c04e9db189d088
SHA51212bae8580b701fe6e11724d8659ae9e110c7419a0f5f50c6636d901260dcf39aaaefa1d43ee37ced46ec4b0250add7c603ad2f2d7223e4c939e88c899b022919
-
Filesize
2KB
MD5282dafd0718dd1fc17248b856f4e2a0f
SHA1fb935718f704cf34e2e76db364e27c4062993009
SHA2563b888741e60855e035fb73b3e9e3dcd7ea0cd7b454448f883af8f470cec9bd3e
SHA5128e673fd7c403e833f8bc4c98e41d94fcba00642dfbe408d10ea6901019c984e4ff18ad28d6303362a54b5690fd00e1abafcf09efcae63271745220c472b0140c
-
Filesize
6KB
MD514e24d28bec20a85f6a0ee7081010345
SHA109aa5038f793c759564c92be925a3d9fa5e045c8
SHA256190940dd8197a8aaca337c4018be117427516c0d382dafc5f6f8f25fc48a52cb
SHA5125d9b3dfdc51ac9a021d41f656ec6b242517ed1c281ca065b66b8957dd1681a3177e4055ad33a44625dfddd11bb8fafb70e405ca8e100b47f5e766d3a7b1e7148
-
Filesize
1KB
MD5f213dc9beb16bbeecbb73b9f76b59c30
SHA13171a6b08a9579d5dcdc4e23713e200542f9ced9
SHA2563ff00912677dea5390c01bf5e546b0a60f65e00e32786179e25d0717291ff335
SHA512cd94309eb88025bfdaf206cbf342ea180f2d546eb93c88ef87b353072ae5a92179298a13f1bb75e23686ae24c7ef44b703771419c5dcd1df380e21c27ab184f7
-
Filesize
6KB
MD5c3d1908294fd5106d5c58477b016193b
SHA1add63aaed69ad43e3c861a35c0b3e2c561dce4cd
SHA25649d5a8210a049aa5a33855291c7b34388533736e7877301c5a891fec9b0909c9
SHA512a9963ef036522d837ca7bab4b145438e787b142f04d999e3ad073d3bfe3ecc7cca25ba87d960280c3d303043c8808795bec990d46ab0b19803ea89a666516879
-
Filesize
6KB
MD590a579497c31656e64ff8e79810a1d81
SHA1854d3d9bd20e0cabe6d26d7d1d9f49bec5da0a81
SHA25620831b0ae0e761187882876154aabdc9bc7b1476262d87d3752b366a82982ffa
SHA512169e3f25eeac35945420802cebf1489610186b905d1ba6d4c6a1a46cdcfc2f6084f91e088324ac6495b04171547c3009080442902ae648c56e1e8d261a2284e4
-
Filesize
7KB
MD54ae990f8fb05f27e3060dc901b93a85e
SHA163137ce15d3f9532a03a4a8fcb967ab1563a457a
SHA256969bb46a635895367bd36621dccffa929f326a19550fa97f626dbb83a3a9af55
SHA5122fb213f053bd00a837e83edd2358848ee970abcd97075e7015c84ac7a2e96f5ca321ebf455c89c49e9c74f371ddbfb41b261a5a959020746584f3cf93fb4e30e
-
Filesize
1KB
MD5f0d54e7e24fab09b2edbbefb0f0157e5
SHA1c02968cf54897a64b20e43cf17307817ab181d0d
SHA2567a442d7f42e291c8e9bb84ec25804e148253d636f5636ef3e38ea581e4716fdf
SHA512955f7d0ba512e0ae5199a2788097c000b97e00f9111910e1621a7e4065d936f4ecd5530854a7e5a8edf85df055d5c8c99c843e58eb753a609a28485231b5c9c2
-
Filesize
1KB
MD577c84b4e4910c45778bbe9c5893d0ce5
SHA1a485dda1f26ae370df5f4d9b3029abd6970c9706
SHA25694051427a34a3e932a8eac59b302a8a84fa018bfc36f665d20eb0d30e912a7c4
SHA512b7272f6e3c3afba4df5626f8fdb309858fe80b7bc9f4ce68aaf7995ef0b7c6db89bb369996a08e1ac1b5fc8a73bc691565664bf7c0b17f3253df9c729d73af93
-
Filesize
1KB
MD5fce8fec74105092c6d2790789187779b
SHA1338e071d606f9a431edf545bb432701f422ea076
SHA2568247825c6de7f24b6e6842659b6aab031c144b9f1d7b141fe92474ad6423ce74
SHA512ab373f89df8e4e08e7840ecd69e50d19c229703883ad97e9d3eb944a65e40adb811f434dd470eb7b6de6e83176baeeb9cda9f15272a423d30503672623b53e65
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
23.2MB