Analysis
-
max time kernel
133s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
19-03-2024 19:43
General
-
Target
AnyDesk.exe
-
Size
5.0MB
-
MD5
a21768190f3b9feae33aaef660cb7a83
-
SHA1
24780657328783ef50ae0964b23288e68841a421
-
SHA256
55e4ce3fe726043070ecd7de5a74b2459ea8bed19ef2a36ce7884b2ab0863047
-
SHA512
ca6da822072cb0d3797221e578780b19c8953e4207729a002a64a00ced134059c0ed21b02572c43924e4ba3930c0e88cd2cdb309259e3d0dcfb0c282f1832d62
-
SSDEEP
98304:NzTZ3cINQscs0m++LNkT6OpwDGUUH57yvZ/49Mr8EO3QhA9Kq:Nzt3cINQscNmvLCwDkHEvZ/4R79x
Malware Config
Signatures
-
Drops file in System32 directory 15 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-service2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --backend3⤵
- Drops file in System32 directory
-
-
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-control2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x518 0x51c1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
384KB
MD5b585545368e817b10fc6585f7ecb3fb0
SHA155210164d7ef342a07cbcf17397dd7e885df30e8
SHA256ade9fe84a536af764a9b02204a5cf5db9918fdb5157d0d77d7ced2cb932fe5ce
SHA51236ef6d5446ca256d07e9ae1b8ecc5e3eabb0a33db5f8a9730d40f79a7ea18c6d31847f1edb84ae1b95d8fa0fec151dab9b2b1b77525ff9f586ca7462debdd637
-
Filesize
5KB
MD5ed8bf40eb21c0bdbf3891b2f1984e9d2
SHA1af05d652e56e30532a7f1f7b224a52d47ac8707d
SHA256ce443330d39ff2801dbebe4e484b3b984dbcd3e983964019794f98cfe708b77a
SHA51243815352789951a6b1505c9c91c031f8c74a5a7a0aa760ea1bad32dfd9e35a08a289d0c2dd567630a466269ba97553450fdf3dd88c5a7d895ed354ebca07ca0e
-
Filesize
10KB
MD55acbf1deff75c9cb45c1a27f5999e43f
SHA1c89f6c0d2422029246775abefb694be32e2adbba
SHA2566ac22553d4b836bd05b12161d24f845b517283b0c3936fd632f34105aa7c0ec1
SHA51212bd1799d98b529817e8d26905d53ffb58ecd300da035321c22cb407066c359285f612a9375ec64dc5b1a1f29983a8b21a80e0ff4153024918a238229b6e8912
-
Filesize
37KB
MD52c8d9fe149820d3d4606e890cb1955c4
SHA1f1203c81308d86165ad0dff0233561da360df299
SHA2565e09f4063d835c2c8051e7650fbb7806ba351b654403fb258013a41209276277
SHA5129aec218016bf4af740ff06008754165f386bb36abd4fb6ce10fce6cdef48bfc03753443e4a6e7919b730fff44999398c58786961f6e7a5f293f5a85e5ba00355
-
Filesize
2KB
MD53195d601ce5cc7b601a55143aaed60e1
SHA1fc0ca082e62f7ffe4ca978196ec8e4127ea89c99
SHA2562f1c3ddb0da41046924a94ef1f5e34f08136020cc5ca7d0a8a1e5d9f7be85406
SHA5121de31254ee14e397f3f2a04945be22b749475a206527dd2dbe146a2cc509e7085ba3119fe2e73ef659d9dcc0bdc2b1e2e5bda083f2840a0a6aa69cfa942cf679
-
Filesize
2KB
MD51472de8dbd211607289ce44cc776b336
SHA194b5d3574211ec23dd2a45f726fdf9a9ead0ea34
SHA25611ab30bacfae94b3ebba62624f1243241688d60e2e8664c5f747f390093a4cab
SHA51227e87f50f2030accf5c1d22af784e010a2880362b3204bea95c49b3adf6ea7019fafb3cc62e61509d9d4e7e397ea5103194f66559c3e6df67b0d9c0be93cde93
-
Filesize
611B
MD583f15238bc097dc0e44441d9bc50da5d
SHA1f8c6e6f0d7f590336cbdda973a2d4a4673bf5fa6
SHA256268a1c9c76889859cbae0866065dbdb663fc9a5e87d8904053e5ebcb24de1b8d
SHA5128d97252b9586fb35004432750873752babfd0b4d94b3c4e4a955d6bba13e8e6f43863112b0944f226d5fd3657d879fa77e58c39a25c61b23eb0e5549d2925509
-
Filesize
744B
MD546c7cff5eb88eb074c1c0b04065f292d
SHA1a4c59920f12fbea6584a6d318ac5ad106dd0f7c1
SHA25612c5cf556e4774935bdc010b16e24b1e156ceb2ffa51dfae2ec621b52b4a0999
SHA5121bcb8070aa8722b8dd3002cb241b834b05776d073bada67dcba11028d568fd0c85581455c5e6ec008aa3def9876195e34cd6c9123aaebaebc54f53804f007629
-
Filesize
801B
MD56157ac0e88b629b8a5d2a47c97acaa41
SHA1f489a7084ca9e4a5132e6fb2fbd5f46a62f2e7df
SHA25691e9b75ee6ad13cf30e45034dab482fb86d5acfb25a8c5e0bc68a06ad333f93d
SHA5120b31714102f32a81e207eeaff94d300e62ba5fd98a64a656fed177dac1b19c3bb6e56fa38ed66b181ef1638928c8f54e6613d6f15d0e92ed9defddea2ee40b0c
-
Filesize
834B
MD5867b8fe028902f5e33ced839d85dd069
SHA112ab37922fff1d94fa1647d92ea0fef54264f92f
SHA256628a098ff82a99b7a57f85c073bff122a6fa713a4218a35d8abc75223adf8fd9
SHA512be42742b0ab994bfbd24ac60ad7b183fec5e331dd5864ecc7add4442d54e086e466319d4ac83fe536a3d7f251753870f321291e2cd381b1a57e58752d6130dcf
-
Filesize
312B
MD50c04ad1083dc5c7c45e3ee2cd344ae38
SHA1f1cf190f8ca93000e56d49732e9e827e2554c46f
SHA2566452273c017db7cbe0ffc5b109bbf3f8d3282fb91bfa3c5eabc4fb8f1fc98cb0
SHA5126c414b39bbc1f1f08446c6c6da6f6e1ceb9303bbf183ae279c872d91641ea8d67ec5e5c4e0824da3837eca73ec29fe70e92b72c09458c8ce50fa6f08791d1492
-
Filesize
834B
MD5dea6ebbc230906727ad376d7efac5948
SHA11607691210ce303fab121244e844ae49d0389e18
SHA256119cb91ba1306dab9fe8b53527fd9d9311f74d29b7aefa5832686b651af42b76
SHA512b3de8b8be31b05be4928b0d4abcf8a8a7f4acc07f35cb85ede31eff9f637b4c659cba2b8c1809a849bff86b369dfcb40842140ef5bb3cd47853d8b6222f24788
-
Filesize
1KB
MD57b192d780abf5db37d4691bf9ab95b95
SHA155ba1fd56deb115fa3e2dc75a05b1fba88376e0f
SHA25601923da2fe48d414e93b3220e151bc0c34ef55605e0430951329ea6cf3a3b38a
SHA512e21b1a481a6b81b3568f5af3611c360f89b77df6b0f3f54512dc7649836d9644dcfc483a707682117f24ee0c6a8e3604d661770f8547214be0bfe7f79d87e4cf
-
Filesize
424B
MD570e4493c33ddf3b86b5cef70b83bd2cc
SHA117a799d9608e8029a858812f09cde5d793a79936
SHA2563772a5b34a7285cb5055a804a7dbd60c5867170e58fd43e901a9eb3199815156
SHA512f04bd02cd004f3cebc60ab797d7f85ef21970b068af2cb4956d0aa2ffb70b96b01cc4791c496e42bd42d73196ad67d771577dedd2ec95adce4efc7876bbf100a
-
Filesize
1KB
MD5e57a338b20b90f79b941b2cf9786e315
SHA112c5794efa4314d7f63cae3cd085b6683afb7913
SHA2565bc6cb8c96c203f85b06732cc554f0f3cd94ec4fd7a0aa139af36fb2eb34a7cb
SHA512af0a4586e72b05ce23d2f3a69a12651a494a39c2d51bb066a52b3be1c24a07a5a56e6099dd2f8cb34e8fc21b464bafe0e70b6eed07d8bfacfc75d2e7fe896d83
-
Filesize
1KB
MD501a973a8cd14ad682881789eba879598
SHA1767a8638d945a1aa4b6d32d0f94529afc38e1dd8
SHA256336a3247742ac60074bf9847ea86264de4d3aa1cd685bfe3a5e2570c372e7f66
SHA512c593b4206c524ee8c9f7e8134891a70dedf89b65175e9ca6a2bca1b06572505e9adf23bc7486b9fd712523f81970bba1508b4195274e0cd1f9bad1bdb329c09a
-
Filesize
2KB
MD56c9f0df42ad9dbf506d2dafd117bd713
SHA1323219f783ec1938f597b1ec7377e2ec73304ff1
SHA2567e4209adcb85eb08961a3bfe89abf896e630d1e9ef50d95a6d845e3c340d0f92
SHA512388b1c2a10b2f83eca9337946aed5c5d60dedd0839bd7688176f0b74b332b8c64fdcdf8990583af2b7708cbcf0f5547430834e74954325da0c47027f21970a00
-
Filesize
3KB
MD5a1b0655e0b7e653f3cc8397f01a61462
SHA168425ac3821e1c25acbe540ce691314a8ad8d0f2
SHA25603d0a2747d0be7bf80773cf8916bda375d0e96024551fbc487ff8bf78799e4e7
SHA5123ab9ac04cd75e1c8c52953e42beb5ee6bec50c3ba54287ca09a46538d38dc44d7a990b710feae0e7f28ae7fa9d74169b696d32940a1ef4eac91a59bff219e553
-
Filesize
3KB
MD539655c6a7625adc16d2d39609b884019
SHA192744d5a56eafdddf82c8f654900ed5b8fc82a3c
SHA25657352d753be367ea8584f8bbd8804bae721fdf74fa3cde8687d3582a71bc7931
SHA512f24004a1153ff89c1acbbcf95258ebe930cdd715cabe67b75230f36c62c33fcce2af3e090bffcff50fd04965e6d219b012f2da88ea0815e1b46bfd0005f26e19
-
Filesize
3KB
MD5ad52847686e2e8d5070154c71b336a5f
SHA10a4a3b86daf97e27dd783017503de716de03352c
SHA25621e7eec0e13417fac5235f5378adb58f79d35f42c9ad0a7e2c7351659a04c983
SHA51246efe96c33c2315e1787caaf262a44bf92d45fde7365a61fe9b546f8d1cb77f31bdc04bca92bf9d641f921d82e2d969d1c4b9555e2a97f5a3c5da89f07d37e27
-
Filesize
6KB
MD51422bb571bbe18b0f38958db745ce6fc
SHA1adbdea5daf319e436efd611e9d53406e33f8e106
SHA256996053e0386e9a810e24fbd5404c123d066840e69bfdc73a55b55a156f23240e
SHA5123ce98311f38b69686772f7629fe1db62c37ecdc034f5df992ea20cbccc0b73fc642ae8234697f3089a34f7e74bd8219016938802a57dcd974ce44739eeab50a1
-
Filesize
6KB
MD58339d1e3c067d59d81db730c423bcddf
SHA1a30272211e46e33f820bba95c8f5495752349cc7
SHA256f4dffad7d38e54113064a194485cb1fc7ef426eaa80ffc79b1f93cc48ddf9be8
SHA5126dfacf845714ff1b01ad7a9a49ddf186a40a811d4c3fb0e0ac9bbb5c84a68402b1cd73a96873710a8470b7aebf04b1c25112b0e59b21b763786f51321501cd43
-
Filesize
6KB
MD51ca9d92a0c7cdbaf221c2097096f286a
SHA191188ae2b967fdef27ad98987a79c9372262411c
SHA256c729f4ef5850c6198100449e303f66c35b9c921b6c2e67a30df693a98cde2b04
SHA5128719b8059d96ef5e32ff453bcbde143eef6e0913f65f8470ebee3fd5c1652e5a6d6a640da4d93491ea8102601c07cbe501d1be1cb4fd000dcd01b03dbfca8b3a
-
Filesize
1KB
MD5ca734f8bcc1032c2903f39536b0ebab5
SHA1e6b5df145b1c81237981d9f3a3da19f4e30dc179
SHA256f52da04738648d1e23bf055e5585620635b5b9a646dd0b6bf7a21e7f7ff3fc70
SHA5125eae6d3c4c38ced52aeb315160f9f38180f323733b56bf230166f5419f1fdf606d26c39f714cdc4d198e7970f0a373ee6d25593fb3699a52f07d6392fc3f5a6e
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB