Analysis
-
max time kernel
1795s -
max time network
1797s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
-
submitted
24-03-2024 07:01
General
-
Target
AnyDesk.exe
-
Size
5.0MB
-
MD5
a21768190f3b9feae33aaef660cb7a83
-
SHA1
24780657328783ef50ae0964b23288e68841a421
-
SHA256
55e4ce3fe726043070ecd7de5a74b2459ea8bed19ef2a36ce7884b2ab0863047
-
SHA512
ca6da822072cb0d3797221e578780b19c8953e4207729a002a64a00ced134059c0ed21b02572c43924e4ba3930c0e88cd2cdb309259e3d0dcfb0c282f1832d62
-
SSDEEP
98304:NzTZ3cINQscs0m++LNkT6OpwDGUUH57yvZ/49Mr8EO3QhA9Kq:Nzt3cINQscNmvLCwDkHEvZ/4R79x
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-service2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-control2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
385KB
MD51ce7d5a1566c8c449d0f6772a8c27900
SHA160854185f6338e1bfc7497fd41aa44c5c00d8f85
SHA25673170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264bb8ffaf
SHA5127e3411be8614170ae91db1626c452997dc6db663d79130872a124af982ee1d457cefba00abd7f5269adce3052403be31238aecc3934c7379d224cb792d519753
-
Filesize
5KB
MD5cc706fec1336b49ecf5822b17d7a74e9
SHA1ab2491dc638bfcaa13a953e715eaf61cc9459e39
SHA2569d1a1674aac5e42e08b9d4f5a2ea25aaa5e534c928d9a4d9107591c0643c0d61
SHA5124e55005a6fc8edaa670122b937160c054d2e8228783630dba609abb15b5a0b175fbccabe245039bc9b8f7a40283d1ff30b376c9298b69ee5a4187ad89ee6a1ce
-
Filesize
9KB
MD502df8f28c92e1300b45191f7198da78b
SHA1bbe7114d38d7936080fef0612f84ad37efc889af
SHA256ed581f10e69c64471898fd3150f355f366028955433685e23b7628f1b3c1cee1
SHA512fbdaa6dca47526082c86c39765950e3abc8dc4e29d50ced6e1e85788981a8a2713c7fd83b58167ddca6916055e6422142031b58524e42275bc1d3d485feb1e6c
-
Filesize
2KB
MD57b3a9002bf9c6a4602820209b0d8f3a3
SHA1672194703a972a5c842da7d7e94a160f09c9ee18
SHA256682412e8d4142bc8fdfd39411f25913e07aaf3bd07669ef5978f1ca6844621da
SHA512f2c52d68fc34f1047c8af0d89908a15953b2c74bca18fec395bdac86e989490889bcd2800e86c20949fd0fa20fd5ed43151a068484541784d787eb34483fce0d
-
Filesize
2KB
MD5870a5327f5a93db6a65bad96c569286d
SHA110f37413fd7b32a5148481d9d1b922c0f632cd2b
SHA256be6ecebc63e0349bdf670e587cb2369b7355ad72293a005ccd03d842fa4357f8
SHA5125ab45cd670886a07f6ea14d8b47f9176da530a7e8deb69d0a9529fa6301f7006d2e6a3084bf06c6e99f247019bd570db5d09254de77eae1ee5014d035bda0652
-
Filesize
680B
MD514798fa50a76ae2e9d871ac094a263c5
SHA1a8889746829d3fe779405e6f0d9ccf2c54087d04
SHA256c449b77a9c9e65e044def17687915303ad55339750635e147b8a60781a4a9268
SHA5124c9cc64b9098e3316e813f5535871bdca73f27aa2421294708b59f80a2a351417abdf5cd48e102bb25a35cb936bcd4f6b42a12cda17aa54544b6c65021d301aa
-
Filesize
744B
MD5e0b56b5cb19bf95c58ca57fbe4ccea12
SHA16325aa77e7aa9c6e377d1b2fa0875e22f98bd4c9
SHA256712e3dee9d540668fd8fbba7e56e62c4fa6787981a55edcf28e86f0f2da3f2a8
SHA5125d5ba6f9b69246e2daf4b56653e0d5bfd570026508bf6fbbe60e0fad5dacea61cc50ab70ac9fad01e6a08d7ec84529765a0c415821d48473a17c89cb7c6a2c76
-
Filesize
801B
MD5461d0785fd9931bbe02577d931c78089
SHA121b1155518a7f3a429dd3cd238204c8c2910992a
SHA25604e3a75a756541c30e44dd703e8ae97b24f8242e34517c6cf04aff783e3f7596
SHA512ab27284a444115cef7b197e50ae456cdf9390aacf3044ff1a49bdba6270f0c8e9ddd7f3282692e9c6f94a6d47f9d76eea776f969261a69dfd5c821a3e80084d9
-
Filesize
312B
MD50c04ad1083dc5c7c45e3ee2cd344ae38
SHA1f1cf190f8ca93000e56d49732e9e827e2554c46f
SHA2566452273c017db7cbe0ffc5b109bbf3f8d3282fb91bfa3c5eabc4fb8f1fc98cb0
SHA5126c414b39bbc1f1f08446c6c6da6f6e1ceb9303bbf183ae279c872d91641ea8d67ec5e5c4e0824da3837eca73ec29fe70e92b72c09458c8ce50fa6f08791d1492
-
Filesize
424B
MD5376ecec19bb4b1dfc0b894f2dd68acfd
SHA16ff2306405c50f9ced38485e60a11fa8077e808b
SHA256443aeb34832c6dce8499e1ad1311457063fa1fef4d2e0ae54b55d0971af46ea2
SHA512dc530204da59fbfe7e2e8c6520083b920c35f03cae497de22f8ba9325536e88f15ff67223affe0b3ffbb536df72c1b447fb342ccb6a174bc431965cd85b1392a
-
Filesize
1KB
MD5c0d0bf07c9a6bbc93dc7bcc84e3457e8
SHA163710ad6595996c24a63cab212c48cb25353cb15
SHA25663d160186872000d810c6ab80c02da8296f667a0ceedf3ce84e03af53c01ddf8
SHA51232026a393a8e2fde3dd6651ec5fb78bd9331eb37b4b956f2f5ea9a840226d4cd8b3b9a7f42f185dbd7a78f52c603b0ca472c580fb994f38a0551859d55b45b0d
-
Filesize
2KB
MD598e449fac9de873700070555ac8f5e76
SHA157bcd51e693a7ecd08edc3ec482f2910851bb739
SHA2562afbf4087aeed72f99d96fea7e64b99657711b602533a62bbeb6c03dab517e93
SHA51227be80f8fa4b7dea0673a3a746a10deefb864cd3959c51eb5bd1336bfd79373757f767bc0e787825cc8182773cc122acb14d1623718442af999e8c7a1b4af39d
-
Filesize
2KB
MD501b0e2284139d091f2898c2775bd31f4
SHA1736fa70b82590c143bd58c1836a6ad2b546e02c6
SHA256350512786ddfe487f634accff44dc6e20ffce3965dce8a7f255abe2a0d477a9c
SHA5124286027b737f4bd2359862000e6a58c95f7e1245c2ca2511710fd6293eaf5ef3b745fca0b5d079fc41961114e269a13a0031e29c48102edb28dd7d5fbfc6588a
-
Filesize
2KB
MD581e07b1cabc781d99c0bc2db22f7b686
SHA18f61a938707569c8c5c108a3d3d54201838857c3
SHA25630c3904b555faccf48168140c09fffdd7bf3eb6c433fd22aaeb3c36cdd636ac0
SHA5121a78baae5913766bfdf96e10ad7a2cbd16307f17a37df6362f95b60a8f0c5347769a78dab6260a03674ae4ca05e8ae5e0653edf6bed3cf05e88b68558c91a7b2
-
Filesize
2KB
MD5ecea5afd29f72fbf782f319c3e97e3fb
SHA1c7b8a0454ca1d6f9c5dc31692de7778bd5c43a97
SHA256163ce5bef6acc964fb05f56d2b97ed78fc664f6e680a4db02a79a753ed7f042c
SHA512c6b47c215bd8c586601ac2147369463e52bfc3f7678d524cefb83df68b576230e388111d3a2c24a9a5e16a322e9fd3a1efbdc7359afd6862f825f3c2e932c534
-
Filesize
5KB
MD5466dc77606a2853987de82dc501d80d9
SHA1fbf6ea63f844cd4abee296d9c3a2d07f42bff61f
SHA2565f1ddb0f1d7cd65f30a9c1443af346e901b7530fd75f616b2b572c63232603f0
SHA512b4041f229b2ac20020f1812c9b03f2e368265f17457d32b70ae50edb3f9554faa114dee630df3f23782edefff84afb3fc05415f7de312a886e3eb6264f8fc02e
-
Filesize
1KB
MD555a0706cff65bdec40fb57129884c6d4
SHA1dc017f1c8b6e36aa5ca3b570534f318dbaeadc0e
SHA2565ac9192cb755663a6283a9202279149e72405249c072776705c126b7386efb1a
SHA5123eeb742f65d615a5dcce1cd2a17b1742df418f53f3198327dd85c38bf3937bbf16e89d849075ecac316e52bf9e540d5a7c0f0a107d5fe28a15885c470fde4fcb
-
Filesize
5KB
MD533ff381a3f17265f6398eac9a99b6e90
SHA13565a41a7cf06be34757e3a54061e2fee7407a7a
SHA2563656117b83f5f94d981274cafbe66a4f0365e8547f012058fe0b0cbaea9e9758
SHA512129acee112a189bff376bf4269a59ea010d7c528c1d496100aba63b3e35f36d7e5b50be2133e577b05f63838395fcd9333c7cf4a373854bb0d86c3d6a9f53b97
-
Filesize
1KB
MD50e4a66a6213297965aaa1283972e540d
SHA1e06af307e1609863340e4b5c78b058b190937c34
SHA2569e4b3bc6ffc24d716221a2b3284496672171351bf3d378e8c0ce31f2330488a5
SHA512e9cd76da7921fba1addb373404f996ece4fb3f64bc0c86dcf5a78e81d2135cfd02a789c08d610d5359ecea5b8f7ac56684ffb43673b2193bad9b20950ad4d865
-
Filesize
5KB
MD52052cdb1f6f310579276099367bc0f19
SHA10af04430300a5629cea0bff459cbdcd76400d514
SHA256f8df52dabe2fa3ee67a5f0cb742802a32c21a88de967c6a555176a20da31a521
SHA5123f72acd6d407110accb76ecf2e585e006d9121aa314fdb55b8aa5b38c599d26a7e487d147f352baa39993ccc8f464b07b1d9041bf472447519505605fc8d978b
-
Filesize
6KB
MD58ca97a4be2a8bf701c5c9b31114859c1
SHA1f9ffdabd6496a85702956ea24be70f434c0d19b8
SHA25616de60047591778144c7b9b232035e802376c23913d58587550f8d3d0bd5eb10
SHA512e289cf8d9cb22b9e48340d4788226bbbadbb49a541840c28f9a1b0daf1ea32f1351e809fc0e372a5cb0390828789f21acf1a6a50522cbb01bdcdadffbd3f7594
-
Filesize
6KB
MD50c9fd77566b835d07a892b7d1c599fbe
SHA1429ee36cb17fa0ab3f62889c36ab01408d9179a0
SHA256138f78aef877cf57d256dfbc2deb8bce00577605a4f240431e585c639a0e50da
SHA512c2d6103637fe3a325e44fe156bdb0c07b63d0d0bf3c9cf8c8983c143da04f0b9cc62fb263688ec94f5744dc95d4bd142d0a3689affd0af7459a9b72cdfd85bca
-
Filesize
1KB
MD52b1beef76728ab1416f76a8322e6d4aa
SHA1723c12385cd3245b1f3e4dd31491a44676c44175
SHA25647374c82256dfff6cb2f8198fc01a28ce81f08d351e9a9c6ad7355e3bce5093f
SHA512bcf14a6c34996112e766f60bfc60c0ccf828f42d15e531f750005af2fa2d51c68ab14773fad15eea8fe1db97e4ccd6c78952c9390ae313a1554891dd4f8003f6
-
Filesize
1KB
MD57ed51a9a8bd90fddbc044fecd2d2de1c
SHA100358efb22e8d9c616a086f3c71475c11325c601
SHA256b91f92ba450b5eb05c27a5aa3e8eea066950be84c712a20ab13e741abf371c07
SHA5129bc86e96970751d8e5978b247398f009793b82839e97c0fe6bc4b49b0f218957cda04bd27be37c96307cb7fc9217be5280c94f1060556377ed45ff250d8fb8f1
-
Filesize
3KB
MD53c5cc49a8eb66bfb383f24167bc39b35
SHA14966df6270562312d49c4ad2c14433337f2d9abb
SHA256c7e0800fe7d622d6170908b5cf628bf86cd99c3fc0089a9264e8afc479be6665
SHA5128645b738dff5f9c11328c89c19ba4373ec466daf80093be5306c161faaf8fd3a75b805a11dd3563287a46b6a8f88b00e95f9ed487614ce3e01f4ebe18f461504
-
Filesize
3KB
MD51059ba0c068ae988902378a494c51852
SHA1bab5e6655b4c39e4ee6902560a40f12e0ed3d091
SHA256c813dbb26c7b94326b67a8d66ad23016e771517dc44aba04141eed363f189d4c
SHA51223acc226ef37d2d954460b94ac22ed22df063a4b2df7449415e4488518936be9026d19f29ba264376168dde41c65eb9aba673acdd4eade2cc8b68548c4f7cf70
-
Filesize
5KB
MD5f16ce03b54931bb005684d9429e183b6
SHA1cc995c6e74343e686601cd5d1fc5972e3f0cf6eb
SHA256f7521ea5c2e438de489e0f8320bcd333bdbd1d76140db81ee189d132181c7515
SHA5125d118ea8376b6757635498f75e61182eea9aaa43314a7c69f56885ce303c7d2d11ea9b9da4c597a70a5c97cd1ea7144f81b5750d7a03d3f7bc7c79e918de13d3
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB