Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
96s -
max time network
101s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
21/02/2024, 10:19
Static task
static1
Behavioral task
behavioral1
Sample
AnyDesk.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
AnyDesk.exe
Resource
win10v2004-20240220-en
General
-
Target
AnyDesk.exe
-
Size
5.0MB
-
MD5
a21768190f3b9feae33aaef660cb7a83
-
SHA1
24780657328783ef50ae0964b23288e68841a421
-
SHA256
55e4ce3fe726043070ecd7de5a74b2459ea8bed19ef2a36ce7884b2ab0863047
-
SHA512
ca6da822072cb0d3797221e578780b19c8953e4207729a002a64a00ced134059c0ed21b02572c43924e4ba3930c0e88cd2cdb309259e3d0dcfb0c282f1832d62
-
SSDEEP
98304:NzTZ3cINQscs0m++LNkT6OpwDGUUH57yvZ/49Mr8EO3QhA9Kq:Nzt3cINQscNmvLCwDkHEvZ/4R79x
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AnyDesk.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString AnyDesk.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2876 AnyDesk.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2992 AnyDesk.exe 2992 AnyDesk.exe 2992 AnyDesk.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2992 AnyDesk.exe 2992 AnyDesk.exe 2992 AnyDesk.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2492 wrote to memory of 2876 2492 AnyDesk.exe 28 PID 2492 wrote to memory of 2876 2492 AnyDesk.exe 28 PID 2492 wrote to memory of 2876 2492 AnyDesk.exe 28 PID 2492 wrote to memory of 2876 2492 AnyDesk.exe 28 PID 2492 wrote to memory of 2992 2492 AnyDesk.exe 29 PID 2492 wrote to memory of 2992 2492 AnyDesk.exe 29 PID 2492 wrote to memory of 2992 2492 AnyDesk.exe 29 PID 2492 wrote to memory of 2992 2492 AnyDesk.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-service2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2876
-
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-control2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2992
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
385KB
MD51ce7d5a1566c8c449d0f6772a8c27900
SHA160854185f6338e1bfc7497fd41aa44c5c00d8f85
SHA25673170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264bb8ffaf
SHA5127e3411be8614170ae91db1626c452997dc6db663d79130872a124af982ee1d457cefba00abd7f5269adce3052403be31238aecc3934c7379d224cb792d519753
-
Filesize
7KB
MD54717d149bca3a08cfddab7f1f7394311
SHA1026ebb8dd01c5aecdfb4b881955644b58a08a694
SHA256481462f13d40eb1229026779256d40cd4d73e3e1a2ef9eaad0d3f60704740db8
SHA512d4fc8a49c709ab54122700e690b0dd0dd02f5bb20f335e8bdb1e494a9bf8b39f78831c145bc6100c7ce11fbddb476e70e5b31a2373887c61c65c7813138b9eec
-
Filesize
2KB
MD5845eb922473f59eee152ca01c8f17a35
SHA163c43d4ad497ea25d1ab76a4e24c4c2e53b30f36
SHA25691fe2e26cdc8d917b6d80492d9385f8a2e06d3f95564f325beaacbdca20fd0f7
SHA51267442b04c345d74aefe370fc1edd737cd8051f838b103165ca7cb5dad6f85219ca3d5749160f62264f8f28ffff7e1757002fdaf21a33fbc84995298413dfbc0f
-
Filesize
2KB
MD5b3f1b0f92e834dfa0c7803c58714e1a6
SHA1dd13947007971874385555d4d622d35289db3e86
SHA256ea7e871012a4d579ec3977170805268ccab068f23e4a9629ec209fe16b3f7ab6
SHA5121b7e2e79bd8388f0f855f5125c5b732ae1f69e3f39199b5805f40196ee66939e99033575449b44956d23b74091834012eca7f55d12274c8c7d3c409c1927bf99
-
Filesize
612B
MD5064b182a4ffac84fb326bc6713ec1a57
SHA1c9f93336b75d197f92e6f721eee528b598b728ca
SHA2564bb811a7b07e47591a7155ede9f0ad2252ecef6a1c5962937dc1bd4d823067d0
SHA51229e44f68bbeac2ec0b3e254965dfdb28dd20b446e5c5670fc0e271ff0d66eae309ee0d3c5fb605cdb07ef3ebb9b97acc13adc16edf581cbd673dc2b752cdda05
-
Filesize
733B
MD50b2630e61999b893cd8c38b82fd940a4
SHA1a36b49109d012598680dceb660e164cba2866083
SHA2561e5aef5532cc4ac125b4277fbd685941076c0c7bff4f2bc85bd6f449644326b0
SHA512ac00a6db42491e0b6e4970e6cfd1286633cf74485a77b10d0cd6acd13cfff2dc4ec5c4fff76d17bd692b979e63a10e383e88112f2d0cc22a2eba6cada8979731
-
Filesize
802B
MD54dfc48139b45faf1a790fbf0586c4d1e
SHA134ed339de5a768b945098f8ce6795c7c0c831fea
SHA256bbf4ab9c8dcef57defb94404baf6d34eba4f70c9d4d9d718e8209bdccfd25b9f
SHA512ab006f8aeb1db5997503b37802031fab019d79a8d6c34b91ad24a31c6765b4e56968e843b59ddea8cdd270f08a7bcd98bab98a2dd1730adf102a3dd821bf2501
-
Filesize
424B
MD50294d6199e1d3f4ed8c19021d6f247fa
SHA159ff9ef1023616f30979a58f66a739dad9c1bec3
SHA256ee10cb97b3d4e0067d3f34f879a130f459640a2401fede703b35912fd846c7b4
SHA5129c6b1bffb83e4d9784e0cb603e196e7ee9f29bdae98b38f004e1fce87d90f5c49087663c5513b0e48b1214ad034049aeee81e35ff8aeeafd32329a1e89131c43
-
Filesize
424B
MD576f50d8421a34b19584d432360605f06
SHA1fd0c18ffb7ee9f71aa0da807a6ee663d8545fbf0
SHA256775fdd0d38def10603bc50ae4e0aa79cf831609024bbaf38d6fcfcc4dfdd5820
SHA512247c6733966e35dfd339b41db4d674e28d72956b4377849933508438c24ec2946bbdfd7b667077ba0e23f3d333378c4434a820bb3ee206326d0b38577b08620a
-
Filesize
2KB
MD57599f0c709ffee46e800a6fe596b2ca3
SHA17b116dcfaf350e1625aee87c73581f843ccd59c0
SHA25697abb9c81cd84855956f976f8a8b879439b8d872b523d0fb6795c690ea10dbc3
SHA512ea92eb9bfcc806ae43dd2a78a27d4402bcd06be5b16f5dd6b86b3b5556e79e81c7cb979b678216dc481cdff3436f2ad3381a4246f65e89d276450bca2df1981f
-
Filesize
3KB
MD523fc6d42e4fba0b72d1add9fc4059706
SHA1d2df4d973e4bce38110ddfc3858fd6472a6880de
SHA256df7cfe189fe56b49e3c8ae455169c03b74731b41437ab4bc8b4773a70dcca0d3
SHA512c3e8a9fa0b12447481c8e3f0b5e7893de9567195abda93f37391a9ac7ec51fcd20f1ab4fc42347d40f8eb71b4e88561e8b0a61119d40c5b6d36ea5afd1159cd1
-
Filesize
1KB
MD59749d6125a4abc71901481bfa3339cc3
SHA19a94212c1585ca18ef75c72a3b416cb4cfd540bb
SHA256b9a5df7966bc7b42af3a5f2672f2870ff5b410916cffea7f330c75a88624d486
SHA5127623a172c3f56603fc790cdefd168e4ad719560dfcbac2b2de90662fb2a08013bebc651eccf546fe544e67b037aee6ee48db2ee9c8762dae304c94a77572cf8e
-
Filesize
6KB
MD52dd235faffdbb01d84481beefeacae83
SHA15753458b57c2afee417bcea86f1c6cc52697de50
SHA256b93ba23b9b33c383ddfb466c464835e36cc7e28c3e34454ca19edef2c6614f02
SHA512c5d3e6650286e447242ff2fe76be601741b0446356490cfed36491b669b76ecf8c4ae8b50a6491b33f2e53b365afe518d2b15b2f3cb950e5c4b1930b6dfa0c12
-
Filesize
6KB
MD502d5d88bb652bb708461e4a3be7a4b8d
SHA1dd61010bd2967e531cefdf91b0d2b9b516faa2a4
SHA256ea3813fa102ad549ba1010561d1f5e9adab766edebe2615944b31f0af2437c66
SHA5121127b373c4ca45963dcdb427dfe8500622d339f2e53831fff1ce840cb28f1bb1954fada53730bc47f930a33074dd8f1a63119d7bac348ffd5a54effd294ecaa5
-
Filesize
6KB
MD5f0132da864297850d25ea2ea3f68057f
SHA16b9aa4e6f9deafca2161b52ce258454be2b4d7e3
SHA256e839b60f676d8219513ba61404053c5643367e262ec75e68c6d634085df4885a
SHA5128de1af885b631dfb3650c593c72fe8bbfde819b2ec0443dd9c504a41e6a4aa9908d5e57341cfc3cfa506d5b0d59fd0fd8eacd75da6812637665115a487d8aef2
-
Filesize
6KB
MD5eb601a6964036ac860ffcfb95e7d8822
SHA13360b5d41722266596e45b7111e32366f7fe90f6
SHA2563ed2e3c223fc063283f488acb371f0a7536ac991328ba44a7b4f8bc4bb9147f9
SHA51245a7ae3d76406fd9151d7073d58dbcc823cca0ab522fdd42a0657c6c5a2abdf01801c2a22cbc3b446a971a75a078f5d0558eef29a8fa967882b225b80f2c07c0
-
Filesize
6KB
MD57d176bdc5d65b50ddce89a1b5bcf7dc6
SHA11991672f2eae63e980a8493e14b15b41b2a834ff
SHA25621e597d2f4d261dab0bd40303ec23dee6b1a3ab10b42c76c9c057c6cd859047c
SHA512378d29a650f4f27667c995c542d39c603729d5f636665f40cdf67e4635b37f8ba5156772b8247b3bfae0d0b05fa69a83df606c748ac3e0baad00a16f42f7f7f0
-
Filesize
6KB
MD50e9cd371f7e924506ba3d9998a1a66ec
SHA18f7c545109a491e693eaf9599f02379052ae6a6c
SHA25678399932e151b3fdc98fc981981869a78c5dfb74b0b9f82a4faf62e2c19c1dbc
SHA5121739074f751550ca91a6319e228a64b37a467481021118a6f9ebfc0be1d0323c6eb129eec31c494156cd17e615be513fcb1c93e7c3856fbd4c2980271315b8be
-
Filesize
6KB
MD565815d260d18aa9ea8afad8891625906
SHA176c3f4f915061fb3d36340711526fa9b92023f3e
SHA2563e8737d1fc44399021ba03ed67d66465f3471fc085e2d154087058eafabe4946
SHA512e8b86911878ccb352dd4ffe24a65b6a214be21e010a375490b6727a9f35f095751f6b01ed16ef1755a60695d8990a5d2a0257b54414344bafa32d8fcc55f44f7
-
Filesize
1KB
MD5884ddc41f73bbc15621df017ae2cc407
SHA105671f14971fb5888b6eec19898ff7411139f71f
SHA2569b69a09aff9ef9ed27869b274e2c5133722c665111bc697cdab033688c65a79b
SHA51261f214ce4ecb083aa0c92f3939faf0b3dfcec1d06bb10641c867c223222ed041a101ffa303448677464742e1ed5d9908e0f049a6c6154e01b8c1fb26ca6c6f39