Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
27-01-2025 11:23
General
-
Target
AnyDesk.exe
-
Size
5.3MB
-
MD5
0a269c555e15783351e02629502bf141
-
SHA1
8fefa361e9b5bce4af0090093f51bcd02892b25d
-
SHA256
fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca
-
SHA512
b1784109f01d004f2f618e91695fc4ab9e64989cdedc39941cb1a4e7fed9032e096190269f3baefa590cc98552af5824d0f447a03213e4ae07cf55214758725a
-
SSDEEP
98304:Uc9HTcGO0ImBimas54Ub5ixTStxZi/l9K0+zLVasSe4JnzMpm+Gq:UcpYGO0IOqs57bUwxG9CVaskJIYE
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 8 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 7 IoCs
-
Suspicious use of FindShellTrayWindow 9 IoCs
-
Suspicious use of SendNotifyMessage 9 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-service2⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --backend3⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-control2⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4dc1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5fc4237eae759e8d09cfe5cda4a8c033a
SHA182e6a6162282a380177d468e4d4cc52f05e63d3e
SHA256dd17f796f36c9a0413ac5eea61b07795eee642a4e27e334e24d06eb1343266b9
SHA5123fb0c3e2689175a3d094c0883da348eada7bcd2e36bcc8e9e1d328bc1c4c9963fc302b2295b2da6148b20aea06f14df0f8dbd269a5f568b618792450c270992b
-
Filesize
9KB
MD505d8a66b3db60fe16ba04b56650e8f15
SHA1814342b65e9e1ef3639450ac13cf484ec20cb7ba
SHA2562d892a1783128204d6f35baa1632f0005fcc4158d3706ee000dc2fe2cb46d5e4
SHA51263b239b89e4b462a8e50b14ca73bab9e747f8a871b646fcaa6cfe4b55cd50988dddf195f983101f57f0cd8112135a1f6191c1b4bf90544373455fbae575497d1
-
Filesize
61KB
MD5d3328d631d079bd8f906522b5b7627f5
SHA1542a2b1ad1586d00fd9ca6d5a142a73739e92de6
SHA256bf73e20f233a2944f46bea84ad99fd9fa4439c6d0f0958747fdd453fac280b69
SHA5129e381011ee6452c4da494b53ef5227b097c2bf4edf9ad26e8f284f3c415f310d308c9a154e58a3a5323a162e0ba13183e3c6c9a07828c0ecbad1a2229c23615e
-
Filesize
2KB
MD505a24357ed14be535c870cd264306b38
SHA1c6b9d91e39982f1209742db373a1835466e28b92
SHA25685ae4a3111d7294b1c44a51745b426c519572aedcd1772e31f5feafd578b14a8
SHA5126d0a172075a0709f25d5559219965d078b1e4f5a2b67b1ac0cb62891455d8cbec9a3f0b7d618da25d47717536060258b363440cca009efdba11ff26d4de61682
-
Filesize
2KB
MD5a5c3c4df81852af3505cb36162a71a32
SHA11fdd604090a41da82c6e7b90dc7ae87f0b9fbf88
SHA256f0c5dd41bd752db42d73902be0e6187862d5664f171a04872268345264f501ba
SHA51272f7d5ababd0665e6db4a19f26e17173f69a8305750609e6433ffa77aae71c6a1909c18cf27323ca7b7f0174f649b63697a6fd9a3e7b617e123939881a62542d
-
Filesize
766B
MD576479ca61b7c3690b236ea1872e2cb65
SHA15e1af33b610445aa8321b62b9bf4ea7a31838417
SHA25681b485cfcdd4ffc6a20b42c9afa60b4d71ffd404ada6b5589cc64707696b31d7
SHA512335d2fca60ab97085f22c6111f803bc77368ee7a8621d02bf812233eefb4dd054bca62938e36a28565e0402560c878e3afb9bed1ae642a0f31b73c5a9ecbec02
-
Filesize
775B
MD5c60eb9de1446eed888fa4d57038e9ddb
SHA1fd1f513fff893ff70cc77a65f68f8436666ca9fc
SHA256e94bfed4481342c73776b29c5199315e266a08687d86cdda893ac551062e1992
SHA512f53db49dc6f48ef425adc3dbc396e74d82dcf09f2b3d83f8c1d2f676d6ccfccecb3197f20a372919e8bce1487f39e27d4493f76f9780b692f8d353227cfbea61
-
Filesize
832B
MD527378dfb6decaac8034daf88b22154b5
SHA1561fbbf5424c568ad8051ceb332c0e37f04485ba
SHA2560e18d8629bd1970e54bc34c61eb1bd30c27f56ab7fd6ef2ca1fb714b4cecc158
SHA512f7fc8af4baf863cb2205e154c42f8b3ce4d0b28f4870126ce71c4b0143df07c97c56a69642ddc95a9ab84d5f0214fe0aaffb1b4058385106013ee92b04d77b29
-
Filesize
312B
MD50c04ad1083dc5c7c45e3ee2cd344ae38
SHA1f1cf190f8ca93000e56d49732e9e827e2554c46f
SHA2566452273c017db7cbe0ffc5b109bbf3f8d3282fb91bfa3c5eabc4fb8f1fc98cb0
SHA5126c414b39bbc1f1f08446c6c6da6f6e1ceb9303bbf183ae279c872d91641ea8d67ec5e5c4e0824da3837eca73ec29fe70e92b72c09458c8ce50fa6f08791d1492
-
Filesize
468B
MD54b8363685ba13be69dadaad754c51e35
SHA120401b4eec2574d1222e76df52c8df6502cc9ff4
SHA256675605eebc467bb1caf2541f6d5f61b94f1d4cf66e400a0e97eb1eb8d89ec60c
SHA51277fa971da81e2cfa177ab2722fa5a88ec69241cc52724824228e411e21e94c9e5efbea5f318f5ede47034fdc09479a772f35837a5ffd071aa667ebb0fad09d08
-
Filesize
468B
MD53cd1a726340fa0295e8632330792307f
SHA1ecd5d6ded77ec7e1e08344da9f4d433e42db5247
SHA2568418de60025b82bb8c00dff141dd5c8401b288efbb3b383a78fb5b9478fd22b3
SHA5124100366123a8396d95a62fdcee7b86cb37cdf000bdc2d45648a315d52fe64f403e9fb16dd1ad082474b642f66c533de8e69f5feb9ffc29e5cd247ccca3849e53
-
Filesize
2KB
MD52381304c83b0a86191964ddac8eedb14
SHA128650a8b28a7f97d2d0d07c4c05b39b910d12be2
SHA256a35e20b2c997fdc5440c9095bd93105f21c8387ebdfd468d0a4bcdfb65f40e82
SHA512e357c3aff5e1c6cc0faf33858a0e876a610809f4545b1e7f83adc3cc01b1d67815bbae8991ff68c01279716efaa77641cd230c8a2c66b56e624edf39394af7a1
-
Filesize
2KB
MD5307e6975b5dbaeccce9c9b0161da1954
SHA1312d4657d0c6296a09e653ba673aee0f8344a909
SHA256dbf44000523c140892d714847b66f46f0462eaae2a19722e9225e6eac8120eeb
SHA5120203adde48d68c2b1f2d0cc1f8294a2868001bbae0f43a4b2a8151dae121c3ab3819ed83365a86b3d539ae5d2ac944485721cf92d554d3f1fba01624c55ce1da
-
Filesize
2KB
MD5465dffa00b1684be5065944546cba1f9
SHA11e58d5ca439204b75614543f2484ee4b135ccc54
SHA256f09023a1eaa78cf64c8e19f55fceb87fb7b412c96580958a64a979c1711210d9
SHA512087d4d89f69af3e172c126a3c1c2a4740938d4d0a6f35e78f59997a70a93bc29237827e4e3315208a9dabf7175620a1c47436d0815b332ef242bb70faaa4c044
-
Filesize
6KB
MD529672991005812930d8526acdd5c505e
SHA13e5f04ef0f241d2993d889f47a30c140d2ff5d2f
SHA25698c3aabb5bcbeffb845f78b8cafc34e0bd9283384545ff14ec0808ad97d70e01
SHA512c1b29d7efb4e92cb2bf0b390c72fa9bbd571a68fab8c3e0becffb3ff732cb694582a76e87eb53798505f9157493d2af1ce6683a1a750fa1da0665fa27ad3c991
-
Filesize
5KB
MD53fd36af52029454abb9d221ef2abcc4c
SHA122e80ef4810afe9db8f481cfc3de20bede083465
SHA2566e0a8047aefd2adf80fa2b8c6d0b8aea287d3e5714b07b374be5e7ea73cef747
SHA512af91eaabab73347167ee03ce11a71c9533db04628289f64ac9a30f42764b37ae02ef0079b3dede752e43ff593f0e153cb264bdb9e2ed4d7535207b07a48c3923
-
Filesize
5KB
MD5370809386abf007d7ee0984c9473dc64
SHA157eb8c7f510d802bd09831f1b5f037056396a338
SHA2564a13557e8f17f542b3b9c6bb8e2698363d62e3bc1c887aa9b612b4a9ca3f7b96
SHA512a7663015f5bf6c1d7d32fdfb5ad97f0ecb7f8fd25c0cfb41992f4098bc076149ed1ae61c3ce443ca97bbb700abf0beda8c8fe4a0882d07b43ac5ac16bd402b9f
-
Filesize
5KB
MD5546819d3ba283b9a4434058da51e4401
SHA16eee2ec9b7ba08b9319715b00eb6a082822fe8ff
SHA256f92d747075773b5ebd0d5721ca97e557d04638eb4a4e2ceb0d3c025ebebbcb31
SHA5121a98335d39dfb47428b3361c93d50cb7d5f17fa1036a7c8730e31edcf095eedf46a5183d283dfd3a181ddd72631ebf12da50168ee4dbe8555057af15ff7044ce
-
Filesize
6KB
MD5704b95a5a551167f09f55a5da730cae4
SHA1b27b8b0febe75ec231c325981332a7fef3b1d131
SHA256230512d8168dd154c4cc6e8c86a2367a71196d3f343ee49ec38a544925a802ec
SHA5125e4ec7f9a48b8c9d41a820a00814a6f5f4ae4521cdc7a76d12709b1071195b7899a8cfe8e8ff9ca664d883b039563ca41872c7bfcb3df41e10dfadb86539fdf8
-
Filesize
6KB
MD515fa5155b1566a22fee9a6ad28e6b7b3
SHA1e7fdfffe894ea1ebd7c5c934094fb329c144a7ca
SHA256182b7e71f39d8f156e30a7292f7334188d178a30896ff471d8501ceb064924f3
SHA512ca5d03dbc24f2519c2397bc1c70e4f9932628c2c312897311f8290bde214cb6d14428c2009d96edba1ef54108502ab717520c41092353537ca6c99e8feb13a0c
-
Filesize
6KB
MD52ea8f8175da48a40a0ad924b3e3a7ccb
SHA1877f985388a4406bd7fe31b0d02379589df8a6ac
SHA256b4bf963edec4402e5bb72863ec9a82119847c8f9d36d264356256e8f42b2f6fc
SHA5128bd1e280e2e8e53fb4308a75025455d6f6cb9c1de2918dcad105562ed3dca34ff78ea58c98b692f9e37f01bd95de89523113ea6a2df88b917b3208d18f53be0b
-
Filesize
6KB
MD5bc4b12cbf9177d97d2e5b5e96d0cc466
SHA1789aa69b41fd85067826366264965141b680bb9e
SHA2563b066cd6e4e51ba5042043c2dd1885532379199785b22b14aa803ff8cf9eafe6
SHA51291fdf66bd3e38444fd192ad5b1388d561438580252d3706908b203ad4a836a22130931b83553b3550d4f10ebf4cff0e99c06f9ba47097b35609b9a1fadee0617
-
Filesize
1KB
MD58a896fe6b44cddc1fe389404c6773e3d
SHA12bec73f8d60c0545680ae81f3f938502b95cdad3
SHA25602374d32a44dec7a75bb79930ac3f7a0f03da14e35371acbde4436cca87a7f4d
SHA5126ba429ced3f17c6571a145a6957b35e3bd08a703815d12bd19c50b076329f955a842c6c52f6cceaea43481edfbdec0fb454f8f4a82ccd9e78d2de2e835d626d1
-
Filesize
6KB
MD5f2a24be46292fdc6050bc421578a98c4
SHA1da3243e25e2ad4e56c15135b4145f57960b58d03
SHA2565566f0a0aea8ae1ab175fadf0f9c274a5456410b9b00ee2079dae452e78010f7
SHA5126c2606ae518c3bbc6b240fb0a0163bf579a212d3c0ecb53626f6395e04a0b4d0d0c9de982d42310fe463ed2e6a4a3774bbc4160debde87fab33935044f28e577
-
Filesize
6KB
MD568c9779d6660a5443c7fab3cfefab3b9
SHA1e955b7fb70d5faa474b4c8b93040f51bd40415f8
SHA25617f70b0b7361ee74e73cc35944c9f36f436929be57ca2b741884299db7383f54
SHA5128244b63c3e9e634b086ef099bb384097247fa6d99dd6cd565e3543705ab7c1f22c06b4a9e5dc4e1445c47ba3101f8e7c5d1f45806ed6143ea544dcacc81b47d0
-
Filesize
6KB
MD5323b0108a02eac71cb0b71cf0e09ac95
SHA126a0bfb2992ed73a71863825fa25bc6d249e4df0
SHA256b1181b1e8e130de74f7df97a3eda69293c3ba83a13187424ae869ce8367006ba
SHA51258f5c0e9c5a51f34218dc077b873b2d8c73cd685826895805b2bba04b0a01ccd0312f81f72313ee39781fd38ed466300b0407918150fe3fa8607fa74db642e60
-
Filesize
6KB
MD5563ad4ff000750be5913b8aa0f7f2380
SHA112914d14ab6aa367d691ced89a94a1c8633ec8b2
SHA2564c8cdc4629220eeafd89cbefc767bec6208f290aad314188945ba3aac101ae3f
SHA512d190253e41e3d58705b256fbc1cc90749dcc1cba0ccf51c2c99dfdae5d913cb6648c45c37145f45798bc296a6e25733d3fb0d3ff7777a8961d2de0a647a02280
-
Filesize
5KB
MD5b6fcab2bda93277a3b5d3304446f8b03
SHA13f87eb81321976c2cf0ed1e96589e8f1b061dc78
SHA256b394101a9c68fdc8a461f9c03de15d4081bdfba26f0cf18b7763f5646726b618
SHA512d818112e5e36184a59bac00d5f85a42ff436bb3cd892afe19010f33628f186bf63a43704add093508e77c3b60867722ce6c59198d4ee13d7eaec3fd299f0b472
-
Filesize
6KB
MD5019e451952cfc64e11b03ec498e6a955
SHA1a86b09b0c020517235e29b8871441a6606550439
SHA256294604b3f3168dbe3b0fe5659d15de9a02b9a6bc617315c7315cec837151b929
SHA512025d6ab0c828b91c4ad11955a409b8af5d5a107354501c41d7c89f94dcd1b3e751150f2a72c9f1037dfc38a2d452b0dc78256b4a9b22a04b65250ba51edb1f0a
-
Filesize
6KB
MD5b95acc007d521c82a7c0dd2385ead9ec
SHA1f0b5e707d0e08c4f02007879a0ea259efcf7d54f
SHA2567a4ebef548abb0e1cdee3e5f0a756dff604f19520b411c0507ceb2b585dc3d88
SHA5125e9fb44ec75a9b719e73ccaeb9c916fbf80451a56f83e62220b3544fb670d617908af40a211d9ebbe9a45fa8bc6420accefdf628562f23c06b103636c21f2b2c
-
Filesize
6KB
MD54e97de1c90b9e046ce5b1201a4e828ae
SHA18047a75eb0924c3dc76959da252680e5281a83ca
SHA256ef21e6ee42e361bb104d5a86ab3bb5a4a382d4aa165ea2fd9256c4cc5718ddbf
SHA512fec60121a0104d10bfea52a9324de89bd8a68636850beaf0e7ead561024c13c18fb48b9fa7d42ecf013e2f9c90514e49141f5a380e9ec0d6cda502fcd1a52df6
-
Filesize
6KB
MD5ff948fd3f79d2312d4f056d5e2ac5aee
SHA137e9f0f7b5bad2f5eebda24516121c660d9f3530
SHA25678fea95c5c21e8b30db5ea423f61eb84209fd454a71380b50f73c7b8aa18ec6b
SHA512cc0a44ac1b8b8dc4a0787f1013f3a2d9b64aa0b471b4b51bd94d82c6d9e84491a182340179e5ac5ce2f3d076dae9dbf3dfb856c549e57979f30e979c97c281ac
-
Filesize
1KB
MD508e0dd557fcbae87e673222823cbac8b
SHA1df71d35f4bc2075f64dd5dd23284d7ebce5ac5d9
SHA2561c0141821af4e0cb69f36dde18b08428c9bd5667fd10cb14fb51d27cb3b81540
SHA512dc06c2aff6406b8a087a970aca5ce252ca03a4e43f359e1afbe92aba8f904ee969bbe86f4c74cc460cb26dc0f1696e064c571fd9a925bdbd0f556f20fb872f2f
-
Filesize
1KB
MD5a6a840f10954be9ffb838e81eb64320f
SHA15d97dd85ccf31ca61ec9cd8265dcfd26df2bd131
SHA2561397c5cfd3d70c48898fd4931357bc2f6804146cb280038928f5cf4ca55f400d
SHA5123d33862979b710da38452e3fac9c8d8fe19f8e85cce11bff1f14c0857e30f0d9503308214d17b95704952fd52df58e45c237fa9a1dd882500356fa7452c5395b
-
Filesize
3KB
MD555d8eb81c6a92a2d5926a5b0f2051ad6
SHA1e4eefae4100a6e097192b34a930997f17240d6fa
SHA256bbd8c0c45586a236e52f7cf840949ad4bb2c560fbd5189f444ff2bcb7dc39436
SHA512c6833d9f301309c34ed88825134090359f764e8f65bf25866b175779e84f57b03041fa86a934313d78a3c8905adbaceaad25b0a8fb676ec5b1c9162dfaa1fd88
-
Filesize
5KB
MD510f6e93c90532516845112379dfbe0d1
SHA1e70f21de8c096c5d34eae9feffdd9c7bcad31b98
SHA2560aa86a60bee1d2650de2bbf8fcd451dac22645dbd1f44ef1aeb26d1f51c4e4f8
SHA5128ce376fa5f6f103039dd82b0764a1e6a5473a50f5abfdda4005dfde7da157d4a64fc81f592ddb1f406f26103af78893668ae9cbaf982882c32254c924f1fa445
-
Filesize
3KB
MD5eb5457b6fd3780d64c2abac2b2367994
SHA1f3c0205e6ab719577e2d90bc01e381a4dd027910
SHA256a0cf75adbd6abcc6c81f150df825f3cf5c1cecf2030452e332bd60d2a8902407
SHA5125fb24e112a5a3a1693775a4ea77c6e38f5f7215699fdd79f2379e0433c77056170cb2edde951b3c8a567a057e3c22e89521b2f9c85faf67e2fa83d304837b9ef
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
17.0MB
-
Filesize
22.3MB
-
Filesize
17.0MB
-
Filesize
22.3MB