Analysis
-
max time kernel
507s -
max time network
549s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
26-12-2024 16:47
Errors
General
-
Target
AnyDesk.exe
-
Size
5.3MB
-
MD5
0a269c555e15783351e02629502bf141
-
SHA1
8fefa361e9b5bce4af0090093f51bcd02892b25d
-
SHA256
fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca
-
SHA512
b1784109f01d004f2f618e91695fc4ab9e64989cdedc39941cb1a4e7fed9032e096190269f3baefa590cc98552af5824d0f447a03213e4ae07cf55214758725a
-
SSDEEP
98304:Uc9HTcGO0ImBimas54Ub5ixTStxZi/l9K0+zLVasSe4JnzMpm+Gq:UcpYGO0IOqs57bUwxG9CVaskJIYE
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops file in Windows directory 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 32 IoCs
-
Modifies Control Panel 52 IoCs
-
Modifies data under HKEY_USERS 17 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 31 IoCs
-
Suspicious use of FindShellTrayWindow 11 IoCs
-
Suspicious use of SendNotifyMessage 9 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 43 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-service2⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --backend3⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-control2⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2f01⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Pictures\My Wallpaper.jpg"1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\control.exe"C:\Windows\System32\control.exe" "C:\Windows\system32\timedate.cpl",1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Windows\system32\timedate.cpl",2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\control.exe"C:\Windows\System32\control.exe" "C:\Windows\system32\intl.cpl",,/p:"date"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Windows\system32\intl.cpl",,/p:"date"4⤵
- Checks computer location settings
- Modifies Control Panel
-
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Windows\System32\shell32.dll,Control_RunDLL C:\Windows\System32\intl.cpl1⤵
- Checks computer location settings
- Modifies Control Panel
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mctadmin.exeC:\Windows\system32\mctadmin.exe2⤵
-
-
C:\Windows\system32\lpksetup.exe"C:\Windows\system32\lpksetup.exe"2⤵
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" shell32.dll,Control_RunDLL input.dll2⤵
- Modifies Control Panel
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\lpksetup.exe"C:\Windows\system32\lpksetup.exe" -Embedding1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\lpksetup.exeC:\Windows\system32\lpksetup.exe /t2⤵
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" shell32.dll,Control_RunDLL intl.cpl,,/p:"keyboard"1⤵
- Checks computer location settings
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x02⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD51765a4f5da8bed97ed52b6ccd38dfee4
SHA1d25f54752ec5b6b2698760909438b59383b644aa
SHA256364cc307ca0bb25a9b0b3bca08e59374206023f882861281d421b4458820b3c8
SHA512aba69effd95a5b4f435d5c1f5d4b4b793a04305d5212c876b55674ec3f8270984934ac734cec11746917f7cb7e0fe8d035e2afd1e61e793358b1a7278529b181
-
Filesize
43KB
MD5c39abdf7a5d33f74eadf47d8bb56e694
SHA1adfe5d92f81e7664980b4abbb2bbdacd2f516e28
SHA2569a40597105ac74a2acb2e5761eef2f45fc499cac37d2f4e25bc96aa32e136b07
SHA512f8e59bf12403a533a62efbb5bfc365f13b34141674b2a966be34c8a60d031a51c35e2f09e44a92b3a2685cacd93579b9c0e00e3bb51384e2266895e9f95d498d
-
Filesize
2KB
MD5d35c2cec775814c6356debfc4c99e6db
SHA147e6effda544d5b59b50c97e19b3aeb905d1b642
SHA256831183439ab4d540cd5f3785fd6d6da57c1602ce1d76da9a079b36057483f558
SHA512c289a8f06ca01cf75d878d40580617f54f6fd015846212298ed65629f6409b6acc381b3ebef4c85dcfff13d1d8945ae0f70d4a8c6eb9a8eef299417f0b121cbf
-
Filesize
2KB
MD576a7c7d56108b2122fa81eb7c7e9d6b4
SHA1887bd1187420efb6b9e2ba049926fe1b67fc8691
SHA256408aa5a03440ecace0b9904209fd14807ac474503b2192a65515e525b16006f0
SHA5125b8fe4271c7ecf4a9c2b79b28d9630e07c2f768cf0f3ca422e60a40c746d96ad52383d1fd4274fcff1a4d79bcee3ae45e5f55b4a44800fbcb4de904ae62b6d05
-
Filesize
697B
MD5bc6e18059b3cab46c0f9a418bcfd3557
SHA164605cd61fc8a0f844da2e4079fc72e9b576a4da
SHA25642eb25082f105f8dfd6ec1f962593608a37ce2db091187b894feacae31a014f6
SHA512121ba48ae655f96ff6b655bb55ca2492b12508ee0c457a029851afa4ce068c1938450b857647853fc11877c0b05e6621d83b5e338de29ba363d20084c78d8374
-
Filesize
754B
MD5421cdf774e810434578b86cf42ca41e0
SHA14b4f4a268f7c4173f34dc489942575862ce2b59f
SHA256f32ba8fdd839cb2abfcd5357d5678f871db1a832272851e86c1ba0360950676e
SHA512d1f807cef231cbf424f125510794e3eba1e206a376960ae1207ffb5e2e7dc915c4dcf15c9eed8e2ede6fca8c43c54113baab717aa6d18a8ce6d7a0b9f0e9f053
-
Filesize
823B
MD5d1d659685f669a316b69f60f5ecb38ef
SHA1a8b5ca2ef7cbf0eeee45edff6299ab89f45f806a
SHA25616b4b8c2434f52ef108aba465e4cd7f6f56428ff6c7495fa43d85d2fdb04985c
SHA512fb9e0f23be333eca4dd0a32b04c3b53148423f05c6282b93dc844b2f7c9ea7f26e39de930a8557471766cc7155da27d478a3c1ac34003a3e5e73741265434bb6
-
Filesize
832B
MD5e8f92e10407276764f50b4c498550b1f
SHA1898e26f13a8c9fe7776e3f6a12b1ac4a375cafae
SHA25621027fee5878551f46cf83bcdb3b243149d37f098067390231abd9f245421c46
SHA5121c42fe17b83658e50bddf689a69a0647956a122761c1bd4ec66db3b076357e200b15743dca65bca1638f98c6860127550a6eef9be205e6d6741dc9eaa7edca9c
-
Filesize
312B
MD50c04ad1083dc5c7c45e3ee2cd344ae38
SHA1f1cf190f8ca93000e56d49732e9e827e2554c46f
SHA2566452273c017db7cbe0ffc5b109bbf3f8d3282fb91bfa3c5eabc4fb8f1fc98cb0
SHA5126c414b39bbc1f1f08446c6c6da6f6e1ceb9303bbf183ae279c872d91641ea8d67ec5e5c4e0824da3837eca73ec29fe70e92b72c09458c8ce50fa6f08791d1492
-
Filesize
468B
MD5727554f39cc52965796fcae1c6ca4490
SHA181874dc6af755dd0c72042964b0651f8b1b6bf8d
SHA256646570f6ddb2a219734ff11061332577bb31f2aa5633a8fa153b7addf09c9e54
SHA51240a44c27e3c9955c1b71e25776dae1aa195e0bced5664498b2b2ce336f6b0b12fb7493a2a62cf2290147664c389907a777b70fcee2d330eedbd06987573919ef
-
Filesize
2KB
MD586817217c0f819a693911736b1260f27
SHA152780e8bcf4c6938cea88a12b48f15e099a21479
SHA256cccbb1f6813174421e69a9ede365a84526c7ae8b5e41c8801e0ff5c1941e9162
SHA512d6e87315cf6b0584c79ac3464ef0ea2e115d767f5c92a12ca45b39c58661514b6216c5e3700419d3660821497318cddbdf67f7eff01b9e9f5e7c360894cb7684
-
Filesize
2KB
MD572bb93b46d833ba05d3d9e6bd5a182a5
SHA1dc0f1644ba6434b1cf07c64c77e6775740ec2dd1
SHA256a4d0aad13cc46066e5b9cd33a5527b264989073c6b8925f94674b2221fec2867
SHA512d30fb44c08323fcb54318cf136ec520956785d2754b96be4593c19f2b5c249df37fea1e965d5d7c931d274406025f0d555c112ba077531697e4ddf7643d35f9e
-
Filesize
1KB
MD5077407a5898e0f38ba9459fc9a73a83f
SHA133a2de0514be2280ff92bee986550fb42e508541
SHA256fc29b13c2ab45295f570372d2d603fdf236c5d27aee7fdb634217d70853e15ac
SHA512fcfe0ad6945c9fb6a97d6f03af48d3761aeac28068bed4a49c89d7c40e5419f32143b4c14891e9bad697a2ced81e8b2afd4362efd0b3236ee67324327c991098
-
Filesize
5KB
MD57f8a918e553e82f64cc925353c4f9703
SHA1df0f8210a8b2302a9e506b8babde96ff37aa9a31
SHA25693585b1fe80cf824b1e03de12b916c5cc6f7f8fe44f80c950a3a59fc83c86190
SHA5125c65669c3dc3c4d1a9b47c37242a98b0a902c22fe6a530ac5c34022da77dff5a7dc0ce679fb3a6cafc75c568bda50cccd827ae8c644b249d1f5ad9dadf0068d1
-
Filesize
6KB
MD5512f03a96f2c5a03d97d4a493a9d80c0
SHA1ab9ad2429f3012d4d3c64fb46aa4ddc6a5d7e4b9
SHA256b2c8f26ed22f88892e831e18314c25bb2930e6cb0eb900a319e1809776d63aed
SHA5125451d2853646eae9d32231e85a33b4435f4ee724e3f1fc5d8f4d6fa4644529b1eac3bd5755d6a9d9d7914618390b5581a8bb43f79f5d2462ede5eab29b431f19
-
Filesize
6KB
MD5c7cc0a5384c82a69c08186c4f01b5fb7
SHA1a0874ee7712975457e88e0c7c2dab054faa6bad2
SHA256dd16cebc25724db7be50348fc7db0d7456b3c0e0e0c6000428dd1eabc74bfc65
SHA512228f6b7424484dc2338cf165009e301800ebbc13f017f38424ec10b556df060e73f0d22930c9a79b38030b2e57c6651525899d167be8daf1de2d9bb5e9ff73f8
-
Filesize
6KB
MD5de1f4cdabc52245e8a2247cbfb904264
SHA12fb8537ade3d59f706722e268348519d60ef6566
SHA2564fdbad3b1baf255bd6bdb4155f23ddc8b4a7b68ce1b1aed18242233fd323b108
SHA512415c3057cec59000fb287491c9b62dc3aec4a8a4683070f3b1c35a6bf3b1ed6d06d46825e7123d0abcac4e35dee287f46fd0f2fa1f322a8dded26f23c20420df
-
Filesize
6KB
MD52b082ed9946f4ac3b408863e092ab55a
SHA10b1330c6f3b1251c14829e804d2e2ddbfc483842
SHA256e1846cb90e30a3c333428accae293c8a5981ba6a90c50a51e3a28a5cd3d09d39
SHA5123aab673fa402fbe68d1b1a58e18978fea931763d036a7a021bc9c00bc9ae57688621c8bc02afc4138ddf18d5db506c31dba4ef249b969ac165500aaebd0b2b64
-
Filesize
6KB
MD5a4d5730775cf94a9ec1163854359859d
SHA16e9d1671c43a31b3a5d3f568de76f3cd04f9be74
SHA2566e976503198a7e71062b6c50556c4ff63a1ef4fba9acffd9a6e3ac9de0fa1e6e
SHA5128260d821a7a43b660bd4fe579a13f216118758e7d25baec53aa6f95b4101fef407cfdc1c42294be2302bcc9783f19cbb165c329f1ca74c85bac14b5b2ad6bbca
-
Filesize
6KB
MD539a229dd3314efb6e9362971732440b1
SHA19341c2b4ae9aa179540f1e8f4c4d1c5cbb947de8
SHA256aacd0b734d22c36f27e6d8b58dad0b2ff97281915eee6d62c4cf0cd280c68285
SHA51244d91cbfc567e43ef5c1733a98e0baf5388bf9f73581c08be5d250054ba75918ca5cd5b6eabd1d60dac980a299ccd71ea015d0c3c897ff6751c21fb1e5f97ecc
-
Filesize
1KB
MD584bd97954298f005838783bb7440bc76
SHA17e35e1944a2dd64c1bea6c9888aa0421dc8e0257
SHA25675ba49bbc085687e00a6bd5a78e1300327a3a18358617f7c6a9845fabb59ad97
SHA512630d3c5036b20029c91bcaa2e07e2d64665afdcb8a42cd0fb6bde817d234630858f7f3203b189e0df256feed37ea1b6ccde733d830b4a4ede6093313f5ac5bce
-
Filesize
1KB
MD5d1e850f5d1726590c1d3f7b45ce72430
SHA1d00ff2d008b2bd6f05091a3bc3e435a9306e0f94
SHA256945c0914da3a8af84c4fca2399d0362d91cb8a91d90a19ba479b475cdb2f4b66
SHA5129cac115d6755e61fe232c52e82ef6dc824cc0939fdb6073e2c96f858977d4f7866a837ca4fb4a1745c29a6fb0073a6b8d0a98d50040676eed80c61ae4fe8d368
-
Filesize
116KB
MD57c25b3dd1b943584cd785555c7d4b3e0
SHA126270b879165e53696e4e12fadd48df49bc40cd1
SHA2564978bbdabdfc0bdea0b560ff5da2aa66264a9639698bbf9d0d5f84faa8f86e85
SHA512347f4e466473bd04d5989f995bd5f1ef5b6e5247afc01a0278df57ad0922cd039580e3b47976583b4b187e3370fdc4c2d10c69c8c39ce514a6e47ab15b5915cd
-
Filesize
385KB
MD51ce7d5a1566c8c449d0f6772a8c27900
SHA160854185f6338e1bfc7497fd41aa44c5c00d8f85
SHA25673170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264bb8ffaf
SHA5127e3411be8614170ae91db1626c452997dc6db663d79130872a124af982ee1d457cefba00abd7f5269adce3052403be31238aecc3934c7379d224cb792d519753
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
17.0MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
17.0MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
17.0MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
