Analysis
-
max time kernel
147s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
16-03-2024 22:50
General
-
Target
AnyDesk.exe
-
Size
5.0MB
-
MD5
a21768190f3b9feae33aaef660cb7a83
-
SHA1
24780657328783ef50ae0964b23288e68841a421
-
SHA256
55e4ce3fe726043070ecd7de5a74b2459ea8bed19ef2a36ce7884b2ab0863047
-
SHA512
ca6da822072cb0d3797221e578780b19c8953e4207729a002a64a00ced134059c0ed21b02572c43924e4ba3930c0e88cd2cdb309259e3d0dcfb0c282f1832d62
-
SSDEEP
98304:NzTZ3cINQscs0m++LNkT6OpwDGUUH57yvZ/49Mr8EO3QhA9Kq:Nzt3cINQscNmvLCwDkHEvZ/4R79x
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 8 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 9 IoCs
-
Suspicious use of SendNotifyMessage 8 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"1⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-service2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --backend3⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-control2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
385KB
MD51ce7d5a1566c8c449d0f6772a8c27900
SHA160854185f6338e1bfc7497fd41aa44c5c00d8f85
SHA25673170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264bb8ffaf
SHA5127e3411be8614170ae91db1626c452997dc6db663d79130872a124af982ee1d457cefba00abd7f5269adce3052403be31238aecc3934c7379d224cb792d519753
-
Filesize
5KB
MD59d50ac4aa4411c45ed5d5b606d28ff0a
SHA1eec8c5bb3ed797bc8347fb793fe9e9ef5ba4ded0
SHA256af14ff0684e6ecd49945ae59593be04723e42d73f3351dadfd4978b5527a6d72
SHA5121f740c4c2233fe0ca2c1274a82a073492744f1e0c3584290b86a65d9033bcfa98f2c776ec475b3c8009ec196f95af3e8b8c65b264e5c2aca7cbcd26ee6a7f613
-
Filesize
6KB
MD5d92f3fb879cc968ba051e2a8f9cfd92a
SHA1f18dee616f45d3c1f59ece7790de6070179d2278
SHA25610e2ca6fe4668d50038f44052a2ee09b577617427e9bbc081aa47e80f4b3117c
SHA5126141eec3ca9cb14ae7c114fc4e2819992906fd3546653a5694c6002a7e6a91cf1c900f50db986fff4b90e86f78a0172be591d794e367f1c836e791a912d28c72
-
Filesize
41KB
MD59fb6539d92a8c261f11a52cc933a89f5
SHA1171dbb32f169a2a9865ce8774e8d0f8d1f0eb466
SHA256899fa929be94b59d437be48c8f541977d81b351f26be3a27121e753e16ae4510
SHA5120cefe35bba8fa17a5be7b4633e1b4482a399ef385f1e020971e7e513d29a918adf1bec23e692fcee19a14c6a317ae8562b674f1bd57959864bbbaea282f0f810
-
Filesize
2KB
MD53f62fe770fb514aabb63858ff0729756
SHA1c5372d05ee1ce4d0a3ae9787090e6f6c59c1212a
SHA256063a716f0035938ee9795463bdf834fa114e88fe91f34bd2b363b4fb12778ee0
SHA5127ffb05fa7e4a980406faf91d0ef0b3e17129b0c89340094479586cfabdc75fc071716fad3db29f8e528d701f3f79082e3ba2c92c9f05bf582b0e1d88f198cfe8
-
Filesize
2KB
MD5fbaf791c715439e2aa416af9799d9440
SHA178ae25d6e3fc75516d3b57d24beb7a3096572549
SHA25625a464e525b2bd758b28eccaaf221bac9df4d66ee5cf18a99a48ee1874431671
SHA5125b9e9ff4f33a307b6c3821c8a786ef69503c8ec8cf3e6800019cb6154a43c60b5d56f86d36af1662f4692ff7af99709c2c7fcea4bf84144286715ec425561ada
-
Filesize
681B
MD5e117cb9dba745288cbdd9db1ae2253b4
SHA13d4c11ba473dc3f530e5f8f379ef959225feee0d
SHA2564c5f8022e32e4be2797c36ebcb3742daea44f3d414ae1266c75b97fd132e68e4
SHA5122078ad0979893e419805f7c39df15039225f552d56eed9251291a296dc419fe780e64f45cd98657613ae5520a91f0c940be6993030f9d8a3e812a541c437a55c
-
Filesize
802B
MD5c5c4b721b742177dc861a6928c530d06
SHA11979e3fe27db3092e8515cd4c83709ca741247d2
SHA256f357e002b65416c70bda36cc57c774e44dc28527b00d567e8cb225fc50125af6
SHA5126d43b79efb3773c5de8a57ce1e5ea0937cc84b8548d4700cacba847781fcd50c0dcff8d6d510c8696b064c4405eb915fb2e3f0d6726e6df24da85c8fc2e27534
-
Filesize
312B
MD50c04ad1083dc5c7c45e3ee2cd344ae38
SHA1f1cf190f8ca93000e56d49732e9e827e2554c46f
SHA2566452273c017db7cbe0ffc5b109bbf3f8d3282fb91bfa3c5eabc4fb8f1fc98cb0
SHA5126c414b39bbc1f1f08446c6c6da6f6e1ceb9303bbf183ae279c872d91641ea8d67ec5e5c4e0824da3837eca73ec29fe70e92b72c09458c8ce50fa6f08791d1492
-
Filesize
424B
MD5d1e5ed7d2b3f513e04fa349b3bd5d963
SHA1f4af813fffd601ccfdb2b4c3a4f7649b3144a1b0
SHA256f7d36c8442b8d5c04c3a8437a4dc2012fd1e9d9b357ead272d9912eed57c9038
SHA512f60eefc7c2016130cbbdc170886831d2eb821e94bcc8b7df51f3c7b197a9bd1701fdecd7bafe09feebaf1f8f660e5012e540b21bcc60f5c4584d63a4f086cedc
-
Filesize
424B
MD568534871cc7a93398796859f2fd7d076
SHA15fea1aa2dbd8fb7bc94bea22ed976e85f45c7e43
SHA256c452265cff088111aa80200312c5ae5e2a135e0dc08bfb2f04fd80f0d357f6a8
SHA512e13b08807a4a470839ad87d8b29991e13750a22ea7feb876eec8ecb836419c430734146303fff9a213f99b960d6f399407b8c1906323844e8bc435ff95e12dbd
-
Filesize
1KB
MD59bfc9cc72d3f2b9f2be8f8cbc1239a05
SHA1a1adde7e91cb330d01c5cb4add75b02bc8a841b1
SHA2560dbad1ef26dae8e47cd2c8aaededb36f0520254859a3db80dbd9a077b1007c33
SHA512105487c7cb8af51b59baa320d4c4b75aff3429fe97e3d06a054c2fdafc49cf6e8d0aa1364c7dd46ca33723c6e68a0be9671c3e18d2c82e1b25f1381015ef783f
-
Filesize
2KB
MD505149ec8643793dc0fd2eb730e96c7cd
SHA11e595fab3b32870f5d851d9d13278ae43500606b
SHA2569b374b9b5e2167399dd2664fb01e28f9f30c31443bf6dfd989a081e33ea98340
SHA5125037db7ddab49eca8ca65e95e55a9948cb912f60b639cfeba1eb45fc597cafc20a6869ec43c36c4bc9fa34f8439806d0bb78c3140c5dd0bd420101cb144cdc4c
-
Filesize
3KB
MD5ca3e7d6b81c92b7897e27c97c152e0fc
SHA18dc97f592d6992656bfcf5fd4c2743af2c3f5a6f
SHA256e49d0c2313b17e75e5e0c57ecefb399b0414a02fdc5f1592bcd60c228019f1d8
SHA512831106c0b6b59cb510077168e67009d555f96c57780579d794c51e296eba26aa7fc7a1449799270a4882b4d390bb678d42598e48fc58c8b02e8e0aaf493816d3
-
Filesize
6KB
MD5684f7f1335bbd9ed329ec5e8ad392886
SHA111e7029df86305d2f7a487f6927e2958bddcac52
SHA2568ae66de833f05a1d6a7daeabcb415b1c55704ad66321cb63db9a4f2de706fd1c
SHA512ca8417b876956d4f2ffa9b50a3ab4654ed9add0498234a56815bd01b4558fdf169ce284deead2dbc349051aa8b24e5ded4e771156e7b4843c4a02f1847a897bd
-
Filesize
6KB
MD59e02e033261bade7ea1acf5d8d84ddd9
SHA15d68c1a291ea957627b364531d3bbe1a40758deb
SHA256173631566096f7b63679f6fe9ccb341bb058212b4be26f22c2ae5afd577cceaf
SHA512e639f662e642d7414e48ae83ef764971fddeec09c6a0733b7f39f5dbcc7ea6f99dab2bb7db4cd39415c4821805fea9799bfa7c1232e4e2d05cfad6180e83fd79
-
Filesize
6KB
MD5c29a84308e113bab8cb43ef737552cd7
SHA18f2975a0dbdc112468c436edf3c9546efb44eadb
SHA256e844bc5a15d85e212ced65db31311204c709bdc0e4ced4b0e16225102426b1d3
SHA512f0118918359ade9b2b1e94faa0dc9cc70eb191e49957a7afd79bc3ec83e599f46182c9bf96da84e9ff37fa618d27640eb9057cdc54d7bf891e616b8702f1c008
-
Filesize
6KB
MD57098283d76706ea5c03e9023a082790b
SHA156516125d18e1ce5460f43f6b5e436947e348b8b
SHA25606330195e014b89f269bfb73b5442801307171dc7259ee05ef33367a564d0e24
SHA51290b613a812ac6cef7a5e90841e665d11b77cfe6514fa98c3b33379437f90564d174f8e63dba0fa5c00fa9d1c55090aa40965accb26f52fb5b7963f16f297fa35
-
Filesize
6KB
MD5baa82e8f91c02b8e88a9e36fe3457e37
SHA17220c69ee6e8f2e1ac1cc0bc44dfae11dc53f82f
SHA25641984e9bd05cfe48028ad88e90b7f62dc505daec2712f0d12cb541f6a1ffb6d8
SHA5124ae40c75354f35ea28e301584ba4508384a842f6d8e4e0a69a9cc2ad44b4628ac888c3d2e1b6436cbc9fc3f8096a7d2c84866eb4f2bf09716c36bc3d92fbab6e
-
Filesize
7KB
MD5baf2932de48a48c15116616d02d19a76
SHA1200b06266140c0e049eb0b9fcfa44bf22e24e1f9
SHA2560129174ebee11d759c8deee14914eb65b747534b0ea27b2643c44f7777daf96f
SHA512b9d5716fab0fd1430dbe56839e6b04854b4c2a26e8e2d9d643278dde491b781d1c54240ff637720cb0ea5187d769f9a1077cabfef009f26a076c434c689a751f
-
Filesize
7KB
MD5b5c386e288154b31f621e7a922a974cb
SHA1a485d71d7589d24505fdcaa22992e91bfe3e14b6
SHA256d9cccc126a13577e1da2458a4bae53d395caa062c1b46ab4bc207dc1e7255110
SHA512b71006fe96c141dad951a95067060df5f8c78fe9e2c189fd40c24fa69d3bc7770f297e5e8b4f2421c28b4abd452c16f3f3ce761e181e699effad7ecdfbe8f64c
-
Filesize
1KB
MD545b498b00dccd7dc8ba8f0f412555c53
SHA10eb9d6bf8f346895eec37ee0b05c22f90645f1e9
SHA256ee4b494963decc67c0a10bc4198f02625eac256c27f8fb0171aaf4ef866a80ce
SHA5123d811ec2cf0a0b1eaa26b59d2b70a7239c6b57a37dcad3cd34a85d5839e8c69fb4960cd64bf45ba2df8a35f6259c9aafbb777073e023f8865221424633e7eb37
-
Filesize
1KB
MD5c00bbd2071434fc6860f48e4ae9354bd
SHA11669ea591168433285e828f3055a125589ebc9bc
SHA256d1dfcbf9e18789320c4ed4a5323df8505792b6f55f0e2174db310b6b4f2cc0b7
SHA512dc37fca3f86f7e2a8516a9caf4e310e39edcdf8cbd666c6a6e47e568113d415c7e98ead910b293bb2a3d4f8f6e193de0dde75202ce84ef853caeb08b714ee380
-
Filesize
1KB
MD5ede1341bd0129f9496ab0d7a87ea9232
SHA166bd417e4155d540c10e07e559657524024484c8
SHA256d5599887deb0ed33a58dc581d953644ada3a99b1343f0a17a222f32d3365c84e
SHA5126b7fab1222fed81a8c0aaca4d827e4d616be55a41a8aaf153e1d43896560a8bec12268436a09028f41c9a1ef9a8cfacf509da112b219a2c493ecca3979bdb2b8
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
23.2MB