24d8d240f8c0e47d02004f24d02c159feffb0bdd8457c4440644576b89551500

Analysis

max time kernel
20s
max time network
26s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 16:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Anydesk.exe
Size 17.4MB
Sample260826-tw3y9sgk21
SHA256 24d8d240f8c0e47d02004f24d02c159feffb0bdd8457c4440644576b89551500
MD5 b30a13d71db0c8cc5cd5f135e926cb57
SHA1 b055416b75186278619e60b2b0dd665b5ce14ce6
SHA512 e3ea93402f934b80a77d4bf478f7232fa2cd38fbe30923d14e9e45e0846c85ca1777432c0eadb1ed6534a324839000ef23ab5c1fa10a5dbff391494d30a0a377
SSDEEP 393216:HCTfw24KUPkFu7UQCIreE8RglmjI61kItEYy4K4tLepvLPyUH:HZWeYI6a+Ew3ov/H
TLSH
T1FF07D016E37800E8D4AAC2B8C7465157D771744A13B0ABEF1690AEE12F37EE51E7B702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion

Malware Config

Signatures

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Anydesk.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Anydesk.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1396	timeout.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Anydesk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Anydesk.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3360	Anydesk.exe
3360	Anydesk.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3360 wrote to memory of 2520	3360	Anydesk.exe	89
PID 2520 wrote to memory of 1396	2520	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\Anydesk.exe
"C:\Users\Admin\AppData\Local\Temp\Anydesk.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Windows\system32\cmd.exe
  /c timeout /t 2 /nobreak >nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\Anydesk.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads