Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
27/01/2025, 12:46
General
-
Target
AnyDesk.exe
-
Size
5.3MB
-
MD5
0a269c555e15783351e02629502bf141
-
SHA1
8fefa361e9b5bce4af0090093f51bcd02892b25d
-
SHA256
fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca
-
SHA512
b1784109f01d004f2f618e91695fc4ab9e64989cdedc39941cb1a4e7fed9032e096190269f3baefa590cc98552af5824d0f447a03213e4ae07cf55214758725a
-
SSDEEP
98304:Uc9HTcGO0ImBimas54Ub5ixTStxZi/l9K0+zLVasSe4JnzMpm+Gq:UcpYGO0IOqs57bUwxG9CVaskJIYE
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of FindShellTrayWindow 6 IoCs
-
Suspicious use of SendNotifyMessage 6 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-service2⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-control2⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5681⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD5bc1fb7121f43aa520e19ba67f2a0b26b
SHA1bd8ad38a68d53e762296eb393e2ddaceb75f9d3b
SHA256f729883e3a3f7d101235f0a178f6cd641f65170b1b48c2cd19925fa3d4cfe3aa
SHA512647a2b2be15ff61e50bb7ac2aea54aaf40383c44bb0b24489e08632b4900ace41a4b323bfc1d987b685c359e13c4ac24ca3765c71fc5a43fbdd1ecf264f1a3df
-
Filesize
2KB
MD59f21a0233d13599e924430eb50f7bc60
SHA18687610c1452090b3bcdceb69d7134e0b502ea6e
SHA256471d5268906cc061171df223bfe69b203f966fd757850c91e3a9c4a304ce77ee
SHA512b3735e3dcb5a477a841ddf6ec5f389f797e358ef8526607dcb55c9ac8721f4406c55aa25025fb6077d36b37e6bc06e06813e55ca12bba8fb7f46fa8c07354462
-
Filesize
2KB
MD5a634b119f059af2f7efb44bdc640b8ea
SHA10b8afee987ac15f62e2746b00d6407bd5961a244
SHA2561f3b3171f55394cdc396d2b0389d6bc43a224545c2399b1b7971a478844e11f4
SHA51236ba34e7f84c79b984f40fddbb23096bd69df0c995ef4c3dede6d6fa1c5da34fb1aa741f53286bf28dcd56e5fc961bee4aff083cfdf17d776829c8caa8b54dc1
-
Filesize
765B
MD580a543b63cddd68ce0b27113a9e9b0d4
SHA101d8fac60f57cc816c616fca3ce854a3b3efd326
SHA256adc24c1f39393c050b0a253147ad30a9aafc6684307dd335efa8cfcb292de5e6
SHA51218222e77a4d465176b7951804b26ca7c2407cf63b71fa3d6ed7153453be167fb1e865de4c00ce1eeaccdb9c937f69785a665c7f3106258c64ad6ff2494f78419
-
Filesize
774B
MD5a2bbcea5c209f8a5686d0f897d70e6da
SHA1f4149062d35048ab2b2446d486e8d2e480880cb1
SHA2565ae7f5c18d2d05ad72526dd8257a81e7d4faeee25a84425bb3c7adc9e07b0768
SHA512f2e2d7b041397f2134d8503a8bc5b3e7db67adcec70ffeabc16c5da882ffa3eefabade514a88b4e959a5ee4ec13ebb571a62ebdfe5f6d4fb88c0656de739495f
-
Filesize
831B
MD51d6364b2ef2060b9335820ec0dc708d2
SHA1b6324819193f363376bc78a5f6bb4f0429dfa57a
SHA256e086739bc24c10bc9a65ec8f92bcbec8ee5d61a4846cc2e26b4dfea25977aed6
SHA5122e7bc40911b2dfa80bd6e79f1f97bcfcda30d775228e2e6cab60f5b3a5cdac8ccabb98b5de7c2fe6ab2543e7e8015e852d57cc0cfb66678b8c6872fa830a6b33
-
Filesize
312B
MD50c04ad1083dc5c7c45e3ee2cd344ae38
SHA1f1cf190f8ca93000e56d49732e9e827e2554c46f
SHA2566452273c017db7cbe0ffc5b109bbf3f8d3282fb91bfa3c5eabc4fb8f1fc98cb0
SHA5126c414b39bbc1f1f08446c6c6da6f6e1ceb9303bbf183ae279c872d91641ea8d67ec5e5c4e0824da3837eca73ec29fe70e92b72c09458c8ce50fa6f08791d1492
-
Filesize
468B
MD5d0b6eecacbc67b91896bd2829f66d945
SHA17dbab6c8000f869ca5d8149bf2fe40a7082bb392
SHA2562ad71d18dfa124652eef87331b0386496489071f27a57ff935558f1d5db29c35
SHA512aa74dddf4fbdc60cf1bd70bd5c2b1d1c548324eb1bf083829d1e31ba7ecc5d7d1d4749f37eefa9a618198a1c6ab7ce770b06844873ec1b7a586171d88eedfc43
-
Filesize
1KB
MD536aa6111b59ccd56bcd7da837e205e85
SHA18ccda2c534f6adf46cb34c797ea3d8218b5cae9d
SHA256a884a280948d5878380f03f0e7c9e11982b0af9e747e4c26215d4b370b376819
SHA512a3970b31b95329662bacda625c1bc874864614798933787c0c9771dc3637caceb1e70d359f75e31975b8126d6a7caa0279f856bbbe0682827d1501f87888d3fe
-
Filesize
2KB
MD5695b0183ebdc0ba487e8f5edb1167fa7
SHA1aa35373dc7aa1580c86d2eee5b9ab9ee5e5d84a1
SHA25688899a404f80bab3ce3b9befa87c4ca571daf461b892322df8650cfbc2450687
SHA5123f2c44e710a3bd981299d9be79267fee43059521eac7608b5ab96b193be9a775ef5dbc5cdc4e54ea96f111a9f00611b392c6f262abec3901962ceb9251b4cada
-
Filesize
5KB
MD59b65bec3c0649c4b56f12744658aa7bf
SHA196d5f12ab70f6df2e8f762710cec458a87b331a0
SHA256af80a796dc069712642b538d79f7ecc0e58b196bc83b8e456468072da7709da7
SHA5123aa35aeb32d315d27096452309873f7fcb81a19ac53e7c4b1b5a2342138f75e1b262016217f89f7482bdaf2c0df6ccd089a1ce8ae207edab6feca0b18de42902
-
Filesize
5KB
MD5d891596f800687d5f34b4ba9a414b37f
SHA180d42438303d28ceffa2cbfa6370b60ba215c65e
SHA25663072ca50d126c6f4e3833e66e15cea514c97429e98ae159feaf12793a4f1968
SHA512ea58b77badbef993ac4841da77f19da7352a3feb8d98ff53a1322778a3cba7ddd695c6231c590b83748bb2c3de875fea7d5f774379972b0ccf27ca32841798bc
-
Filesize
5KB
MD511a64019024c9fe962842f43b7b810c0
SHA1499d8b7a902e3ee0080c4ce32e7f8411cc49b464
SHA25686a924d25e8bb55f7c242e0fcf796647505697b028346dd5d28733df6e11b0e2
SHA5127673cc858143e0ffdaca951e163cf51639a91396b56ca7e09d491b0197675f71a9238200c6e842480f39a2c0352d4da48854010177735daf5a73e9daa8b4101b
-
Filesize
1KB
MD5c4a0ed1ce63ae54ed3ac8a63f99d7ad0
SHA15834abf87f639a510eb00b0cc54033286f34413b
SHA256176298a5c7eca07ab8408081e5de35f3300f2ae05d0515992779cbbb67348433
SHA5121f6b4af4af54527428197033d0dedcd22c53aa6e22aa1f6a9f73e3a4446648df44c308f76a1aa03e6cbf269078472cad77fc14bbfc897f1a440a63b629dd5003
-
Filesize
6KB
MD57db0030eca0487c01e9edba2b9bd2d83
SHA157845b0931d3aafc1c7ada5b12c335a3d863aeb9
SHA256cbdecb1ead293c3f951def3a801224a74b415f1f94edffe5c93c2c364c9ce86d
SHA512ebf3a911270078b9ca7381a795509ab92cf9432473d2cefdc252da897fd523449e6b3fabe62bf5e9af693ebb7f41324bad85f8ca791fb14d3f58fe912cd2ea41
-
Filesize
6KB
MD5b40e9445657e8a05204e29d8c710d645
SHA1aa62d86f6c6df1210bd3f96b094f481b06961828
SHA2561d521eb8f4b020ebd76921f488e3a8438cee656adcb14da648f4c909a1ab6e42
SHA512d44305a6bcb6aaf4dae4656d7e118ba0021bab47e70aebf15d65df3e479ecb1173094a3e1ccf43036dd4fc69b53e268c20dc546a0a332a7217568f47fc7eeffe
-
Filesize
6KB
MD56bcbfa39bfbf1812a2668f3991de5149
SHA1d4cd254b365603a76eaccb328126910c4c6edfee
SHA2563a6e90d61b339add3fd47e588c2c81ff75f9ea4da2ca024ab6bbee693b09ee99
SHA512abfd7605a3608ea0aff0ba2f466b5d0a1805d6e62a47d92731016503f457cc2f7772146bf2aeba6e138e997576f1a75bee08c7e998553421d561e58712d4b020
-
Filesize
6KB
MD5f3803a0fe091d84d172b9644558ae4e1
SHA1c9bb0954cb04cd8ce9b133ac8dcc6a2279067783
SHA256bdc59369d2051358a834c2061d338d8bb70762aa21d12e9ddbf8a517cad45f0c
SHA512b2a531fa67dc73ce34075b006ccf1791a51f81326b672d04c59245dfc535126d17a16924e23585daeeb209a671afe80a2096965cfb14b9aeaec2a33a1ebc1b58
-
Filesize
6KB
MD585594f3d4c549c451083c23f0d4b52dc
SHA160e5044084ad4d0e5264321c8e9fca39741fa2d2
SHA2568d75afbef04faccd6c759d776d27f7c66547eef902532c1c72c448ee5f262906
SHA512b37e855a20fba1614fe909817bdfc5f40b311da9240a3332b86f971c2d82862f2dcf81b925d9f6059e363a4d01f623c930abc03a6e4f28ce86239d43db5e01e2
-
Filesize
1KB
MD5bcb0bf4108bb994507c19bfea728c739
SHA1d1dca3d8fc9bf22a7973f3c732357d435ce931c0
SHA25635e94e882c179aa3285fa357cce1b9c2e9a54f34953fdf6a9a9cfde143e837cc
SHA51272928f4b28d5598819191c08f4d0b58e849183a4dd00b196c989b5716576454fd5c21cb99e023878a51d3a2bbb514c5592fb1c9c8dcd662ab5940d864e0f539b
-
Filesize
1KB
MD5ede59bcb90ae495a690e265919216bb1
SHA1d139212a1f4206dae7b14135f4c9b9ec523b5a86
SHA256a6c2ecbb7c18f201199423b17854ad2c20786f904487b66548a185f9b31bdb3e
SHA512ecd40bd1e8186c77a8710a02b06d410a9aef003025384fa6a5fb91ed61dec93e0927eddeb2d9a774ff4296f862afab082063aecc90eaa31c8f2cc344a2da734b
-
Filesize
1KB
MD57e2b1c5bdd88fd62c6f69a1a5f80ed67
SHA18a11ec3a1a6dcac447cf8ad91d140947906f14a0
SHA2564862e5eef71103a14c4e153b6e725a9bf94b4ade486e904a4bdeeac95e122ac3
SHA512460272023cacd75f6c486bd74eedfb70ffa3b9ab1286177543b0fff9333c00872003220425f03cfb71fa324b980d7d8202f5bf01763858ea681d227291b7dea5
-
Filesize
3KB
MD52101eb07fc55778b06ded9dba6c425c3
SHA15c8c3b821101701ff76d5db6bbdb59e3be2c800b
SHA256a2893702873dc88c93cefe6f9407bdd193ab34d979f104ec9236adf323dffafe
SHA512cd4b8bb816c94e7b77091d91b9c153fbfdcc3b1440fce3aab83a151922bad691b7d17a20380b47945a41ee011b6e2cee392261312200b070fbd0568ee33093f3
-
Filesize
5KB
MD54cd5709b566e92efe6953f7377ec4772
SHA1e58f4fba2ab0ead57fa6091c4f618d2bc4017a0a
SHA256262c4427f6631e0d9a36dbd1122e6f5b3f9a105cffa1d74667abe0779748cb35
SHA512cfc88a153662c10e358aec30aaacb558955de1955a3ff972afd57a3ee1d8030c711751d2eadecd887737d30c529a81a176584be0676b08786410c1a0c9f5aa8f
-
Filesize
3KB
MD5f0999c9a0e2b566f6651bf34e0471fe6
SHA12dc484f3bc9c45bd6c34b1ccee481ca2bc270fef
SHA2567b8f65225c87d08ab94a156391e4f557c44f39094bab4423b381dbd66fd7df1d
SHA51260400f76411832b7db25ed69fdbe949805f76fc3649b6b3e5c60d51dcb80bcd7fb0706665fee72aa87faf7abfc018ece1bc4186f700429cc712d99ac64403af1
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
17.0MB
-
Filesize
17.0MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
22.3MB