Analysis
-
max time kernel
364s -
max time network
368s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
26-06-2024 05:58
General
-
Target
AnyDesk.exe
-
Size
5.1MB
-
MD5
aee6801792d67607f228be8cec8291f9
-
SHA1
bf6ba727ff14ca2fddf619f292d56db9d9088066
-
SHA256
1cdafbe519f60aaadb4a92e266fff709129f86f0c9ee595c45499c66092e0499
-
SHA512
09d9fc8702ab6fa4fc9323c37bc970b8a7dd180293b0dbf337de726476b0b9515a4f383fa294ba084eccf0698d1e3cb5a39d0ff9ea3ba40c8a56acafce3add4f
-
SSDEEP
98304:G5WW6KEdJxfpDVOMdq2668yIv1//nvkYCRThGXBJdicotUgwoAo5beyjF:y3vEbxfjf4Y8yofvktkLdurH5iyR
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 1 IoCs
-
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 32 IoCs
-
Modifies data under HKEY_USERS 17 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of FindShellTrayWindow 9 IoCs
-
Suspicious use of SendNotifyMessage 8 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-service2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --backend3⤵
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-control2⤵
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x02⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
385KB
MD51ce7d5a1566c8c449d0f6772a8c27900
SHA160854185f6338e1bfc7497fd41aa44c5c00d8f85
SHA25673170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264bb8ffaf
SHA5127e3411be8614170ae91db1626c452997dc6db663d79130872a124af982ee1d457cefba00abd7f5269adce3052403be31238aecc3934c7379d224cb792d519753
-
Filesize
10KB
MD50615975eda299ea1840fcfe4949ee28b
SHA120b19bdefcd795844f0ed20c9272cf925b52f2fc
SHA25658b5ee7d912a83979c9350e85a93f170f5ea87f7940475aa4e8f4525c713951e
SHA5126e85798220af7a78248249a464bbc593e3901ef9e103765e138f2b9ae030f25bdde39f15b1e31b96c02b62f9c6746ed1fcd6feb544579370dacd8c8366388196
-
Filesize
41KB
MD5f723dd04cc87e15f719eab218621bb88
SHA16883007c70e7f122d6a2c6a415cdb2b6107cbf1f
SHA256c36160c9b270a46732275b72957b0d399abe59519e538713298cfc5253479f8e
SHA5124cd2bddc50209621ce40c4d216dc5056fe3ac17909087674e8927a8e15c59e5bedef80ea22e60771ef96346cc2e039ae47a23203d199de55b0692bcd4fa5374a
-
Filesize
79KB
MD5446b238fb2796f6e6c337007527f7ddb
SHA14acb026c961e3e58d5ee5b2e502ec66406f02de8
SHA256f3e14ffbab3bda6c90fb636492823c6225e1d0e0ad7a8beb29612431f0c3eefd
SHA51215bfae6a9e18b9251254ffa645d87484090cb068a4b16eabcd0c95fbb21210d9fad3f417b9725a5c82b97ca5702c0450a27040ab24499c28e6c6c273e8398a44
-
Filesize
184B
MD589c502bd2b232fdf03c88ceace1905d1
SHA19796471e2e6bdcbfd25d313ff9afaa2dddb351d0
SHA256afd52bfd24b9c7f4617c5ffc8090b0ebb14245066d1349df120ec6a296cb3993
SHA5128eeaf77ac8f7049927c915eac8a91a910f0ec9421bf72507afcc55ed504801ed59f82f714a23fa270ddc3fb016025d71dcd149af3aa04087b313bb5106808a51
-
Filesize
2KB
MD51648a3ca59ea7d2c80528189e150ea5e
SHA19387257b32ba7da489573bf47d34b40d3ad87365
SHA25647d5f04338ea8e51e0ba5b08d9f150797aa9a96458c16bd7769daabf40d38ee3
SHA512dfe216c9a9b495ea9e7f9265e5a850948ac97ba2bcf07dd7b49207eab12fc4752f810a05998748a86cce0d150f0a24d942a6cd68749e64e7a4cbefdd44a507ca
-
Filesize
2KB
MD5ad3133e7d9193a99a67081d5a0d145c3
SHA1fc2dacddec18d6db071ffd737d5624c2bc4168e0
SHA2561ce1d9886fe0b5433da39c77c1b33dcbd12f8682b4d54680835f3e9d25f34a0f
SHA51297e62b99554901689eef53ed0a4cb759ddfea27622beac527338a594fe89f29550d663c03ae00dd2c52a2818032487d29f5542715895315b5dab2ef0a0a5b037
-
Filesize
701B
MD5c38b5ca669cef488c1c45073aa4838ca
SHA1ccccd29cedaa44dbd0b96c4c0a2bd07ea839560e
SHA2561b3c30a727f9b3dbf8d51403f75976a4bdffa82f03605afedb743c3488ce05f3
SHA512980a992c2ea9d0b21f8bbed264cf52b1076089e32666c4b0b193198f9b650c491e5adada25ae313c7b0093c84771ff1f7f2cb45e0a38e52c467b9d9997d1d09d
-
Filesize
312B
MD50c04ad1083dc5c7c45e3ee2cd344ae38
SHA1f1cf190f8ca93000e56d49732e9e827e2554c46f
SHA2566452273c017db7cbe0ffc5b109bbf3f8d3282fb91bfa3c5eabc4fb8f1fc98cb0
SHA5126c414b39bbc1f1f08446c6c6da6f6e1ceb9303bbf183ae279c872d91641ea8d67ec5e5c4e0824da3837eca73ec29fe70e92b72c09458c8ce50fa6f08791d1492
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
424B
MD560e5f5a100dbf5ee50373336e9b1b46b
SHA18d5515f16bf473ecbc9ab9d94a59ff58cc41c27b
SHA256c1a706f691351db267dcdf37d2e89c6dd01b3172e83c69964731700b66d4ae28
SHA5128140e6073f792a7c363ab81299914bc2d4238bc6047f1a25d99dd63c6215d49abefddce22b4df1b684a19d8868416d65aa91cd17dfaacf898e574033b3d4c859
-
Filesize
1KB
MD528f3c935b3429eaafe4e6f5dbbb1e282
SHA18b4c85b71f623a063efd98150aeec6f2af69ebc9
SHA2561043f19956a22880e6ac526e399cdd0e95b6310c5bb5b7b089e8fbbfaf97b294
SHA5123e3d56e01f8a0d60c035b3f35d74b39409705a6e5adec60f7f67788a2e411b1b1c7d6375882de6e98cac383a6fe98646a4ec28b73cec143c28a10b048342eee6
-
Filesize
2KB
MD5f465c18da0e029af47017407b9612507
SHA135754e0f50aeb540074a4d50cbc96fbbe95ebd17
SHA25671fea9a761fe638aa62660fe4f7f42a490fb1a9e4eecf3f2e3832de24e482c96
SHA5124425e88b660244912d607167e000cc0ee3cf3e63ca1ad2b2cc7f80ee51ff66fbabaafadc75c004596bc0e080d0da7c7e362e07166fadfcae2dfe2510c17642bc
-
Filesize
3KB
MD5f30f3fba968f1bf5ca8864867832fbe0
SHA1acb9e137f6d60757fe86dce2033c848072710568
SHA256d4619185177fec9e8f8267326de774b8ae61563e73d7686e8159a66791220660
SHA512d076375df339b792f32e3b61e745de777498655b1ff6db0e8c4314aa1e62e4489b0deeebd05e07e469732db02bcc25ed523b41b98a926a7f2212de9e5a6525d7
-
Filesize
3KB
MD58d97e46f4d36b6356516f10cec435dda
SHA153eccb2cbfa885f3339e9cb5b2dfda5b43df5011
SHA2565a1c096aa0879fd86f4a9e3a97748a347022ddb58efae8117a602132a66e15c3
SHA5129ba35d52f9f3b42d660e0b18c731105266d34d388ca11ae7f8f858e3ad4fa7e18949233da4907e2a31e6327ade24843fc89e51c50d87c4aba278639419fa2106
-
Filesize
3KB
MD5a58adedf805bfda81608a3347382f9f6
SHA16d5cbed0829ec5caf7b93297ae3230c538c789ca
SHA25654a385258b33a0889cc0968daffe207545badaa16b2f5f8ff3d85c8771b38b82
SHA5121a38a32a51a2130af4a351af35e9b69b260d14da7dc2e9e7761f772d4d4d3691fa02f8f2ab93379232a14f572c81107f26b3ba9eb3d5074076a7df1d494dd2ba
-
Filesize
6KB
MD56f50a9e8b2649f13f6ee93bba4acb751
SHA1f46443d06181f1dbda3d78f7c5957b59db765ff5
SHA25613b35f1ec3015ee7daa5d644748fad1315d825d206078bfe707ae05990819f86
SHA51250909246f4f9638c4c033e38c4326f6d77fc1a9b4ef9737adc028412433407fd619c54abc30f07f33d1e75bd5e57cd4484ce21cfab7c689271bf73d4c43603ee
-
Filesize
1KB
MD5f7ee6669da8602550c107654c4355a32
SHA149a118655cdc12db35bc2d989e00ad05b0a02672
SHA256ee3f43adb75229f3d2dcc33d9fa1765f52d35e6c793290a499175e8d61b43f81
SHA512f26514a03f81c696dbabd96249481f39d34d8e14242b1da5d78d43d4fcc1534e0ecc2b4288c82b9b38881b44bc63ebdfa022a901d63fe2f81d665945bdc97625
-
Filesize
6KB
MD54b149a3ceeedeb4941b018dc3b62b7c4
SHA12be90063d6b99f9e187b752a4607dcf4a3a47652
SHA256aee79a39e7f93db1a5914411d704af4232970d33693fa2a687f466b18d795014
SHA512ca73ae48dca20542fd25ed439b0489e960f7a1ee9ad55dc2f5652ecab83fd15ce3294acae20be7a3dad37cfd8fec3c7683c0c88cd4567b4a11c731604a38b046
-
Filesize
6KB
MD54924f1f72259547a8230e93d7a0c0e44
SHA1ee57298fe50301407a1d48144bd5d530628389e5
SHA256a2a168cff6f7909a8c17e1a922082eab297d0d3866832bac8efbcb01d6c2f13a
SHA512fe858917d439cda28564c61e5999df9101154494601b70370ec9ce1a86a112ca20e7d30839d7ae5604f4c448934316f0af53221c46bc4dc0f4b82fd37763e1b8
-
Filesize
6KB
MD5ebcb2b0c5071f77c31b98b05a1e862ba
SHA12b2d23f97a6e2d5e849bca078933a9a2f1dfdad0
SHA256308a5e74a01e49552b25e0dd15fb7c72d3fa612c3d2ad17a86f4c5be65678a34
SHA5127d1480f53b879dd01639da99d864b1b2ed6010b95fbd6dc4ccb99b4453e4b47774c80386d0990856b6a710ad89925684868e4fad0c344245a66609a34523e655
-
Filesize
7KB
MD5ea5e1735e4150632967408ea9f8a2171
SHA1667978373bf214892908daf091099667e242b3e1
SHA256be936d44f4f4f6cb466648283a44c63a102ebd34eb275874516a4b5955ab6a51
SHA512074921b367c4ec77759c1ec232a23d1eb17ac70bc14b8f0196a010fec423e55bbc5a29e8d6fb99ea5e169704e2a2a8bbe0c863cfbd79b31f6a9be5477818ff0d
-
Filesize
1KB
MD570dc481d1c517b262dc672f7b3919ac5
SHA1b6dccd25f883ea2b0a7a3aa9c0d3bc11eb96e14d
SHA2569d17b29e293491bcd422be14cbed49bc19df0dd88d47c38b6608be85b3fec1de
SHA51267dbdda3035bf461a8221bee283e938737f253a60e942aa1db2476160c6da75aba3dfe7f2ae8035568eec5a76e0d738c55b09c2f93484acd925d1d2e2ea3dd20
-
Filesize
7KB
MD56f6969c8bb303e5d25e7a6ea475a4887
SHA1157bb035a60c86eafb5af56946ef383fbfff65d9
SHA256da7f818a1c31af434c04588f982cb153bb8f79f9ccf986f6014c0b908867a4a3
SHA5128fdf772bf65c9ab99f7694de1299ef42c452b15408930a73c4d2c3361232b0b8dcf372cbd6ed63d8c0cdd9e7601dfdb20222f2a6a2b1cda05e9a0a1a4f7c72c3
-
Filesize
1KB
MD5eb43d19a5d5eb39a551ed33e55fb6d90
SHA109ca56a91e4457f3b943f1632f73bb7e40febdab
SHA2566501adb0dca49dbd448e16e527a235d77449d76225f656030fa597ee3aa64bd3
SHA5120ba19b524727d295cc5c77c3c1dbff24876883481c7ac3513a2160b9454a13733ee344d73b4918e12fd71c91dbdc2e953e544ec9f05c55bf547b58b370b28c5a
-
Filesize
1KB
MD50856a81b2d5349cc8a3b577008c1a055
SHA1f894210976712b34abea211faecc963458d3ce6a
SHA2565a8f02427a5024ad73aa97b7559da59a4818487b360fea141ef46cce693e2058
SHA512504024608c81130f30b3f86b6adec1a72e368c1cc1e578e20052aa82e8cd40d22cc0fc2b83e70cc9b5586cc3a0bc8a0f9984bb46d7a7f57b3613c5ba34d9fef3
-
Filesize
1KB
MD5a39eb965ee731a8ab692f0e6f5d0be44
SHA1cced0a47dae05eabaa5dbd9333a76bf866b8a463
SHA2569f0fadb243a2427aa361dcb5be44fdf18a6dedf165663fd1892153ec3a3a6262
SHA512387d4a6da9d701822a17d56f3522a7b6c092af8d051aad87e9d195289eadb59dcd72be84e22c826e314f686ea10f064991b8e46f0c99d6356e1aefb24e56d14f
-
Filesize
1KB
MD5199387f3af4d21a02d416946c20214d3
SHA14bd615db53df1a6334e14117a71a10366243c91b
SHA2562eb7ac069ec032233bd161ca6226ba100b012f4a1156e725b07b8ccbdfac9a5e
SHA512bdda6788117a94eecb36dde48415cb9e6e0c8d292befd9a7807d8bf511d77fd2286eb1399b8ebd3e8f80cbea0e85ba467db83e1c6992c06f324b3bdb14c0c6e0
-
Filesize
3KB
MD594f3ff48b9455994f81a4234f34a2411
SHA10d0fbc77973b39e7c0c73eea90050ccb5a457d70
SHA256a20c8642c8a5ca81c371ae8a97ae5812fbdb87a5eb8fd6a688dff7b43f449231
SHA5129da8956f6f222a2b58e38e0c53859623ca11119afeb8720baac0fce72cd3218d262ad884d25bf793342c14e44a3afc750b7e28ace38d2160dfe0ed62ea993032
-
Filesize
24KB
MD5a51464e41d75b2aa2b00ca31ea2ce7eb
SHA15b94362ac6a23c5aba706e8bfd11a5d8bab6097d
SHA25616d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f
SHA512b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff
-
Filesize
23.3MB
-
Filesize
23.3MB
-
Filesize
23.3MB
-
Filesize
23.3MB
-
Filesize
23.3MB
-
Filesize
23.3MB
-
Filesize
23.3MB
-
Filesize
23.3MB
-
Filesize
23.3MB
-
Filesize
23.3MB
-
Filesize
23.3MB
-
Filesize
18.2MB
-
Filesize
23.3MB
-
Filesize
23.3MB
-
Filesize
18.2MB
-
Filesize
23.3MB
-
Filesize
23.3MB
-
Filesize
23.3MB
-
Filesize
23.3MB
-
Filesize
23.3MB
-
Filesize
23.3MB
-
Filesize
23.3MB
-
Filesize
23.3MB
-
Filesize
23.3MB
-
Filesize
23.3MB
-
Filesize
23.3MB
-
Filesize
23.3MB
-
Filesize
23.3MB
-
Filesize
23.3MB
-
Filesize
23.3MB
-
Filesize
23.3MB
-
Filesize
23.3MB
-
Filesize
23.3MB
-
Filesize
23.3MB
-
Filesize
23.3MB
