Malware analysis AnyDesk-8-0-10-0-2024-BY-lAufer.zip Malicious activity

Add for printing

File name:	AnyDesk-8-0-10-0-2024-BY-lAufer.zip
Full analysis:	https://app.any.run/tasks/80e4873f-91a3-4cad-afae-89667d51001a
Verdict:	Malicious activity
Analysis date:	August 08, 2024, 15:11:27
OS:	Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME:	application/zip
File info:	Zip archive data, at least v1.0 to extract, compression method=store
MD5:	E2D6BEB90B4EE16CDE884B01BF590D17
SHA1:	ECC81CFFEDA95137F218267E983CF4BC49FB3160
SHA256:	F8F319208670D83A68A015B9D43D52F76EE6F372E6A837158D49FE46AF9603FF
SSDEEP:	98304:bf4bAtLvz+qHVZ+eMR4YAPkW/PvNuaiXxKCGpIPahlhYjHiKloGshfz+D+yR6daW:mnxbeqNfk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 120 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: 60 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Uses AES cipher (POWERSHELL)
  - powershell.exe (PID: 2228)
- Gets or sets the initialization vector for the symmetric algorithm (POWERSHELL)
  - powershell.exe (PID: 2228)
- Gets or sets the symmetric key that is used for encryption and decryption (POWERSHELL)
  - powershell.exe (PID: 2228)
- Dynamically loads an assembly (POWERSHELL)
  - powershell.exe (PID: 2228)
SUSPICIOUS
- Checks Windows Trust Settings
  - AnyDesk.exe (PID: 7108)
- Executing commands from a ".bat" file
  - AnyDesk.exe (PID: 7108)
  - cmd.exe (PID: 2872)
- Reads security settings of Internet Explorer
  - AnyDesk.exe (PID: 7108)
- Reads the date of Windows installation
  - AnyDesk.exe (PID: 7108)
- Application launched itself
  - cmd.exe (PID: 2872)
  - Classic.exe (PID: 3864)
  - powershell.exe (PID: 2228)
- Starts CMD.EXE for commands execution
  - cmd.exe (PID: 2872)
  - AnyDesk.exe (PID: 7108)
- Allows hiding code in an environment variable
  - cmd.exe (PID: 5908)
  - cmd.exe (PID: 5980)
  - cmd.exe (PID: 1948)
  - cmd.exe (PID: 7156)
  - cmd.exe (PID: 4296)
  - cmd.exe (PID: 2336)
  - cmd.exe (PID: 4016)
  - cmd.exe (PID: 2008)
  - cmd.exe (PID: 2204)
- Starts POWERSHELL.EXE for commands execution
  - cmd.exe (PID: 2872)
  - powershell.exe (PID: 2228)
- Executable content was dropped or overwritten
  - Classic.exe (PID: 2852)
- Cryptography encrypted command line is found
  - cmd.exe (PID: 3032)
- Uses base64 encoding (POWERSHELL)
  - powershell.exe (PID: 2228)
- Drops the executable file immediately after the start
  - Classic.exe (PID: 2852)
  - WinRAR.exe (PID: 304)
- Potential Corporate Privacy Violation
  - Classic.exe (PID: 2852)
- The process executes via Task Scheduler
  - PLUGScheduler.exe (PID: 1064)
- Process checks specific path in scheduled tasks
  - powershell.exe (PID: 5468)
- Probably obfuscated PowerShell command line is found
  - powershell.exe (PID: 2228)
INFO
- Reads the machine GUID from the registry
  - AnyDesk.exe (PID: 7108)
  - Classic.exe (PID: 2852)
- Checks proxy server information
  - AnyDesk.exe (PID: 7108)
  - Classic.exe (PID: 7076)
- Manual execution by a user
  - AnyDesk.exe (PID: 7108)
- Executable content was dropped or overwritten
  - WinRAR.exe (PID: 304)
- Reads the computer name
  - Classic.exe (PID: 3864)
  - Classic.exe (PID: 2852)
  - Classic.exe (PID: 7076)
  - TextInputHost.exe (PID: 6392)
  - AnyDesk.exe (PID: 7108)
  - PLUGScheduler.exe (PID: 1064)
- Checks supported languages
  - AnyDesk.exe (PID: 7108)
  - Classic.exe (PID: 3864)
  - TextInputHost.exe (PID: 6392)
  - PLUGScheduler.exe (PID: 1064)
  - Classic.exe (PID: 2852)
  - Classic.exe (PID: 7076)
- Reads the software policy settings
  - AnyDesk.exe (PID: 7108)
- Checks if a key exists in the options dictionary (POWERSHELL)
  - AnyDesk.exe (PID: 7108)
- Process checks whether UAC notifications are on
  - Classic.exe (PID: 3864)
- Create files in a temporary directory
  - AnyDesk.exe (PID: 7108)
- Reads Environment values
  - AnyDesk.exe (PID: 7108)
- Creates files or folders in the user directory
  - AnyDesk.exe (PID: 7108)
  - Classic.exe (PID: 3864)
- Process checks computer location settings
  - AnyDesk.exe (PID: 7108)
  - Classic.exe (PID: 2852)
  - Classic.exe (PID: 7076)
- Reads CPU info
  - Classic.exe (PID: 3864)
- Uses string split method (POWERSHELL)
  - powershell.exe (PID: 2228)
- Uses string replace method (POWERSHELL)
  - powershell.exe (PID: 2228)
- Checks current location (POWERSHELL)
  - powershell.exe (PID: 2228)
- Gets data length (POWERSHELL)
  - powershell.exe (PID: 2228)
- Creates files in the program directory
  - PLUGScheduler.exe (PID: 1064)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.zip	\|	ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion:	10
ZipBitFlag:	-
ZipCompression:	None
ZipModifyDate:	2024:08:08 14:38:54
ZipCRC:	0x00000000
ZipCompressedSize:	-
ZipUncompressedSize:	-
ZipFileName:	AnyDesk-8-0-10-0-2024-BY-lAufer/

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

262

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

304

"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\AnyDesk-8-0-10-0-2024-BY-lAufer.zip

C:\Program Files\WinRAR\WinRAR.exe

explorer.exe

User:

admin

Company:

Alexander Roshal

Integrity Level:

MEDIUM

Description:

WinRAR archiver

Exit code:

1073807364

Version:

5.91.0

Modules

Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll

1064

"C:\Program Files\RUXIM\PLUGscheduler.exe"

C:\Program Files\RUXIM\PLUGScheduler.exe

—

svchost.exe

User:

SYSTEM

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Windows Update LifeCycle Component Scheduler

Exit code:

Version:

10.0.19041.3623 (WinBuild.160101.0800)

Modules

Images
c:\program files\ruxim\plugscheduler.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll

1948

cmd /c "set __=^&rem"

C:\Windows\SysWOW64\cmd.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Windows Command Processor

Exit code:

Version:

10.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll

2008

cmd /c "set __=^&rem"

C:\Windows\SysWOW64\cmd.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Windows Command Processor

Exit code:

Version:

10.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll

2204

cmd /c "set __=^&rem"

C:\Windows\SysWOW64\cmd.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Windows Command Processor

Exit code:

Version:

10.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll

2228

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Windows PowerShell

Exit code:

1073807364

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll

2336

cmd /c "set __=^&rem"

C:\Windows\SysWOW64\cmd.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Windows Command Processor

Exit code:

Version:

10.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll

2608

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

2852

C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Windows\System32\rundll32.exe

—

svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows host process (Rundll32)

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll

2852

"C:\Users\admin\Desktop\AnyDesk-8-0-10-0-2024-BY-lAufer\AnyDesk 8.0.10.0 2024 (BY lAufer)\Data\Classic.exe" --local-service

C:\Users\admin\Desktop\AnyDesk-8-0-10-0-2024-BY-lAufer\AnyDesk 8.0.10.0 2024 (BY lAufer)\Data\Classic.exe

Classic.exe

User:

admin

Company:

AnyDesk Software GmbH

Integrity Level:

MEDIUM

Description:

AnyDesk

Exit code:

1073807364

Version:

8.0.10

Modules

Images
c:\users\admin\desktop\anydesk-8-0-10-0-2024-by-laufer\anydesk 8.0.10.0 2024 (by laufer)\data\classic.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\winmm.dll

Add for printing

Total events

28 128

Read events

28 102

Write events

Delete events

Modification events


(PID) Process:	(304) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:	write	Name:	ShellExtBMP
Value:
(PID) Process:	(304) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:	write	Name:	ShellExtIcon
Value:
(PID) Process:	(304) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	1
Value: C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:	(304) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	0
Value: C:\Users\admin\AppData\Local\Temp\AnyDesk-8-0-10-0-2024-BY-lAufer.zip
(PID) Process:	(304) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	name
Value: 120
(PID) Process:	(304) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	size
Value: 80
(PID) Process:	(304) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	type
Value: 120
(PID) Process:	(304) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	mtime
Value: 100
(PID) Process:	(7108) AnyDesk.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	ProxyBypass
Value: 1
(PID) Process:	(7108) AnyDesk.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	IntranetName
Value: 1

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
3864	Classic.exe	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms		binary
		MD5:7C625E96678EB15DF307F4186CB8003C	SHA256:A79CBE456B82FF14339DCACA43CA66E8664BB90B064A51205058403CB81EC5DF
7108	AnyDesk.exe	C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_nmejhcht.bgh.psm1		text
		MD5:D17FE0A3F47BE24A6453E9EF58C94641	SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2852	Classic.exe	C:\Users\admin\AppData\Roaming\AnyDesk\service.conf		text
		MD5:072F9D80C61F1BC912D6D0145B2E5027	SHA256:79D52BC97A54EE687229929FEF3805FF5359D09741462381B2037E157AB32A97
2228	powershell.exe	C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_t15ewq5a.5y4.ps1		text
		MD5:D17FE0A3F47BE24A6453E9EF58C94641	SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
304	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\Rar$DRa304.21515\AnyDesk-8-0-10-0-2024-BY-lAufer\AnyDesk 8.0.10.0 2024 (BY lAufer)\AnyDesk.exe		executable
		MD5:F5ECF2EB39C378971BF78F7A7A92CE8B	SHA256:4506BAAA1B8B9284E432B1396D35D6157EC10109EA0A0ADD7B4E08E7110284FA
7108	AnyDesk.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FE17BEC2A573BC9AE36869D0274FFA19_6DA81F04C5F9EAD2CD0268808FCE61E1		binary
		MD5:C67694744018B32AC849460D1FE2DF1C	SHA256:8415841FB684C9A2458CB6EFEC18E0B5275D84F4D1575712001021D0207221D5
304	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\Rar$DRa304.21515\AnyDesk-8-0-10-0-2024-BY-lAufer\AnyDesk 8.0.10.0 2024 (BY lAufer)\Data\setup.dll		text
		MD5:50666591FB42D9E912A11CAA2DED4ADD	SHA256:652A740A2B4C79E78D301A64229E3712639BBD4B9E9668E30C907F7B27D3B2CC
7108	AnyDesk.exe	C:\Users\admin\AppData\Local\Temp\setup.bat		text
		MD5:50666591FB42D9E912A11CAA2DED4ADD	SHA256:652A740A2B4C79E78D301A64229E3712639BBD4B9E9668E30C907F7B27D3B2CC
7108	AnyDesk.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\248DDD9FCF61002E219645695E3FFC98_B65931808D21CEA247CFE7AD8A5650BC		binary
		MD5:F344DEB4F1E4C912FB4436901B23490C	SHA256:C0A72E1B8E1417D63DB48EA2DBE774FA6067AF02475C2BBFCD46D2FF206C72D4
7108	AnyDesk.exe	C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_u5js521o.woa.ps1		text
		MD5:D17FE0A3F47BE24A6453E9EF58C94641	SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
5336	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D	unknown	—	—	whitelisted
—	—	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
7108	AnyDesk.exe	GET	200	52.6.97.148:80	http://ocsps.ssl.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSoEwb5tith0jIBy9frSyNGB1lsAAQUNr1J%2FzEs669qQP6ZwBbtuvxI3V8CEC5PS6JcFeO7CIfoudHuK%2F8%3D	unknown	—	—	whitelisted
6348	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
—	—	GET	200	52.6.97.148:80	http://ocsps.ssl.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQg3SSkKA74hABkhmlBtJTz8w3hlAQU%2BWC71OPVNPa49QaAJadz20ZpqJ4CEEJLalPOx2YUHCpjsaUcQQQ%3D	unknown	—	—	whitelisted
2852	Classic.exe	POST	200	18.245.86.105:80	http://api.playanext.com/httpapi	unknown	—	—	unknown
6316	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
4620	svchost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
2928	OfficeClickToRun.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
532	svchost.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
—	—	239.255.255.250:1900	—	—	—	whitelisted
2120	MoUsoCoreWorker.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
—	—	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
5336	SearchApp.exe	104.126.37.139:443	www.bing.com	Akamai International B.V.	DE	unknown
5336	SearchApp.exe	192.229.221.95:80	ocsp.digicert.com	EDGECAST	US	whitelisted
—	—	40.126.32.140:443	login.live.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	unknown
—	—	192.229.221.95:80	ocsp.digicert.com	EDGECAST	US	whitelisted
—	—	40.115.3.253:443	client.wns.windows.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	51.124.78.146 51.104.136.2	whitelisted
google.com	216.58.212.174	whitelisted
www.bing.com	104.126.37.139 104.126.37.128 104.126.37.160 104.126.37.154 104.126.37.130 104.126.37.145 104.126.37.155 104.126.37.162 104.126.37.161 104.126.37.170 104.126.37.178 104.126.37.177 104.126.37.123 104.126.37.171 104.126.37.163 104.126.37.131 104.126.37.144	whitelisted
ocsp.digicert.com	192.229.221.95	whitelisted
login.live.com	40.126.32.140 40.126.32.72 20.190.160.22 40.126.32.138 20.190.160.20 20.190.160.14 20.190.160.17 40.126.32.133	whitelisted
client.wns.windows.com	40.115.3.253	whitelisted
fd.api.iris.microsoft.com	20.74.47.205	whitelisted
th.bing.com	104.126.37.178 104.126.37.163 104.126.37.123 104.126.37.170 104.126.37.162 104.126.37.177 104.126.37.171 104.126.37.186 104.126.37.128 104.126.37.131 104.126.37.160 104.126.37.144 104.126.37.161 104.126.37.139	whitelisted
ocsps.ssl.com	52.6.97.148 100.24.223.135 34.237.184.165	whitelisted
arc.msn.com	20.223.36.55	whitelisted

Threats

PID	Process	Class	Message
2852	Classic.exe	Potential Corporate Privacy Violation	ET USER_AGENTS AnyDesk Remote Desktop Software User-Agent

Add for printing

No debug info

General Info

AnyDesk-8-0-10-0-2024-BY-lAufer.zip

E2D6BEB90B4EE16CDE884B01BF590D17

ECC81CFFEDA95137F218267E983CF4BC49FB3160

F8F319208670D83A68A015B9D43D52F76EE6F372E6A837158D49FE46AF9603FF

98304:bf4bAtLvz+qHVZ+eMR4YAPkW/PvNuaiXxKCGpIPahlhYjHiKloGshfz+D+yR6daW:mnxbeqNfk

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Uses AES cipher (POWERSHELL)

Gets or sets the initialization vector for the symmetric algorithm (POWERSHELL)

Gets or sets the symmetric key that is used for encryption and decryption (POWERSHELL)

Dynamically loads an assembly (POWERSHELL)

SUSPICIOUS

Checks Windows Trust Settings

Executing commands from a ".bat" file

Reads security settings of Internet Explorer

Reads the date of Windows installation

Application launched itself

Starts CMD.EXE for commands execution

Allows hiding code in an environment variable

Starts POWERSHELL.EXE for commands execution

Executable content was dropped or overwritten

Cryptography encrypted command line is found

Uses base64 encoding (POWERSHELL)

Drops the executable file immediately after the start

Potential Corporate Privacy Violation

The process executes via Task Scheduler

Process checks specific path in scheduled tasks

Probably obfuscated PowerShell command line is found

INFO

Reads the machine GUID from the registry

Checks proxy server information

Manual execution by a user

Executable content was dropped or overwritten

Reads the computer name

Checks supported languages

Reads the software policy settings

Checks if a key exists in the options dictionary (POWERSHELL)

Process checks whether UAC notifications are on

Create files in a temporary directory

Reads Environment values

Creates files or folders in the user directory

Process checks computer location settings

Reads CPU info

Uses string split method (POWERSHELL)

Uses string replace method (POWERSHELL)

Checks current location (POWERSHELL)

Gets data length (POWERSHELL)

Creates files in the program directory

Malware configuration

Static information

TRiD

EXIF

ZIP

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information