analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| URL: | https://download.anydesk.com/AnyDesk.exe?_ga=2.190686507.1226611674.1614943138-1869065603.1608909196 |
| Full analysis: | https://app.any.run/tasks/a75a0d96-fa33-4e64-aa57-c5bd1f911a7a |
| Verdict: | Malicious activity |
| Analysis date: | March 20, 2021 at 16:07:22 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MD5: | D2A6F9ABEEB52D61E321E8164979029D |
| SHA1: | D912F44BAF6C1D83F58B01F321630D8DB19183A7 |
| SHA256: | E12B9EF5615544498F80E7A3DE088D4ED09C903B6C40F8C43719FB82DFB84126 |
| SSDEEP: | 3:N8SEl/c3kwJEHRcVT2DXDYUTStKU6alTc5QzT:2SKlvRc52XZoKHxI |
MALICIOUS
Application was dropped or rewritten from another process
- AnyDesk.exe (PID: 2200)
- AnyDesk.exe (PID: 2480)
- AnyDesk.exe (PID: 2920)
- AnyDesk.exe (PID: 756)
- AnyDesk.exe (PID: 1456)
- AnyDesk.exe (PID: 4016)
- AnyDesk.exe (PID: 2588)
Loads dropped or rewritten executable
- SearchProtocolHost.exe (PID: 3088)
Writes to a start menu file
- AnyDesk.exe (PID: 756)
SUSPICIOUS
Drops a file with a compile date too recent
- chrome.exe (PID: 2184)
- AnyDesk.exe (PID: 756)
Drops a file that was compiled in debug mode
- chrome.exe (PID: 2184)
- AnyDesk.exe (PID: 2480)
- AnyDesk.exe (PID: 756)
- AnyDesk.exe (PID: 1456)
Executable content was dropped or overwritten
- chrome.exe (PID: 2184)
- AnyDesk.exe (PID: 2480)
- AnyDesk.exe (PID: 756)
- AnyDesk.exe (PID: 1456)
Cleans NTFS data-stream (Zone Identifier)
- AnyDesk.exe (PID: 2200)
Creates files in the user directory
- AnyDesk.exe (PID: 2200)
- AnyDesk.exe (PID: 2480)
- AnyDesk.exe (PID: 2588)
Application launched itself
- AnyDesk.exe (PID: 2200)
Starts Internet Explorer
- AnyDesk.exe (PID: 2200)
Creates a directory in Program Files
- AnyDesk.exe (PID: 756)
Creates files in the program directory
- AnyDesk.exe (PID: 756)
- AnyDesk.exe (PID: 1456)
Creates a software uninstall entry
- AnyDesk.exe (PID: 756)
- AnyDesk.exe (PID: 1456)
Changes default file association
- AnyDesk.exe (PID: 756)
Executed as Windows Service
- AnyDesk.exe (PID: 1456)
Searches for installed software
- AnyDesk.exe (PID: 1456)
- AnyDesk.exe (PID: 2588)
Creates files in the Windows directory
- AnyDesk.exe (PID: 1456)
INFO
Reads settings of System Certificates
- chrome.exe (PID: 568)
- iexplore.exe (PID: 3392)
- iexplore.exe (PID: 1544)
- iexplore.exe (PID: 2352)
- iexplore.exe (PID: 1320)
Reads the hosts file
- chrome.exe (PID: 2184)
- chrome.exe (PID: 568)
Application launched itself
- chrome.exe (PID: 2184)
- iexplore.exe (PID: 1544)
Changes internet zones settings
- iexplore.exe (PID: 1544)
Reads internet explorer settings
- iexplore.exe (PID: 3392)
- iexplore.exe (PID: 2352)
- iexplore.exe (PID: 1320)
Changes settings of System certificates
- iexplore.exe (PID: 1544)
Adds / modifies Windows certificates
- iexplore.exe (PID: 1544)
Manual execution by user
- AnyDesk.exe (PID: 4016)
- AnyDesk.exe (PID: 2588)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
62
Monitored processes
21
Malicious processes
6
Suspicious processes
2
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 568 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1044,9671496484348040644,4031006835901244959,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=15135389817254098894 --mojo-platform-channel-handle=1548 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe | ||||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
| 756 | "C:\Users\admin\Downloads\AnyDesk.exe" --install "C:\Program Files\AnyDesk" --start-with-win --create-shortcuts --create-taskbar-icon --create-desktop-icon --install-driver:mirror --update-auto --svc-conf "C:\Users\admin\AppData\Roaming\AnyDesk\service.conf" | C:\Users\admin\Downloads\AnyDesk.exe | AnyDesk.exe | ||||||||||||
User: admin Company: philandro Software GmbH Integrity Level: HIGH Description: AnyDesk Exit code: 0 Version: 6.2.3.0 Modules
| |||||||||||||||
| 1320 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1544 CREDAT:3282195 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
| 1456 | "C:\Program Files\AnyDesk\AnyDesk.exe" --service | C:\Program Files\AnyDesk\AnyDesk.exe | services.exe | ||||||||||||
User: SYSTEM Company: philandro Software GmbH Integrity Level: SYSTEM Description: AnyDesk Exit code: 0 Version: 6.2.3.0 Modules
| |||||||||||||||
| 1544 | "C:\Program Files\Internet Explorer\iexplore.exe" https://anydesk.com/order?utm_source=adwin&utm_medium=app | C:\Program Files\Internet Explorer\iexplore.exe | AnyDesk.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
| 2184 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --disk-cache-dir=null --disk-cache-size=1 --media-cache-size=1 --disable-gpu-shader-disk-cache --disable-background-networking "https://download.anydesk.com/AnyDesk.exe?_ga=2.190686507.1226611674.1614943138-1869065603.1608909196" | C:\Program Files\Google\Chrome\Application\chrome.exe | explorer.exe | ||||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 3221225547 Version: 75.0.3770.100 Modules
| |||||||||||||||
| 2200 | "C:\Users\admin\Downloads\AnyDesk.exe" | C:\Users\admin\Downloads\AnyDesk.exe | — | chrome.exe | |||||||||||
User: admin Company: philandro Software GmbH Integrity Level: MEDIUM Description: AnyDesk Exit code: 0 Version: 6.2.3.0 Modules
| |||||||||||||||
| 2300 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1044,9671496484348040644,4031006835901244959,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgACAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=865944308212431485 --mojo-platform-channel-handle=1032 --ignored=" --type=renderer " /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
| 2352 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1544 CREDAT:3478796 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
| 2480 | "C:\Users\admin\Downloads\AnyDesk.exe" --local-service | C:\Users\admin\Downloads\AnyDesk.exe | AnyDesk.exe | ||||||||||||
User: admin Company: philandro Software GmbH Integrity Level: MEDIUM Description: AnyDesk Exit code: 0 Version: 6.2.3.0 Modules
| |||||||||||||||
Total events
2 828
Read events
2 623
Write events
198
Delete events
7
Modification events
| (PID) Process: | (2184) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (2184) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 2 | |||
| (PID) Process: | (2184) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: | |||
| (PID) Process: | (2184) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: 01000000 | |||
| (PID) Process: | (2184) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 1 | |||
| (PID) Process: | (2184) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
| Operation: | write | Name: | dr |
Value: 1 | |||
| (PID) Process: | (2496) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes |
| Operation: | write | Name: | 2184-13260730057721375 |
Value: 259 | |||
| (PID) Process: | (2184) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome |
| Operation: | write | Name: | UsageStatsInSample |
Value: 0 | |||
| (PID) Process: | (2184) chrome.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96} |
| Operation: | write | Name: | usagestats |
Value: 0 | |||
| (PID) Process: | (2184) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes |
| Operation: | delete value | Name: | 3252-13245750958665039 |
Value: 0 | |||
Executable files
9
Suspicious files
51
Text files
192
Unknown types
23
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2184 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-60561DCA-888.pma | — | |
MD5:— | SHA256:— | |||
| 2184 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\LOG.old | — | |
MD5:— | SHA256:— | |||
| 2184 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\50d8811d-f8d9-4152-a745-347c79015b29.tmp | — | |
MD5:— | SHA256:— | |||
| 2184 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000048.dbtmp | — | |
MD5:— | SHA256:— | |||
| 2184 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old | text | |
MD5:D4322EEBAC92D1B8F7A6F5E39F6264B7 | SHA256:A3EEDF21B850DCC7CE5AE04395ECDD2D29DA4EA549C8A185DD9E8B552A87B8C2 | |||
| 2184 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old | text | |
MD5:C2DDBA63E4A2BD2E39A8B6C2C6384AAE | SHA256:6D5C1C78341C6F84911055D970ADDB0EC3499F8BF7FADE062122A22209CE67D9 | |||
| 2184 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RF133183.TMP | text | |
MD5:D4322EEBAC92D1B8F7A6F5E39F6264B7 | SHA256:A3EEDF21B850DCC7CE5AE04395ECDD2D29DA4EA549C8A185DD9E8B552A87B8C2 | |||
| 2184 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RF133193.TMP | text | |
MD5:C2DDBA63E4A2BD2E39A8B6C2C6384AAE | SHA256:6D5C1C78341C6F84911055D970ADDB0EC3499F8BF7FADE062122A22209CE67D9 | |||
| 2184 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 2184 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old~RF133387.TMP | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
39
DNS requests
18
Threats
3
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2480 | AnyDesk.exe | POST | 204 | 176.34.140.171:80 | http://api.playanext.com/httpapi | IE | — | — | whitelisted |
3392 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D | US | der | 471 b | whitelisted |
3392 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D | US | der | 471 b | whitelisted |
3392 | iexplore.exe | GET | 200 | 142.250.185.131:80 | http://ocsp.pki.goog/gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEECx%2Fl4bakX1AwAAAADLnko%3D | US | der | 471 b | whitelisted |
1544 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | US | der | 471 b | whitelisted |
1544 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | US | der | 471 b | whitelisted |
1544 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQQX6Z6gAidtSefNc6DC0OInqPHDQQUD4BhHIIxYdUvKOeNRji0LOHG2eICEA8aVkWYLIkXQFXHYN8Oxso%3D | US | der | 471 b | whitelisted |
3392 | iexplore.exe | GET | 200 | 142.250.185.131:80 | http://ocsp.pki.goog/gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEECx%2Fl4bakX1AwAAAADLnko%3D | US | der | 471 b | whitelisted |
1456 | AnyDesk.exe | POST | 204 | 176.34.140.171:80 | http://api.playanext.com/httpapi | IE | — | — | whitelisted |
1544 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | US | der | 471 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
568 | chrome.exe | 188.40.104.135:443 | download.anydesk.com | Hetzner Online GmbH | DE | suspicious |
568 | chrome.exe | 142.250.185.77:443 | accounts.google.com | Google Inc. | US | suspicious |
568 | chrome.exe | 142.250.186.142:443 | sb-ssl.google.com | Google Inc. | US | whitelisted |
2480 | AnyDesk.exe | 185.136.157.95:443 | boot-01.net.anydesk.com | — | DE | suspicious |
2480 | AnyDesk.exe | 138.199.36.114:80 | relay-3fe3d19a.net.anydesk.com | — | — | unknown |
568 | chrome.exe | 142.250.186.67:443 | ssl.gstatic.com | Google Inc. | US | whitelisted |
2480 | AnyDesk.exe | 176.34.140.171:80 | api.playanext.com | Amazon.com, Inc. | IE | suspicious |
3392 | iexplore.exe | 65.9.58.50:443 | anydesk.com | AT&T Services, Inc. | US | suspicious |
3392 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
3392 | iexplore.exe | 142.250.185.131:80 | ocsp.pki.goog | Google Inc. | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
download.anydesk.com |
| whitelisted |
accounts.google.com |
| shared |
sb-ssl.google.com |
| whitelisted |
boot-01.net.anydesk.com |
| whitelisted |
relay-3fe3d19a.net.anydesk.com |
| unknown |
ssl.gstatic.com |
| whitelisted |
api.playanext.com |
| whitelisted |
anydesk.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
www.googletagmanager.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Potential Corporate Privacy Violation | ET POLICY SSL/TLS Certificate Observed (AnyDesk Remote Desktop Software) |
— | — | Potential Corporate Privacy Violation | ET USER_AGENTS AnyDesk Remote Desktop Software User-Agent |
— | — | Potential Corporate Privacy Violation | ET USER_AGENTS AnyDesk Remote Desktop Software User-Agent |