Malware analysis AnyDesk-8-0-10-0-2024-BY-lAufer.zip Malicious activity

Add for printing

File name:	AnyDesk-8-0-10-0-2024-BY-lAufer.zip
Full analysis:	https://app.any.run/tasks/80e4873f-91a3-4cad-afae-89667d51001a
Verdict:	Malicious activity
Analysis date:	August 08, 2024, 15:11:27
OS:	Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME:	application/zip
File info:	Zip archive data, at least v1.0 to extract, compression method=store
MD5:	E2D6BEB90B4EE16CDE884B01BF590D17
SHA1:	ECC81CFFEDA95137F218267E983CF4BC49FB3160
SHA256:	F8F319208670D83A68A015B9D43D52F76EE6F372E6A837158D49FE46AF9603FF
SSDEEP:	98304:bf4bAtLvz+qHVZ+eMR4YAPkW/PvNuaiXxKCGpIPahlhYjHiKloGshfz+D+yR6daW:mnxbeqNfk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 120 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: 60 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Uses AES cipher (POWERSHELL)
  - powershell.exe (PID: 2228)
- Gets or sets the symmetric key that is used for encryption and decryption (POWERSHELL)
  - powershell.exe (PID: 2228)
- Gets or sets the initialization vector for the symmetric algorithm (POWERSHELL)
  - powershell.exe (PID: 2228)
- Dynamically loads an assembly (POWERSHELL)
  - powershell.exe (PID: 2228)
SUSPICIOUS
- Reads security settings of Internet Explorer
  - AnyDesk.exe (PID: 7108)
- Reads the date of Windows installation
  - AnyDesk.exe (PID: 7108)
- Drops the executable file immediately after the start
  - WinRAR.exe (PID: 304)
  - Classic.exe (PID: 2852)
- Starts CMD.EXE for commands execution
  - AnyDesk.exe (PID: 7108)
  - cmd.exe (PID: 2872)
- Executing commands from a ".bat" file
  - AnyDesk.exe (PID: 7108)
  - cmd.exe (PID: 2872)
- Checks Windows Trust Settings
  - AnyDesk.exe (PID: 7108)
- Application launched itself
  - Classic.exe (PID: 3864)
  - cmd.exe (PID: 2872)
  - powershell.exe (PID: 2228)
- Allows hiding code in an environment variable
  - cmd.exe (PID: 7156)
  - cmd.exe (PID: 2336)
  - cmd.exe (PID: 4296)
  - cmd.exe (PID: 5908)
  - cmd.exe (PID: 5980)
  - cmd.exe (PID: 1948)
  - cmd.exe (PID: 4016)
  - cmd.exe (PID: 2008)
  - cmd.exe (PID: 2204)
- Cryptography encrypted command line is found
  - cmd.exe (PID: 3032)
- Starts POWERSHELL.EXE for commands execution
  - cmd.exe (PID: 2872)
  - powershell.exe (PID: 2228)
- Executable content was dropped or overwritten
  - Classic.exe (PID: 2852)
- Uses base64 encoding (POWERSHELL)
  - powershell.exe (PID: 2228)
- Process checks specific path in scheduled tasks
  - powershell.exe (PID: 5468)
- Potential Corporate Privacy Violation
  - Classic.exe (PID: 2852)
- Probably obfuscated PowerShell command line is found
  - powershell.exe (PID: 2228)
- The process executes via Task Scheduler
  - PLUGScheduler.exe (PID: 1064)
INFO
- Creates files or folders in the user directory
  - AnyDesk.exe (PID: 7108)
  - Classic.exe (PID: 3864)
- Reads the machine GUID from the registry
  - AnyDesk.exe (PID: 7108)
  - Classic.exe (PID: 2852)
- Reads Environment values
  - AnyDesk.exe (PID: 7108)
- Executable content was dropped or overwritten
  - WinRAR.exe (PID: 304)
- Manual execution by a user
  - AnyDesk.exe (PID: 7108)
- Checks if a key exists in the options dictionary (POWERSHELL)
  - AnyDesk.exe (PID: 7108)
- Create files in a temporary directory
  - AnyDesk.exe (PID: 7108)
- Checks proxy server information
  - AnyDesk.exe (PID: 7108)
  - Classic.exe (PID: 7076)
- Reads the software policy settings
  - AnyDesk.exe (PID: 7108)
- Checks supported languages
  - AnyDesk.exe (PID: 7108)
  - Classic.exe (PID: 3864)
  - Classic.exe (PID: 7076)
  - Classic.exe (PID: 2852)
  - TextInputHost.exe (PID: 6392)
  - PLUGScheduler.exe (PID: 1064)
- Reads the computer name
  - AnyDesk.exe (PID: 7108)
  - Classic.exe (PID: 3864)
  - Classic.exe (PID: 2852)
  - Classic.exe (PID: 7076)
  - TextInputHost.exe (PID: 6392)
  - PLUGScheduler.exe (PID: 1064)
- Process checks computer location settings
  - AnyDesk.exe (PID: 7108)
  - Classic.exe (PID: 2852)
  - Classic.exe (PID: 7076)
- Process checks whether UAC notifications are on
  - Classic.exe (PID: 3864)
- Reads CPU info
  - Classic.exe (PID: 3864)
- Checks current location (POWERSHELL)
  - powershell.exe (PID: 2228)
- Uses string replace method (POWERSHELL)
  - powershell.exe (PID: 2228)
- Uses string split method (POWERSHELL)
  - powershell.exe (PID: 2228)
- Gets data length (POWERSHELL)
  - powershell.exe (PID: 2228)
- Creates files in the program directory
  - PLUGScheduler.exe (PID: 1064)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.zip	\|	ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion:	10
ZipBitFlag:	-
ZipCompression:	None
ZipModifyDate:	2024:08:08 14:38:54
ZipCRC:	0x00000000
ZipCompressedSize:	-
ZipUncompressedSize:	-
ZipFileName:	AnyDesk-8-0-10-0-2024-BY-lAufer/

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

262

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

304

"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\AnyDesk-8-0-10-0-2024-BY-lAufer.zip

C:\Program Files\WinRAR\WinRAR.exe

explorer.exe

User:

admin

Company:

Alexander Roshal

Integrity Level:

MEDIUM

Description:

WinRAR archiver

Exit code:

1073807364

Version:

5.91.0

Modules

Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll

1064

"C:\Program Files\RUXIM\PLUGscheduler.exe"

C:\Program Files\RUXIM\PLUGScheduler.exe

—

svchost.exe

User:

SYSTEM

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Windows Update LifeCycle Component Scheduler

Exit code:

Version:

10.0.19041.3623 (WinBuild.160101.0800)

Modules

Images
c:\program files\ruxim\plugscheduler.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll

1948

cmd /c "set __=^&rem"

C:\Windows\SysWOW64\cmd.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Windows Command Processor

Exit code:

Version:

10.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll

2008

cmd /c "set __=^&rem"

C:\Windows\SysWOW64\cmd.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Windows Command Processor

Exit code:

Version:

10.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll

2204

cmd /c "set __=^&rem"

C:\Windows\SysWOW64\cmd.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Windows Command Processor

Exit code:

Version:

10.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll

2228

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Windows PowerShell

Exit code:

1073807364

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll

2336

cmd /c "set __=^&rem"

C:\Windows\SysWOW64\cmd.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Windows Command Processor

Exit code:

Version:

10.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll

2608

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

2852

C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Windows\System32\rundll32.exe

—

svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows host process (Rundll32)

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll

2852

"C:\Users\admin\Desktop\AnyDesk-8-0-10-0-2024-BY-lAufer\AnyDesk 8.0.10.0 2024 (BY lAufer)\Data\Classic.exe" --local-service

C:\Users\admin\Desktop\AnyDesk-8-0-10-0-2024-BY-lAufer\AnyDesk 8.0.10.0 2024 (BY lAufer)\Data\Classic.exe

Classic.exe

User:

admin

Company:

AnyDesk Software GmbH

Integrity Level:

MEDIUM

Description:

AnyDesk

Exit code:

1073807364

Version:

8.0.10

Modules

Images
c:\users\admin\desktop\anydesk-8-0-10-0-2024-by-laufer\anydesk 8.0.10.0 2024 (by laufer)\data\classic.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\winmm.dll

Add for printing

Total events

28 128

Read events

28 102

Write events

Delete events

Modification events


(PID) Process:	(304) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:	write	Name:	ShellExtBMP
Value:
(PID) Process:	(304) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:	write	Name:	ShellExtIcon
Value:
(PID) Process:	(304) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	1
Value: C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:	(304) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	0
Value: C:\Users\admin\AppData\Local\Temp\AnyDesk-8-0-10-0-2024-BY-lAufer.zip
(PID) Process:	(304) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	name
Value: 120
(PID) Process:	(304) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	size
Value: 80
(PID) Process:	(304) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	type
Value: 120
(PID) Process:	(304) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	mtime
Value: 100
(PID) Process:	(7108) AnyDesk.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	ProxyBypass
Value: 1
(PID) Process:	(7108) AnyDesk.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	IntranetName
Value: 1

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
304	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\Rar$DRa304.21515\AnyDesk-8-0-10-0-2024-BY-lAufer\AnyDesk 8.0.10.0 2024 (BY lAufer)\AnyDesk.exe		executable
		MD5:F5ECF2EB39C378971BF78F7A7A92CE8B	SHA256:4506BAAA1B8B9284E432B1396D35D6157EC10109EA0A0ADD7B4E08E7110284FA
304	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\Rar$DRa304.21515\AnyDesk-8-0-10-0-2024-BY-lAufer\AnyDesk 8.0.10.0 2024 (BY lAufer)\Data\setup.dll		text
		MD5:50666591FB42D9E912A11CAA2DED4ADD	SHA256:652A740A2B4C79E78D301A64229E3712639BBD4B9E9668E30C907F7B27D3B2CC
7108	AnyDesk.exe	C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_qstrpola.kxa.ps1		text
		MD5:D17FE0A3F47BE24A6453E9EF58C94641	SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7108	AnyDesk.exe	C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_nmejhcht.bgh.psm1		text
		MD5:D17FE0A3F47BE24A6453E9EF58C94641	SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7108	AnyDesk.exe	C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_zldbck1z.itw.psm1		text
		MD5:D17FE0A3F47BE24A6453E9EF58C94641	SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7108	AnyDesk.exe	C:\Users\admin\AppData\Local\Temp\setup.bat		text
		MD5:50666591FB42D9E912A11CAA2DED4ADD	SHA256:652A740A2B4C79E78D301A64229E3712639BBD4B9E9668E30C907F7B27D3B2CC
7108	AnyDesk.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FE17BEC2A573BC9AE36869D0274FFA19_6DA81F04C5F9EAD2CD0268808FCE61E1		binary
		MD5:7A3B8457313A521E0D44F91765A4E041	SHA256:2B08ECF53BB8B6C430659926148F896102DC80B5F38B0EC5EFE122199659651C
3864	Classic.exe	C:\Users\admin\AppData\Roaming\AnyDesk\user.conf		text
		MD5:A787C308BD30D6D844E711D7579BE552	SHA256:8A395011A6A877D3BDD53CC8688EF146160DAB9D42140EB4A70716AD4293A440
7108	AnyDesk.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\248DDD9FCF61002E219645695E3FFC98_B65931808D21CEA247CFE7AD8A5650BC		binary
		MD5:33D58682E63E1E07C094B5E04EBC1510	SHA256:555B6873426ACF7F3EB072E38394988F1461B3785A727076D8B747017C81539B
7108	AnyDesk.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\248DDD9FCF61002E219645695E3FFC98_B65931808D21CEA247CFE7AD8A5650BC		binary
		MD5:F344DEB4F1E4C912FB4436901B23490C	SHA256:C0A72E1B8E1417D63DB48EA2DBE774FA6067AF02475C2BBFCD46D2FF206C72D4

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5336	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D	unknown	—	—	whitelisted
—	—	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
—	—	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
—	—	GET	200	52.6.97.148:80	http://ocsps.ssl.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQg3SSkKA74hABkhmlBtJTz8w3hlAQU%2BWC71OPVNPa49QaAJadz20ZpqJ4CEEJLalPOx2YUHCpjsaUcQQQ%3D	unknown	—	—	whitelisted
6348	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
6316	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
7108	AnyDesk.exe	GET	200	52.6.97.148:80	http://ocsps.ssl.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSoEwb5tith0jIBy9frSyNGB1lsAAQUNr1J%2FzEs669qQP6ZwBbtuvxI3V8CEC5PS6JcFeO7CIfoudHuK%2F8%3D	unknown	—	—	whitelisted
2928	OfficeClickToRun.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
4620	svchost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
2852	Classic.exe	POST	200	18.245.86.105:80	http://api.playanext.com/httpapi	unknown	—	—	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
532	svchost.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
—	—	239.255.255.250:1900	—	—	—	whitelisted
2120	MoUsoCoreWorker.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
—	—	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
5336	SearchApp.exe	104.126.37.139:443	www.bing.com	Akamai International B.V.	DE	unknown
5336	SearchApp.exe	192.229.221.95:80	ocsp.digicert.com	EDGECAST	US	whitelisted
—	—	40.126.32.140:443	login.live.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	unknown
—	—	192.229.221.95:80	ocsp.digicert.com	EDGECAST	US	whitelisted
—	—	40.115.3.253:443	client.wns.windows.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	51.124.78.146 51.104.136.2	whitelisted
google.com	216.58.212.174	whitelisted
www.bing.com	104.126.37.139 104.126.37.128 104.126.37.160 104.126.37.154 104.126.37.130 104.126.37.145 104.126.37.155 104.126.37.162 104.126.37.161 104.126.37.170 104.126.37.178 104.126.37.177 104.126.37.123 104.126.37.171 104.126.37.163 104.126.37.131 104.126.37.144	whitelisted
ocsp.digicert.com	192.229.221.95	whitelisted
login.live.com	40.126.32.140 40.126.32.72 20.190.160.22 40.126.32.138 20.190.160.20 20.190.160.14 20.190.160.17 40.126.32.133	whitelisted
client.wns.windows.com	40.115.3.253	whitelisted
fd.api.iris.microsoft.com	20.74.47.205	whitelisted
th.bing.com	104.126.37.178 104.126.37.163 104.126.37.123 104.126.37.170 104.126.37.162 104.126.37.177 104.126.37.171 104.126.37.186 104.126.37.128 104.126.37.131 104.126.37.160 104.126.37.144 104.126.37.161 104.126.37.139	whitelisted
ocsps.ssl.com	52.6.97.148 100.24.223.135 34.237.184.165	whitelisted
arc.msn.com	20.223.36.55	whitelisted

Threats

PID	Process	Class	Message
2852	Classic.exe	Potential Corporate Privacy Violation	ET USER_AGENTS AnyDesk Remote Desktop Software User-Agent

Add for printing

No debug info

General Info

AnyDesk-8-0-10-0-2024-BY-lAufer.zip

E2D6BEB90B4EE16CDE884B01BF590D17

ECC81CFFEDA95137F218267E983CF4BC49FB3160

F8F319208670D83A68A015B9D43D52F76EE6F372E6A837158D49FE46AF9603FF

98304:bf4bAtLvz+qHVZ+eMR4YAPkW/PvNuaiXxKCGpIPahlhYjHiKloGshfz+D+yR6daW:mnxbeqNfk

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Uses AES cipher (POWERSHELL)

Gets or sets the symmetric key that is used for encryption and decryption (POWERSHELL)

Gets or sets the initialization vector for the symmetric algorithm (POWERSHELL)

Dynamically loads an assembly (POWERSHELL)

SUSPICIOUS

Reads security settings of Internet Explorer

Reads the date of Windows installation

Drops the executable file immediately after the start

Starts CMD.EXE for commands execution

Executing commands from a ".bat" file

Checks Windows Trust Settings

Application launched itself

Allows hiding code in an environment variable

Cryptography encrypted command line is found

Starts POWERSHELL.EXE for commands execution

Executable content was dropped or overwritten

Uses base64 encoding (POWERSHELL)

Process checks specific path in scheduled tasks

Potential Corporate Privacy Violation

Probably obfuscated PowerShell command line is found

The process executes via Task Scheduler

INFO

Creates files or folders in the user directory

Reads the machine GUID from the registry

Reads Environment values

Executable content was dropped or overwritten

Manual execution by a user

Checks if a key exists in the options dictionary (POWERSHELL)

Create files in a temporary directory

Checks proxy server information

Reads the software policy settings

Checks supported languages

Reads the computer name

Process checks computer location settings

Process checks whether UAC notifications are on

Reads CPU info

Checks current location (POWERSHELL)

Uses string replace method (POWERSHELL)

Uses string split method (POWERSHELL)

Gets data length (POWERSHELL)

Creates files in the program directory

Malware configuration

Static information

TRiD

EXIF

ZIP

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information