File name:

AnyDesk (3).exe

Full analysis: https://app.any.run/tasks/040a98b0-86d0-4e1b-ba1d-fff665154c88
Verdict: Malicious activity
Analysis date: June 24, 2024, 13:51:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

A21768190F3B9FEAE33AAEF660CB7A83

SHA1:

24780657328783EF50AE0964B23288E68841A421

SHA256:

55E4CE3FE726043070ECD7DE5A74B2459EA8BED19EF2A36CE7884B2AB0863047

SSDEEP:

98304:77G2MoEslkjwWvZNy87N6IWwZ/wszMRAx8SvePTqWeYaPPYZOkL67enf5Lglp4mK:xaPWzKc818XE58BZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • AnyDesk (3).exe (PID: 3432)
      • AnyDesk (3).exe (PID: 3208)
      • AnyDesk (3).exe (PID: 2864)
      • AnyDesk.exe (PID: 3364)
      • AnyDesk.exe (PID: 3884)

    • Create files in the Startup directory

      • AnyDesk (3).exe (PID: 2864)

    • Actions looks like stealing of personal data

      • AnyDesk.exe (PID: 3884)

  • SUSPICIOUS

    • Application launched itself

      • AnyDesk (3).exe (PID: 3432)

    • Reads the Internet Settings

      • AnyDesk (3).exe (PID: 3432)
      • AnyDesk (3).exe (PID: 3196)
      • AnyDesk.exe (PID: 936)

    • Reads security settings of Internet Explorer

      • AnyDesk (3).exe (PID: 3432)

    • Executable content was dropped or overwritten

      • AnyDesk (3).exe (PID: 3208)
      • AnyDesk (3).exe (PID: 2864)
      • AnyDesk.exe (PID: 3364)
      • AnyDesk.exe (PID: 3884)

    • Creates a software uninstall entry

      • AnyDesk (3).exe (PID: 2864)
      • AnyDesk.exe (PID: 3364)

    • Searches for installed software

      • AnyDesk (3).exe (PID: 3196)
      • AnyDesk.exe (PID: 3364)
      • AnyDesk.exe (PID: 3884)
      • AnyDesk.exe (PID: 936)

    • Executes as Windows Service

      • AnyDesk.exe (PID: 3364)

    • Creates file in the systems drive root

      • AnyDesk.exe (PID: 3884)

    • Potential Corporate Privacy Violation

      • AnyDesk.exe (PID: 3364)

    • Connects to unusual port

      • AnyDesk.exe (PID: 3364)

  • INFO

    • Reads the computer name

      • AnyDesk (3).exe (PID: 3432)
      • AnyDesk (3).exe (PID: 3208)
      • AnyDesk (3).exe (PID: 3196)
      • AnyDesk (3).exe (PID: 2864)
      • AnyDesk.exe (PID: 3364)
      • AnyDesk.exe (PID: 936)
      • AnyDesk.exe (PID: 3884)
      • NLBrute 1.2 x64 & VPN - KeyGen.exe (PID: 1280)

    • Reads the machine GUID from the registry

      • AnyDesk (3).exe (PID: 3432)
      • AnyDesk (3).exe (PID: 3208)
      • AnyDesk (3).exe (PID: 2864)
      • AnyDesk (3).exe (PID: 3196)
      • AnyDesk.exe (PID: 3364)
      • AnyDesk.exe (PID: 3884)
      • NLBrute 1.2 x64 & VPN - KeyGen.exe (PID: 1280)

    • Checks supported languages

      • AnyDesk (3).exe (PID: 3432)
      • AnyDesk (3).exe (PID: 3208)
      • AnyDesk (3).exe (PID: 2864)
      • AnyDesk (3).exe (PID: 3196)
      • AnyDesk.exe (PID: 3364)
      • AnyDesk.exe (PID: 936)
      • AnyDesk.exe (PID: 3884)
      • NLBrute 1.2 x64 & VPN - KeyGen.exe (PID: 1280)

    • Process checks whether UAC notifications are on

      • AnyDesk (3).exe (PID: 3432)

    • Creates files or folders in the user directory

      • AnyDesk (3).exe (PID: 3432)

    • Reads CPU info

      • AnyDesk (3).exe (PID: 3432)
      • AnyDesk.exe (PID: 3884)

    • Creates files in the program directory

      • AnyDesk (3).exe (PID: 2864)
      • AnyDesk.exe (PID: 3364)

    • Manual execution by a user

      • AnyDesk.exe (PID: 936)
      • AnyDesk.exe (PID: 3884)
      • notepad.exe (PID: 972)
      • NLBrute 1.2 x64 & VPN - KeyGen.exe (PID: 1280)

    • Process checks computer location settings

      • AnyDesk.exe (PID: 936)
      • AnyDesk.exe (PID: 3364)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:01:27 18:04:37+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 10752
InitializedDataSize: 5185024
UninitializedDataSize: 19132416
EntryPoint: 0x3653
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 8.0.8.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Unknown (0)
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: AnyDesk Software GmbH
FileDescription: AnyDesk
FileVersion: 8.0.8
ProductName: AnyDesk
ProductVersion: 8
LegalCopyright: (C) 2022 AnyDesk Software GmbH
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
57
Monitored processes
9
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start anydesk (3).exe no specs anydesk (3).exe no specs anydesk (3).exe anydesk (3).exe anydesk.exe anydesk.exe no specs anydesk.exe nlbrute 1.2 x64 & vpn - keygen.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
936"C:\Program Files\AnyDesk\AnyDesk.exe" --controlC:\Program Files\AnyDesk\AnyDesk.exe—explorer.exe
User:
admin
Company:
AnyDesk Software GmbH
Integrity Level:
MEDIUM
Description:
AnyDesk
Version:
8.0.8
Modules
Images
c:\program files\anydesk\anydesk.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
972"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\aa.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1280"C:\Users\admin\Desktop\NLBrute 1.2 x64 & VPN - KeyGen.exe" C:\Users\admin\Desktop\NLBrute 1.2 x64 & VPN - KeyGen.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\nlbrute 1.2 x64 & vpn - keygen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
2864"C:\Users\admin\AppData\Local\Temp\AnyDesk (3).exe" --install "C:\Program Files\AnyDesk" --start-with-win --create-shortcuts --create-taskbar-icon --create-desktop-icon --install-driver:mirror --update-main --svc-conf "C:\Users\admin\AppData\Roaming\AnyDesk\service.conf" --sys-conf "C:\Users\admin\AppData\Roaming\AnyDesk\system.conf" C:\Users\admin\AppData\Local\Temp\AnyDesk (3).exe
AnyDesk (3).exe
User:
admin
Company:
AnyDesk Software GmbH
Integrity Level:
HIGH
Description:
AnyDesk
Exit code:
0
Version:
8.0.8
Modules
Images
c:\users\admin\appdata\local\temp\anydesk (3).exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3196"C:\Users\admin\AppData\Local\Temp\AnyDesk (3).exe" --local-controlC:\Users\admin\AppData\Local\Temp\AnyDesk (3).exe—AnyDesk (3).exe
User:
admin
Company:
AnyDesk Software GmbH
Integrity Level:
MEDIUM
Description:
AnyDesk
Exit code:
0
Version:
8.0.8
Modules
Images
c:\users\admin\appdata\local\temp\anydesk (3).exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3208"C:\Users\admin\AppData\Local\Temp\AnyDesk (3).exe" --local-serviceC:\Users\admin\AppData\Local\Temp\AnyDesk (3).exe
AnyDesk (3).exe
User:
admin
Company:
AnyDesk Software GmbH
Integrity Level:
MEDIUM
Description:
AnyDesk
Exit code:
1
Version:
8.0.8
Modules
Images
c:\users\admin\appdata\local\temp\anydesk (3).exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3364"C:\Program Files\AnyDesk\AnyDesk.exe" --serviceC:\Program Files\AnyDesk\AnyDesk.exe
services.exe
User:
SYSTEM
Company:
AnyDesk Software GmbH
Integrity Level:
SYSTEM
Description:
AnyDesk
Version:
8.0.8
Modules
Images
c:\program files\anydesk\anydesk.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3432"C:\Users\admin\AppData\Local\Temp\AnyDesk (3).exe" C:\Users\admin\AppData\Local\Temp\AnyDesk (3).exe—explorer.exe
User:
admin
Company:
AnyDesk Software GmbH
Integrity Level:
MEDIUM
Description:
AnyDesk
Exit code:
0
Version:
8.0.8
Modules
Images
c:\users\admin\appdata\local\temp\anydesk (3).exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3884"C:\Program Files\AnyDesk\AnyDesk.exe" --new-installC:\Program Files\AnyDesk\AnyDesk.exe
explorer.exe
User:
admin
Company:
AnyDesk Software GmbH
Integrity Level:
MEDIUM
Description:
AnyDesk
Version:
8.0.8
Modules
Images
c:\program files\anydesk\anydesk.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
9 923
Read events
9 887
Write events
34
Delete events
2

Modification events

(PID) Process:(3432) AnyDesk (3).exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3432) AnyDesk (3).exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3432) AnyDesk (3).exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3432) AnyDesk (3).exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2864) AnyDesk (3).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AnyDesk
Operation:writeName:DisplayIcon
Value:
"C:\Program Files\AnyDesk\AnyDesk.exe"
(PID) Process:(2864) AnyDesk (3).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AnyDesk
Operation:writeName:DisplayName
Value:
AnyDesk
(PID) Process:(2864) AnyDesk (3).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AnyDesk
Operation:writeName:DisplayVersion
Value:
ad 8.0.8
(PID) Process:(2864) AnyDesk (3).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AnyDesk
Operation:writeName:EstimatedSize
Value:
2048
(PID) Process:(2864) AnyDesk (3).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AnyDesk
Operation:writeName:HelpLink
Value:
https://help.anydesk.com/
(PID) Process:(2864) AnyDesk (3).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AnyDesk
Operation:writeName:InstallLocation
Value:
"C:\Program Files\AnyDesk"
Executable files
5
Suspicious files
18
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
3432AnyDesk (3).exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-msbinary
MD5:4EE46ED51789EEB44AA015F8BFF4E131
SHA256:CE35B3D464745B533817FCF3D508A737CE5237BC9A4924A35F7405D5D7216450
3432AnyDesk (3).exeC:\Users\admin\AppData\Roaming\AnyDesk\user.conftext
MD5:A787C308BD30D6D844E711D7579BE552
SHA256:8A395011A6A877D3BDD53CC8688EF146160DAB9D42140EB4A70716AD4293A440
3208AnyDesk (3).exeC:\Users\admin\AppData\Local\Temp\gcapi.dllexecutable
MD5:1CE7D5A1566C8C449D0F6772A8C27900
SHA256:73170761D6776C0DEBACFBBC61B6988CB8270A20174BF5C049768A264BB8FFAF
2864AnyDesk (3).exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AnyDesk.lnklnk
MD5:A1ADE3873E4CCB1EDEE59FAE17049F8E
SHA256:CEAC0FDA950CA60844ACA8259023D826DBB5D2ED30BCC2824B070629B1F10F49
3208AnyDesk (3).exeC:\Users\admin\AppData\Roaming\AnyDesk\system.conftext
MD5:0C04AD1083DC5C7C45E3EE2CD344AE38
SHA256:6452273C017DB7CBE0FFC5B109BBF3F8D3282FB91BFA3C5EABC4FB8F1FC98CB0
2864AnyDesk (3).exeC:\ProgramData\AnyDesk\service.conftext
MD5:5935EAE51545AFE6522E99543F547F30
SHA256:53FCA5524AECA9051BFD9212987D729546A944C4EA1A5A5AA31E42B3B850E634
3208AnyDesk (3).exeC:\Users\admin\AppData\Roaming\AnyDesk\service.conftext
MD5:CC1EFBA27B95FE210CFC6E8202EB0192
SHA256:44AD18F31FC75EA4E6D6BB8DC89CEDF21FD040C2240B058B01576A42381FD2C0
3432AnyDesk (3).exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6AN9C6UR9IFLTVD5V1SJ.tempbinary
MD5:4EE46ED51789EEB44AA015F8BFF4E131
SHA256:CE35B3D464745B533817FCF3D508A737CE5237BC9A4924A35F7405D5D7216450
2864AnyDesk (3).exeC:\ProgramData\AnyDesk\system.conftext
MD5:06B5BC84CC1347880D790F4BD8561BF3
SHA256:2B6B2286E78532412BBEBA7FC24B2641457B0C155AB2966532CA538425446AC2
2864AnyDesk (3).exeC:\Program Files\AnyDesk\AnyDesk.exeexecutable
MD5:A21768190F3B9FEAE33AAEF660CB7A83
SHA256:55E4CE3FE726043070ECD7DE5A74B2459EA8BED19EF2A36CE7884B2AB0863047
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
57
DNS requests
10
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3364
AnyDesk.exe
POST
200
18.245.86.84:80
http://api.playanext.com/httpapi
unknown
—
—
unknown
1372
svchost.exe
GET
—
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
1060
svchost.exe
GET
304
23.50.131.216:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?67a3611ec3c0260d
unknown
—
—
unknown
1372
svchost.exe
GET
304
2.16.10.176:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?33775f6043c93e33
unknown
—
—
unknown
1372
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1372
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
239.255.255.250:3702
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
1060
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3208
AnyDesk (3).exe
57.129.37.157:443
boot.net.anydesk.com
—
FR
unknown
3208
AnyDesk (3).exe
51.178.65.229:443
relay-07ea9365.net.anydesk.com
OVH SAS
FR
unknown
3364
AnyDesk.exe
51.178.65.229:443
relay-07ea9365.net.anydesk.com
OVH SAS
FR
unknown
1372
svchost.exe
2.16.10.176:80
ctldl.windowsupdate.com
Akamai International B.V.
AT
unknown
1372
svchost.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
boot.net.anydesk.com
  • 57.129.37.157
unknown
relay-07ea9365.net.anydesk.com
  • 51.178.65.229
unknown
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
ctldl.windowsupdate.com
  • 2.16.10.176
  • 2.16.10.179
  • 23.50.131.216
  • 23.50.131.203
  • 23.50.131.199
  • 23.50.131.196
  • 23.50.131.209
  • 23.50.131.202
  • 23.50.131.208
  • 23.50.131.205
  • 23.50.131.221
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
relay-c9990d24.net.anydesk.com
  • 208.115.231.190
unknown
relay-daa16496.net.anydesk.com
  • 51.178.65.231
unknown
api.playanext.com
  • 18.245.86.105
  • 18.245.86.79
  • 18.245.86.26
  • 18.245.86.84
whitelisted

Threats

PID
Process
Class
Message
3364
AnyDesk.exe
Potential Corporate Privacy Violation
ET USER_AGENTS AnyDesk Remote Desktop Software User-Agent
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
AnyDesk (3).exe