Analysis
-
max time kernel
1047s -
max time network
1050s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
27-01-2025 12:49
General
-
Target
AnyDesk.exe
-
Size
5.3MB
-
MD5
0a269c555e15783351e02629502bf141
-
SHA1
8fefa361e9b5bce4af0090093f51bcd02892b25d
-
SHA256
fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca
-
SHA512
b1784109f01d004f2f618e91695fc4ab9e64989cdedc39941cb1a4e7fed9032e096190269f3baefa590cc98552af5824d0f447a03213e4ae07cf55214758725a
-
SSDEEP
98304:Uc9HTcGO0ImBimas54Ub5ixTStxZi/l9K0+zLVasSe4JnzMpm+Gq:UcpYGO0IOqs57bUwxG9CVaskJIYE
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 8 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 7 IoCs
-
Suspicious use of FindShellTrayWindow 9 IoCs
-
Suspicious use of SendNotifyMessage 9 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-service2⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --backend3⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-control2⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x54c1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5aeaa5132fbe4bf477536557353a585f4
SHA124299c29a5778a88d6d418450def75c2dad0e076
SHA2560071a70c79d0945bf32263676e94cf7dcd6cfa8294292ee454c7ba09c9ab5bb5
SHA5122b2788cab6d5291aaf9c37567ed7e5943c72083733949b7f288deaec18bb8b79cacd9e573fe507b40b60dcc2d14d01b3db1d53412633d213c188615f5f8a59b8
-
Filesize
8KB
MD560e34ffd7f24669592a4fed4cc155efc
SHA1faeb44128606a21dd40b9e59b61c44e3d4a20b2b
SHA2564c79812ad73f153f336594d04627bed7dbd5398d6055f2e169d8921e13305549
SHA51204a65ff6b7b63b747c715ce011564a4e7f45d3c16a97afb5f0dad890e0c95aa6d0f712e76b05e26a7c974119b8d6cb240b6d411d7f85119025234ae97bc869b2
-
Filesize
57KB
MD57352a4d4b31357cd6b56b5f24bb7bcda
SHA15419a707787c32816e0d7de229d2172a8a978a38
SHA256b1c6d581883753961b9b09353dda91627ee6ad81dba1699e3bdfd958182d399c
SHA512f8fd50396a193ea062810a335477e0074dbcdc776ebea470a8921ac82477c8633b11f45eea865efd8609befd3ecf477633b392a09f60612905abb597c527c70e
-
Filesize
2KB
MD5dffa2d80e38a6f7664a3f29e3c67f0c2
SHA1e5ea3f5410d055ee76e6883f0ba59f1cadca6697
SHA256787c46cb7163a23c7c4e489cb63afaf3603dc0fb1d1ae4546949978421011ac7
SHA5129c74abf89e21cd5bef1431cc44aca24fe4dcac3cb2b3c2e7dc62bcd11af220354e1a7fb26970ac9d2132c4ea6259d053be4cbb20535b5c2ce99001434bce04c0
-
Filesize
2KB
MD575a47e2ff32205c9f90d87717b739990
SHA1fac7bc8e37aa673b456056a40acd7f59bf6144ae
SHA256693c8bcab3b24972f98abe7b30a6af0b800f39a790a1d12bc90cfc481b26414d
SHA512d7eac7a22a73b46fea4c17b0c63c75f6e83b747de2679d6bbb0cd62a5693452b47b9cc20e0d843089ef7d7e03287968bdfcfd9f3f69f36a301b36bea8053a37a
-
Filesize
745B
MD557e85a8eea9e4b50d005d4db2fecce40
SHA143d0ae1e027be1b7eccacec1e1db502949f9eeda
SHA256f622294af8aeb19f82738b2ffa82cc79eb85ec63db5b2d7f4e3bcc3334a49810
SHA512076a46d0360196a042297f85024a8399549e8f97e4dae5a68736b0b73032e44cc12c797f498b97c0508c738db1b1e772e2aaca074444302d2e65646f294a134c
-
Filesize
766B
MD5d7fe6d10574a13c3be28121fce9cea6f
SHA1491a6bb17c86c0b44336a15bbb7834066a98ba5a
SHA2566ce39c76c07fafe91833ec5e54519bf72fca923a4c82114b24ea4ed0769e96ac
SHA512b009c470943f6332a4d2f6c774d33f0237a97b68fe7148fe81918e2a349c5d5117de5f6204104f86ecdc79a5f9c52dffcea04d56d96d052794a5bdeb7dd5d8a5
-
Filesize
775B
MD5b3c573347845d06e736c80deab6b8532
SHA16edc2c8f9bfd7a488044e9455ea8406b76e5e9ad
SHA256e2909a5533e8d150625a06a24b9f6cdb1e2fd85b7f86cd49b112365caf34d3a7
SHA5128663990f0d75149e1ce419022bf04c6cc464a081a6aa9c5de3f2a9ba687c46a9c1fe1df9aeb773ca943f72d4d261cf4a930f27a675686127eb47bbe958aaf1ea
-
Filesize
832B
MD5126696c39344a928e8cf439e3238cb22
SHA128f6d4c6d74e324581aa3b4bf54925e186c8b661
SHA256c6c726110d1212030c40916470aa61685cf4eae918439fc62d39509699080cc2
SHA5121378349023b150f6a037aeb985253493cb7ed887fe401a328e47f1e334f0a312cb6ba6a9b76429ea6c20e184b475ce4055076f89449ed84cd7af5e4b5fe1e345
-
Filesize
312B
MD50c04ad1083dc5c7c45e3ee2cd344ae38
SHA1f1cf190f8ca93000e56d49732e9e827e2554c46f
SHA2566452273c017db7cbe0ffc5b109bbf3f8d3282fb91bfa3c5eabc4fb8f1fc98cb0
SHA5126c414b39bbc1f1f08446c6c6da6f6e1ceb9303bbf183ae279c872d91641ea8d67ec5e5c4e0824da3837eca73ec29fe70e92b72c09458c8ce50fa6f08791d1492
-
Filesize
468B
MD5cbf670693e9fcbe0cf16d5dbb040b003
SHA1d92d78bbb7ea43f05775ac4ef7e4614d4f3dcd86
SHA2565610a6dd9994208ed173f97a18feb39ed07ee4a039560d768abe82f03ac54a59
SHA5126979025f3d2bd5f516b7f657f7b4a259b40f0cfab4e78cac2a29a571048311fe4a702f785aeb751040432adc3d3d4e6f85c24dbc1b44f953ea7060f2b24f2e44
-
Filesize
22KB
MD55ed649129616b1920242d15daae96f20
SHA144d1bce9d4f5e2598e82616d2adfee3ec72ca26e
SHA25680c8c576ffdf29da2e24c63d31e6c5f33ae4c883da0948e69cfaa04472719ba9
SHA51208288e79df96535ab778b65cc5599512d280438335bed9dc5e369236f46ec91d648ba22c803090a5291d5def0704a377f52abd37a5b09555cc666706f1cf7cbf
-
Filesize
1KB
MD582e26281da21e51ea8d4af7d2798a277
SHA1d6ba37103265558c5a5f8aeeacb25bd495533b13
SHA256370685fe5a6343297e86bc95cee43e3371b9084ef550c0e19fc19f4865475d24
SHA512ebaf5b7959b363abad396e07c42607d2d43e72798c628ffa6bdddc028a134a91ca836095b441f4e8c307170f7def6dd6b9046114c73435ef2e4c950c8fc01109
-
Filesize
2KB
MD5bf2adb4ac6a9e616595c18ceb09fe22d
SHA1cc9add4a5fb6323aa1e0b4e5eafdbe9f41b712a4
SHA256dc54c47ddeee684499771ff793af2b8b80d57fe75c80b798cd6c5c343cd97948
SHA512f79f832efceca0cd75a4a651b14687e9d095fcc259ce6a91055d68ec49e4db823933ca9a3f540fc27dbcf28abe992a5c9792c6ec1e6047c5e50a0ef979187c28
-
Filesize
5KB
MD5ca13e0f6cdea84688792d8e3d8ecb281
SHA102acc0350498cddd7611a41d62088da242032b36
SHA256a26256296cef4291400c60c05279623063caaa9ff34b43847e3d586ece72734f
SHA512086ab25f8006f02b38f6151f13c5e0c1c18d0bfe3be79d5f029ebeb2ea35a0e379ebd9260852f68dcdcd18f34a89c3fcc53ce0db56bad78b1b4bc65f8dd13adf
-
Filesize
1KB
MD545d2097b8c7006f14a29634ed5f1425d
SHA10043e96750224882d87d6bab119357eecb4fba8f
SHA256aaca410d5dbe7e20ca4f32842579444a44b2a23418d81fdf60ab2e88a2440e7b
SHA512fefb9351d3f4a8b927436d1165fb4f5f2d014ba83ce9fd7caccb8252751b678a8e8239b78acf7896f435b020c603aa86f0f2e309b6b45e11dedda8ce11e9d3c5
-
Filesize
5KB
MD591141d759eeb66aca7822164fb5e7377
SHA1554ba9f26af9e30d410373ad5c9b637024bbd2c3
SHA256f160feabfd2179cef8b59674050aaafdc601b900af4e91cad2a809971ec238a0
SHA5121200a8d77c69207935215f28870e330b2ccc9ceb41d1310e76533c25b29a4c0c1dd1eeb279bf658ba62986e9b441293ea2b18c63be86ec515b28c8f9ba1b2cfe
-
Filesize
5KB
MD54c8cd27d40ae3c0b4b625bfefca80d79
SHA1209d6cc32afab1711047103f770d32cb0c719af8
SHA256185e142b3bf74684b683fcfb160834bd13d17c1030642cf293a4bd24bc69663b
SHA512657445731614cbf0eb1aaba37d3bd14f5172e2e354b1a51675e723c81b73df3308ed32bfa904a8936fa50824f08381f4d462a15965e37d7c0140598ef5e9b4ce
-
Filesize
5KB
MD5f58e1c438fb857ed76cc91548060860b
SHA15f31678fc6d0981fa82616ab7da75d56071c0f2d
SHA256d8b2725482c45e8bee5cc57c0efd8fed6b9c96a8659234d06cf5e36d7f6c37ad
SHA512506bb6f1522dd6082ff0e4cd0f4ff8e2f12efa46ebbaef4dfb6964ccfb97a3229ab8a7b2bc1bbb8da1f5d6407ea01d42a820fb963b4742b1736f47cd65148f33
-
Filesize
5KB
MD57d6d5f95a0bf6fba6183abb6b87294b7
SHA1e79ecb9cf6147c8a71661afb227f247ea562972b
SHA25678e6e55da5acc9bbe5cd28de4c096901928a82e895bd51200c6ec2c5bbb7134b
SHA5124263b565db631154abe2a6df3e230e272140609ded5a065a61ca64bbe213c14d6fddbf7799479bee33d309f83eeabd89d43bcd04be87636e25edb8cb52d600a5
-
Filesize
6KB
MD54b5c957a38f1a10a6b74960571669126
SHA127bd3e1945aa41be03af2ecd018c0156f0c3d996
SHA2566450eeb9db897c446aa68d74f03564dd1de8d25bdf67ce6864095bddc21f4234
SHA512007bf5b9329b1a4ce73fed579ea446e33ccdffd027d6a46845c1e1ed21b4270508325f706a174c47e39a6a73cd02977a09da3e03fd08269cd81df9a944bb87fe
-
Filesize
6KB
MD596f1d3f0c02eeb187fef214af903cd55
SHA1146b44944f16b6363dd43dbc259717334487dc8e
SHA256bf05cd7016ddabc4cf01ec3c977d0725d17773975c89871713c7f94f00d74333
SHA512c88c66fc3d3f1f9c995dac9d7becee51707d234198054269e0c414c3f2332a2205452442398f5dcbdb4377eb0d18b07cf1c64ac51d71014f83d9d85acf88a045
-
Filesize
6KB
MD54582a4d13ff970dae3d24f3af231f638
SHA1d0314084b598ea0e2722760e3b1e9fd38ee5f282
SHA25601e46cb2cfb4c0c0c5adbf9c6eb77079bf2605fbb38fb552e8110511fe5c273f
SHA512bb86b24e0effcfee6d3c87b819603643bcbbd4df18cb3787f4d3bc6a92d4137ca8704f3fc88ff0c65ecc42a7569f6629df541b1a95d097c64e7fabb8180f854d
-
Filesize
6KB
MD51acf8a0cbb1477520a9f71f4a1053846
SHA1378a7af72f17a348a0decfc702c7290f8ce11efa
SHA2560e8ac239cb1be23c7aa9572fd4cf521d6c083cdd6385bd8edee59bcd8b7a23f1
SHA5120a5fefa8c71224c19d7def3e7b8427f2244c0f9a23d6390951e38878d55f335a923b2df206c9cae49f6f73f91095296f7afd5d42c491c435efa4a30bf385b14f
-
Filesize
5KB
MD5562582d3d6a784f2ea61c116140e6b59
SHA183116bbbf7c37f57d5ecf50ba88ff021783d9601
SHA2568e86fc63aab0c1eb32ab4ac3d35b13dc4c0be94d2c2015800f8b0a3b7a9b6f55
SHA512bef6cc71aa4b43e2a4cc0fefb75962cbbcf4365cb6903262c5c944e713e339e11d71245158279a0498bf5f5cbea39d1af255b118a023d820ff9ad3f725a44a2e
-
Filesize
6KB
MD5061aff460428fa7e6422afd7a0e84097
SHA15b6b9cd13ea5eaccf7468afa49d74b6455118cea
SHA25653bafd1df54f1c27e19f03de679dc33042cdfa5093ff5ef32687ab99a016ca6b
SHA5124161e3fcaf5da50d2c8605b5edabd08d470f01a1c78694dc747f30f1ad75a2b3a9c4ef80b354b0f69a545aeb4db23d2fc0bf368e0b471c38dbca490e96c61785
-
Filesize
6KB
MD514c6aecefba8c9a8e292048c91a87e48
SHA1ced4ae8a6803e8d52b7e1fa0a0d69344f8f6eb25
SHA256e704444b2a82971de7e8cec086d8f39b0c1878c0ba70149ad7dbff452ae121d7
SHA51224f73dfad63b44028838057e96f7d49117b8afd8282bfcd6de9f536b75a7e27d5f00fdfd31cd9b98aea68c16b7deb7ccaedcc3ada91123583784295708d579d4
-
Filesize
5KB
MD55a139a62e6a1807f5e527379f6f94290
SHA15b08e7f1e00842df34ce21619d7f003d6a83f919
SHA2561ceb5b5c3b0bf2d89c7b8ac89eb936fa92a4e3deb312a60776c4753656e1d872
SHA51254a6dee14e3dbed7f70156df327bb49c142d12e926af941ee1b61256bf3d46b71ef119f95c3b2aab9b6dff750ec2a283df0678a9816babc4d0d25a95f2814153
-
Filesize
1KB
MD5b732dd0d912a29c62b558e6eeebe0291
SHA142a84455fb3920686af20e46a278c6ded8f16c7d
SHA256a02e165a62ec814d7ec36928d4aa97b1d5e53e2c1c8d7116b108749cbe906695
SHA512ac2a0afe8b96a34c3375dd68a725bb7c3ef0d3a3215e3b0f9d0323bcbb625855b540fa7094ea897a997e9f02b612ba10b04cffe951a5b0c3df533a271b587905
-
Filesize
3KB
MD55e6b4fad37fa72bebd9af91e9dbb8bfc
SHA17866a6280619175061840e2a15f8d8e8103b5fed
SHA2567ed63cf4e28f4387093c5935dc2e42641e7e9fb48605f1bdd063098c3a0485e7
SHA5120d29874f168a77821b412f4e39b8bbefa3fc902ff7f3f56c578a8f4f6d717a6e558a901b2b5395c35593fd34f0f55a6e7fd03b6eb6202a7db55854dc558f55de
-
Filesize
5KB
MD568838b3cf9becd785076e0738ea2b72b
SHA1ddf56f6dcc069e18b3519a890df41434dad21b3d
SHA2563c23d703b82445c05bf08836c450e42855f754b475bbb36110349bf5e1c4b434
SHA512df8df85e75b1e8a99651fd88a0b568badc9c91950f41c88ddafb43de913f58e86d48ec3cf2a62657147886722a1bb14296d9f6b94c544aaaddb7a7e500757407
-
Filesize
5KB
MD5051577c544891301e25ca20c712dd68c
SHA130658181db39f4a51e1b64df5b59c29e9f769463
SHA256bb28cd70f6b77f23965e3d2afc68dfbdd9c89d64aea7be1c3f93128ee690065c
SHA512907c0061984ab64ab18094b997ae5f5e8ff4001d53fc81e68556bdcbab74df311a860e40b0866790983a7515d962252db6f72968316769b369870c667e4da586
-
Filesize
3KB
MD5203cac83c70ab853cbfb758721b323ba
SHA1c63cbb501c10f4801eab35f74cce1fbf1de8c3c9
SHA256144bb63e8094fbd0514d98bc133472fa83aea607fefcd28f2a90ecd45ee64737
SHA512c303fe68ac1662717181daeb4d54de95f902777f8a0b4847980434fb7319a63e22dd3a757d28d7f78407f7cbc0b8680db28e646e38518763b38bc842d4182ca3
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
17.0MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
17.0MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
