Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
20/02/2024, 10:46
General
-
Target
AnyDesk.exe
-
Size
5.0MB
-
MD5
a21768190f3b9feae33aaef660cb7a83
-
SHA1
24780657328783ef50ae0964b23288e68841a421
-
SHA256
55e4ce3fe726043070ecd7de5a74b2459ea8bed19ef2a36ce7884b2ab0863047
-
SHA512
ca6da822072cb0d3797221e578780b19c8953e4207729a002a64a00ced134059c0ed21b02572c43924e4ba3930c0e88cd2cdb309259e3d0dcfb0c282f1832d62
-
SSDEEP
98304:NzTZ3cINQscs0m++LNkT6OpwDGUUH57yvZ/49Mr8EO3QhA9Kq:Nzt3cINQscNmvLCwDkHEvZ/4R79x
Malware Config
Signatures
-
Drops file in System32 directory 15 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 56 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"1⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-service2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --backend3⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-control2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2d0 0x1501⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
385KB
MD51ce7d5a1566c8c449d0f6772a8c27900
SHA160854185f6338e1bfc7497fd41aa44c5c00d8f85
SHA25673170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264bb8ffaf
SHA5127e3411be8614170ae91db1626c452997dc6db663d79130872a124af982ee1d457cefba00abd7f5269adce3052403be31238aecc3934c7379d224cb792d519753
-
Filesize
5KB
MD5a6ca448deb59d628f8c4654dcb927ebd
SHA139ededbd0ae4d8886431e5a6632a387b99aed374
SHA256da74e8bf6d6e3a5117354855d953c606253e5b4943578f457e522904e63e0cf9
SHA51216055b80985a96a745e29200c480f213881d34b3e628310cbb867fb2cd9aa4ab740632546935e7a8beb8b3cdfef8218d607539df66bf975dbacd0c78702870b0
-
Filesize
35KB
MD521c104ede7b5897a8d475bf537cc1227
SHA14cd60c0af4757db2c7f92e21507a60f7bbf21033
SHA2563354f32b602cae4cc9df9f2a84e98e2e168821ffb3205aa8d70282d5f581fba9
SHA5120fb886848a3ad2911105728f436553b50b0b317d0f6a77e9f772ede1c69c491b551e8cf21cd7a8fb20faf2a9bf8b55d48c13d0973cf3545f203ea469639a7b3d
-
Filesize
2KB
MD5d664d4f4466b15bfb010d3315ba4e887
SHA1c31f7baf3a7075351b4eb5fb743ede9652a376c3
SHA256a91b3cc32c1237f6217d999759e89266926d843169e18dce2230789c51ca56d5
SHA512e6f32b974513df9e84c5dd1885f30799eb7a2d0e29cfaaf4c61785e9819e39fdfb553f7ec9cad1c0452760dba97274d60f590ce05654fdb32d5ea1d7d148a594
-
Filesize
2KB
MD547d084a88e16cbabc87d67acb05b3cb2
SHA15bebd090741e4170f1e71873304a1cd45f76815f
SHA2560a3236a9cc727907ae37b58eb97708dcc4cdd9b557e622d4e5bae2f2e2b9212f
SHA51260bd092a47d7e0e88f29fabfc0ce85a3fd5ddc14d6b67691bc2db5d1083dd44943e995bab5ddb9bd2f1f306063410ca163fc4e9e6855fb46468547ae770107ce
-
Filesize
733B
MD553214b3605e842422241e67f9916824d
SHA18bcf6036576f3b5c5d0bcd9b52105f6f94eeb19b
SHA2569057eb51feb1cd46636291ee07c5858fd18f31cb60b5db1c640ac39423725208
SHA512452a117c76ccd4b1b1f280b4b077f30dffc41d2ca58ecd00a9d61c4a703e72d91fc1440b4b576b655e83ad5fbe6918ae10bae211b35161e64b26aec41a2c52cf
-
Filesize
802B
MD58026ee7bbe337f65715a782e6f7b95e2
SHA1ccd406d05055e3cfb98985cbd8390aad73d5d7ed
SHA256889f4ea4dfdeb378f8b56b434070d12ed6f2f1c099081ba2e4ce38510fae8dda
SHA5127786b587980f3411a0566e0b1f606de3a4824429d18c40697e07e8daf97e7d036ec4cd667ad294f1b29c689858e4f39b0ff118026c2cb58f82832900e86075f7
-
Filesize
312B
MD50c04ad1083dc5c7c45e3ee2cd344ae38
SHA1f1cf190f8ca93000e56d49732e9e827e2554c46f
SHA2566452273c017db7cbe0ffc5b109bbf3f8d3282fb91bfa3c5eabc4fb8f1fc98cb0
SHA5126c414b39bbc1f1f08446c6c6da6f6e1ceb9303bbf183ae279c872d91641ea8d67ec5e5c4e0824da3837eca73ec29fe70e92b72c09458c8ce50fa6f08791d1492
-
Filesize
424B
MD5abdbebd4a43025991f5c92fd6c8c47f4
SHA1efde1e9fc7cc3a85cf1469b40147f54f58317301
SHA256dd4cbcb784fd176490711c9c9817daf449173eec2821ab9375d98b8158e82117
SHA512eac4dcc054ade18454d2eaf4a8af13e29d1def18247331bd26ef613635b7046000e4643655da77b73a2917ac3d7a490a0e5d53bc7968e2281599842b02b7b904
-
Filesize
3KB
MD50f1ad178f5d7a7284891101b874fb2fa
SHA1ce4ed50f263022c8c344e9b178ec3f88b7280da9
SHA2563551e1d4925af210e4ef5a5fa583dee1ed22b4b97fbf9f7d982bae1720f6fa56
SHA51292c61098407d02e68aaffcf11c76049a2cebdd0034dcb512798aeb1a7797f58380e2f8d08c4334f6416b87247483be4f96c029e0995b903c05686ff6d0dd44d3
-
Filesize
1KB
MD5c1039427769d12dfde800d1745326fda
SHA1af8f7a485fdff9e51a9a1fb4b3040f39beb11d13
SHA25649699330d815025659f447b9866529d0efa50ec8cb66f7b4d20fec188c334d29
SHA5129101b6b39e07010a7bb8c404b7fb9e069b9f40d17aea0959333f5cddbd6925f57398f1b913ac26ddee37f28153aa8b878c4fffaaad1587ddd17fc0eb548f5124
-
Filesize
6KB
MD5258071b1b8dae1e58d8584bb4a1235c9
SHA1f5bcc8b31f5e2db75781438284e7019708156426
SHA25691c8ab1087475dc73ed8a923f3e3fb630094f960a5f4533e17cb6a01651620f3
SHA512a52b90f442d20be6d2a4d2dce67bf55cf1f8f0e239a2c9157ed95f0f47044eb19c250ce6a8ac9d550aaa502805c5c713a76303e94343b10b3e4bb26778dec45a
-
Filesize
6KB
MD5c1a4d9e165b3fde4e5335bfbda8bcf71
SHA184ac3ddb20ad3b103ab4a455e4ac1d8bcc925fcd
SHA256816330bc68a34fe22ca4a89f12e36b1276b392c3c630c608c4b57f9f6cc2b90b
SHA512a7bb58fdad5222b70fcfdec3fb387f2daba1bebf46a7925ad5e42e18cd69dc7db6106ae6ab3bd70e7c13d7932f75aacf5bf9f4f0e4cc78aac8fe671f307288a1
-
Filesize
6KB
MD593ef0606dd656d2358509de52c0d55cb
SHA179767b34d48eef997988e71a2bd7158c762be538
SHA256926f337a1541759d97e606a0a5ccd46c24d48b29965b480683e145b680fa631f
SHA5124a5ec7a687540552ba6d1a26cee7915fbc32d7e52d0408a11141e973d948378351dc4d5e895366d87213cce95ff9d6a4319da5ad3c213681660d52395df95940
-
Filesize
7KB
MD505bdd4bbc3095dee352146cbcb56fc8d
SHA1affbe1b1bf90d22efe116c70d8b4df69aca64fe2
SHA2566c21d954cf3e031ebfa02c369eddd05cbc409f36e7e91a34c0e13b601133ad9d
SHA5120e52dc7c675b524881ba3a353d8d1dfbdf87c1ffb1f221feba086fc3d946ce43ff05c1ec7aadfd7fce228356a5623db59c44d9e0290e976fdc7a17974d1eeee7
-
Filesize
1KB
MD5dd9086e78e75d39a0c558eb314e56376
SHA15435d9ac61e1ae7330265c8ed87afef382f6178b
SHA256b24d0247ff9819cc462e66692a68cd4e55c3e302adc0858382eddc5f83b1aef3
SHA5127820ca66ed82fdbac9063881b20479c4269c98825afad835ea85ddd277424f86fe6200623025a8506ee671430667e7ea42a9a26c3c5889fbd704a02aab2f478b
-
Filesize
1KB
MD550b9dae893128ac8a991c33f0d81c848
SHA1fa9186b5f40a41d29745ee29266804c46b641a25
SHA25693b96e9c5135d65b79488504e58137fd4d147afa412c2171442de1f9270ddb8a
SHA5125762379d8725ce52cb714b03487129c4f4e1da25bb7ca2aaed968a856c1a1df1894915500e1db3e9f76a977d46131aeaf95cc0ea39dfc6fc896730b1099c0ba8
-
Filesize
1KB
MD51e970d39bc0bf3a3e93f8aea4eba5bb8
SHA15039cd1604cb49931ce5a078c90f317f44ab239b
SHA25655cef9a10d480f6ea7b05af13af644ef472e28d2b41892469767a7143d000a48
SHA51256a87780f44dc4655ced61db526736ac03d52d53a736348af69f656deaaf05bbe9c2d685a80a2e34d46fdd5d08af68bcd147c73f2682e9fd1a0a45cd34767415
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB