Analysis
-
max time kernel
306s -
max time network
311s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
29-02-2024 19:05
General
-
Target
AnyDesk.exe
-
Size
5.0MB
-
MD5
a21768190f3b9feae33aaef660cb7a83
-
SHA1
24780657328783ef50ae0964b23288e68841a421
-
SHA256
55e4ce3fe726043070ecd7de5a74b2459ea8bed19ef2a36ce7884b2ab0863047
-
SHA512
ca6da822072cb0d3797221e578780b19c8953e4207729a002a64a00ced134059c0ed21b02572c43924e4ba3930c0e88cd2cdb309259e3d0dcfb0c282f1832d62
-
SSDEEP
98304:NzTZ3cINQscs0m++LNkT6OpwDGUUH57yvZ/49Mr8EO3QhA9Kq:Nzt3cINQscNmvLCwDkHEvZ/4R79x
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 5 IoCs
-
Suspicious use of SendNotifyMessage 5 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-service2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-control2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x30c 0x2f81⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3688 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
365KB
MD539cb26f3ca42cc83cc8204d4e8e359be
SHA106cec31b6967e3312123441a6c0604ee2c458518
SHA25612dd4792c47d578a088a1cf53b9adf2d7e9cb32c3bb4ccf513857dbb3b331778
SHA512f60e97584e9469059bd60832627d6024fe35de10063e78f0e753c7619a7d62cbde274f217486bb536dc77f61ee1ecebdaa3cc5d13c561f8d625054b2618066d2
-
Filesize
5KB
MD519b4a2ec0cc14610c79519451bdc570c
SHA117d379d0fec832f2fe3704f40efdb6c6847b2ef2
SHA2566532059ccd5b0a1921bcdc4ddf2acd8bb135971efd8670d911ca3eedc8d39dfa
SHA512b7c6aa1785a3d3247458cc15823e63e7e8f754538dc503c77818890d07f71c8cd4497a0c3ec8c67331e4aab753da158b5b197a99343c8e4c023e732f166dce24
-
Filesize
8KB
MD50027feef08f458c395c6e5bdd89fea84
SHA17cca438101b4ef06b86560374c4b1d1ec1edec67
SHA256cad6eab11fe3f7f336ac0566ea2a49f862ba1ec20eb842020e61cca6e4a7686c
SHA5129f56a7de66b3be14b3eccf9d4d8c028d15442f19648a8ae8ae719da147688a7a9d8ff917ab638a33abdf39800fb94a8992b15c72ef2d307fe047ae59bc3753db
-
Filesize
2KB
MD5dd5de2e93ebb82d6fc6e37ce3d3a4be1
SHA19c4bd05ea127227b6a0b908ee880c645efc161e4
SHA25643a563d18d390615b265779a6c68f5c8bf6befb84c545abfb6a299ba6e51bb10
SHA51229597b11762e87e0d9dadd71cabf720787f9f818802d63c0d26ae984f65905d14652f26872054f0124bcf42200ccbb9b456446ba4e8979ff08944878478bcaad
-
Filesize
2KB
MD5f7b812cde2e8054a4d140a34d70ff49f
SHA190dce6f28652c6e603811c2c7a3b7d7f15fc9e9e
SHA256fb7079fc3dd2ed1dd5ea1dd02f4733f403aff71585041f38cddbeb6c77e2c0b8
SHA512e004818ccb5c0b389e309a07a80ff1ce6b50a424f9c5ce3dd03ff8c4a469eb15e5872d576a27de77fb406be3a3ce65385a1497146372f871d97fa003a5130af5
-
Filesize
612B
MD583fd2096729edd9f2c73da4ba38311a9
SHA17453fa105f6ec5ed5ad7214b1049babde1e43ff0
SHA256869d7a4a7769f989d381013c6e5af203ddfc79397a1fcffdeae0f98890ead5f3
SHA51231d78d99548fd27edd8a9d74e0ed3353980b92f82cc904f448f9919e762f9fac6c7837e421c80a7bf860e5db3e6cfecf57d653397cc7e1b924748ee0bbf962be
-
Filesize
733B
MD573b3bf4ef99c09b1897885fc152bd758
SHA122cefd4076a690b13f904c5a2129d491d0c6bb5b
SHA2562d49c46a660c135def879069008b3195c4677735158aea5167602991abcbebd6
SHA512ac1548d4257a2c840c051bdd89e82d5596fb9ec63592ff5e47219c309fe3d078943091b7388cec7bd3fb6a177e3371fdb14989fc89844b2a74aa7a7a246538e3
-
Filesize
802B
MD5b90b3b6f99a25e78b2f29e5ad1fb6a66
SHA1afe331c1db68d5954cbc1508809fb169751ab109
SHA25696a475ea9fafbc71fc5f67a5ddc360ab6781394e2cb81175b8f4fadeb1fa426b
SHA512a43c8b600a6f38ea945a0356e47a56bdf2f6fa0b74a331879861da1af70d3cda48dec342bfebc99263fb06f2f1aaf98027e0c31fcd3ef8e6e7986eaa466b1d15
-
Filesize
312B
MD50c04ad1083dc5c7c45e3ee2cd344ae38
SHA1f1cf190f8ca93000e56d49732e9e827e2554c46f
SHA2566452273c017db7cbe0ffc5b109bbf3f8d3282fb91bfa3c5eabc4fb8f1fc98cb0
SHA5126c414b39bbc1f1f08446c6c6da6f6e1ceb9303bbf183ae279c872d91641ea8d67ec5e5c4e0824da3837eca73ec29fe70e92b72c09458c8ce50fa6f08791d1492
-
Filesize
424B
MD5de395fa7ed60610e7ff3264bc00f62ff
SHA11f16d62f87be47f5a96c9c48d5e218888d7aa0fa
SHA256e5df52940ee6521c01719b565db815d2f19e9b52d74c579b5d28641afeef36d7
SHA5121e68463c1485577b96f3e4e9a99fbfe258447737b1996d29f98d9acc29820350b164f3b07e9c1629b54d946618aba84b6f3267f6e92e516096f7ab3e03a9ecb4
-
Filesize
424B
MD523a577e77ba4990109fa9f6e08a6ed73
SHA1dbf9eb84972efbe6a2b2e70daf010a74dbae40f7
SHA256a219a1ce8d6831868e136f93054f040fa1230aa0fd5a80ede8e091d31e972687
SHA512b01e6ffcaabd37b6570263c4ff98a5826d15901dacc353a5f4b0551260aafff96a3225ed01d71529f134ff17b6cd345e99fa7192ec3dc61effb4309d8d4b5402
-
Filesize
1KB
MD579cd492fcd359547ec8eb7f8a2fa470f
SHA1540b28a447886ecedae77ab4f66381f81653a37e
SHA256643f9920c20fb5a8fd24fce86fab8c468ccab0a2ff3c1a15c912a7eec8550941
SHA512d6c92efce6f2e165c647f50265bd770ca9dcfb81c4c64571adf0632a2b46396ce951ec43d6fe229f586cc7c27a6aeb9539d07363c4241af0f7797775499b8f33
-
Filesize
2KB
MD5b0d28019cad705171ac219845eb2273e
SHA11f4890c357c94800ae322c1a63705a142f33c205
SHA2569e20f374974c996cfe3db8b2375ddb9f08383ed780b845eb53332af9fb747a8b
SHA5129d209a712e95ee1015df74abe705787de883535f33b02a9021a94460c07d75b16fe7b9f1780f9b340b98e16c7f32d05ff400078712eb46929bdbae88a7124a14
-
Filesize
3KB
MD54010fd12ff1a3c28347ad71ceb7e80d4
SHA11d55341078882d00671e29eb6f83407bf19b73f4
SHA2568a6497ed8d328dc1c3e285a51534a87c0df6e09fab312788842e733fe9145558
SHA51266f8f33621fc41333d7401dcd810772b970eabdaca314634fdd62fdf0b0a5f88a947ee46150acef2dfba1e619a5eafaec60ac1b7b93b01860e06dbd1004fa4c5
-
Filesize
6KB
MD5d6de58839e16bfae2af1b4d8769d2946
SHA1270544d887c19dc3d19befe1fc63ea9318daf126
SHA256e7bbcfe979f076c8f13743282549b03bbb685c9461c53b95d6d2216176919e4f
SHA512895d8a2e150d312825467d85c630d852fe8756969ecb460d9bd754cd4ef59061edde1053bb7ef7e847e017c4290867e1cd706d7f6ea454d82bfd5159d848e1b2
-
Filesize
6KB
MD5b6939adafcbd4ea7a795b93fff4fd1fc
SHA1707a960d18371be34b2634c3041e6bf34d61d66f
SHA256ab811d046ec3d90414344b0eb2f8191f773fdb46f87f79a79ad40c552d5f585d
SHA512d597757be95b450c9b4738d6444ebfcc419db4a1a7182186a2e7b76c1b6b432e1d7587aa0f618aa5f54e2f4c119ce08d12c0c54f9520e8df22b3dc6f5f4a75b8
-
Filesize
6KB
MD5b3ef9f8acf05a946a3d9a023be2ddb05
SHA17ee62ca2c20b9f2b46422a3e2e864479d181f528
SHA25600e16895e3d3d68c6ebf7005e9f5fec472f828383eca26d2728b567828e4e909
SHA51248f9dbaf80387d555a7abc240977fdf785b04085b4d127ab90c31b5288fd1a2c6e68f02f2b6958ee5f9a8fbbcf8d815bae7ba9d02e3f76deb8e3b8df4d33e8ab
-
Filesize
1KB
MD5cc0bedbd308296e546b30fb37fa45239
SHA12fab80f1225409e671e5f2e63384ac20e195d9b0
SHA256e1a63ee7ce52d0e9c6fb33e3a1176a03681dd749687b3639e8611c1cd409795f
SHA5126c42d80693a81ae1f26de609bf897bc2bf6f0baed2d777c3ccd39bc52a34813261621135cc2d230b2e1a84ae191b7f1244b4c792b52879c675bc87dc51997f23
-
Filesize
7KB
MD5285717e4432658998aa76a1690497ca5
SHA1cb7a681ba5982c2aa5047c389fde41125cbfea32
SHA256d643c21fcc059baf727ac647609826afcb851e3712bbedb62a15d12021051570
SHA51297c27f199771996502849b26abe76ff7aef4cf7d2a50abce9f2eef78667f9e940a4963d284cbf24acbd64ffe919a5e3aedb3778c03f2a9cca5fc05cb7fac7797
-
Filesize
7KB
MD51e09b5223c0e0f95e098a3937a80816b
SHA16e2c00cc4cb16df3e134bd687da97246aaac7aca
SHA25671dc537ff93b7b372863ac042a1ad660472550a590ff1f3ab6a1f5e172d91e33
SHA512927dc637915730f50cb9d52eaf9b4fc0dedc626523977b238634781e0e590c35a97ebdeb8df4ecda2d93fc2d4c1581cbad4bd0e7f4d295174f1eb487b260ad04
-
Filesize
7KB
MD5f1fd24acd62f9514c40bc2852a5db4e2
SHA1e179c2b8ef640d20e63c1f6b0781cf16720a326d
SHA2566bc57434038c8e0a3fd6ea57ad741fc82b40fc56a49ac913bdee195f814727ed
SHA51269f28a6bd036d2a8749a9525502c3affd34ccf7f281b96a0d74d3119132e32c60eb87fc795a3532f7a6f1ac529fe1e6cf7fd9633733a7d4a86431b9f8840e979
-
Filesize
7KB
MD533f1752b5f0ddde07e9396054ae908f7
SHA12fe5591d344ebaa8cac247307ca0448256ff5345
SHA256ecec8cfa7367f239283c15e99af58859cd660d5dadd1287295518379e9d324c4
SHA5129b6f60887dca423289d8a60649f0a0857a97fd71365511f43b05dbd9b1aa0aadab102402d0857437e2bc90d49a5427554bf947bbd5035770a8c37ee2a8150fac
-
Filesize
1KB
MD5b21ed67bb99f0ab6791ab3b7ac74e6ec
SHA131c883af88822aadcd73672d76910135b20fc307
SHA256b27e5391b5720b09fee0b83f816e1b20905fd0c3d67a39c70820d0b6582d9431
SHA5124ae88daf083c7a4f4f2542da6188a3b4529417a0e2ccabb38f1251712faae511d8cfa515f64e5551681993135f53a4c46cfacaf064ebec1172027c1117a9f622
-
Filesize
1KB
MD5f836c67938d2333d141df63b6c8efe03
SHA120ee799160bad36d369e1d95cdace03482a40613
SHA256937d1454d75d771a8e4e58be36731cedcd69351c917daf15c5175bb5f98de63d
SHA51237b5ad3f44693d0689d0f87a908dbb9ba98a5903904adfad3bc0ac6d939a3f413765452defeebcddac78a1a44168a6e60cc4966802f3416e5da07df316cc2c2e
-
Filesize
3KB
MD500d5caf71fd09ef4b83fdab4a0e9b943
SHA15b968bfdd4f81ad4d5ab8de19d5c4388df457cff
SHA256da5a04e4e8fae6b89e1d762146447398f449bdda8fe450c9c5e85449b464b1e9
SHA5127168ece5bced0f6a79e3c104926c4cd1385fcbf531addadc8fc2938be7d0a93395c9bd9762f9fb0cb017e8b13a4bf432f4fc160db246c82a474bfe0412f142a7
-
Filesize
5KB
MD542c3dc6e1ad4172bd6744372d2da1277
SHA114e3e64d2f17241d93cf71cb3d1ececaecc74053
SHA256b6cb6fa4f7f63f7e193ece3b0603e84a8561e99d266986a8594c28acf6a4704b
SHA512b3dda30c8f4694524e9120dca38382c15f62949353818a7334a4588dbe1c7d2dc349bed35c3adf84ca710ae1b5e4ad947373c7130ab574d8ebce91459e5248a4
-
Filesize
3KB
MD592fa52ac43a442abaa3790889e23792c
SHA1bdffb8258eab52715148a5c8345bb6a24411332a
SHA256972546866f9c35b7dfdd4600d33e33d37a625c0ff0bff35b01385c428c80c107
SHA5126e9853bb4f06062d794123d3d007b0d712884361e3878e78cbc44b9ecab865f4a5184d21c3b95ca5c004d52b0a603e5b511732971949da1797d85bfcc5c092e0
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB