#Anydesk download will not run for free#
#Anydesk download will not run portable#
#Anydesk download will not run software#
#Anydesk download will not run password#
#Anydesk download will not run windows#

Next up we look for the ID we picked up in the Connection trace file that was active at the time we need to investigateįirst up 40410xxxx, which has been redacted for privacy (I don’t want you connecting to me… sorry.)Īs previously seen, the alias of this is ‘totally not a hacker’, this alias field is typically the same as the local username, meaning this person has knowledge of the tool and what information is presented to the victim. If an older version is being used, maybe it pre-dates these features. Maybe it has features that don’t exist later? Maybe there are security vulnerabilities they can exploit? AnyDesk has worked to make the attackers life more difficult by adding features to highlight scam connections and disabling certain features. When looking at the version of AnyDesk the victim was running, we need to ask why use that version? Finally on this screenshot we also can confirm that AnyDesk was not installed when it was run.

Which is more useful if the host is not available to the forensicator.

#Anydesk download will not run windows#

We can also see the version of Windows used by the victim. This can be important if the attacker is intentionally using an old version. Well straight off the bat we can see the version of AnyDesk that is installed. If this host was a scamming victim that has never used AnyDesk before, this file will still be heavily populated, but at least the investigation will be simpler. Use the timestamps and IDs from the Connection_Trace file to focus your investigation. The ad.trace file is a verbose log and will be where the majority of effort will be spent. This type of information helps to build a bigger picture, and when law enforcement are involved these small pieces of evidence help them to prove that this system was the one the attacker used. It also shows that the attacker is running (most likely) as an administrator on that host. This tells us a couple of things, for one the account ‘local-admin’ is not created by Windows, which means this account was intentionally created with that name, and based off the name is most likely a local account and not part of a domain. The connection from this host was ‘totally not a hacker’ which we can see is an alias for the local admin account. You will get to see a directory path which, by default, will give away the username. The nf file is useful if an attacker has attempted to transfer files. Below is an example that I have redacted to stop you all trying to connect to my lab! Connection_trace.txt nf This provides you with time stamps and IDs to help focus your investigation and give you that initial hook that the baseline of a DFIR investigation. It is important to note that this is for incoming requests only, and does not display any outgoing connection data.

#Anydesk download will not run password#

The ‘Passwd’ and ‘Token’ settings are only relevant if the local system has set a password for unattended access.

REJECTED – if the local user has rejected the request.

Token – a ‘remember password’ check box being checked by the remote system.

Passwd – a password being entered by the remote system.

User – for the local user accepting the request.

The Connection_trace.txt file shows incoming requests with a status of Later versions uses hash check due to search order DLL vulnerabilities, which will be covered later. GCAPI.DLL is required for AnyDesk to run and for PE version may be seen in the same location as the executable, or will be seen in the Temp folder.įor user temp (PE) you will be looking by default inįor system temp (installed) files you will be lookingĪnyDesk will search for this file and download it if it is not already present. If this is from a scammer, it is most likely going to be in the Downloads folder, or the Desktop. To check which way this application is being run, look at the file properties of the AnyDesk application. However the artefacts discussed here will be the same in both locations.

#Anydesk download will not run software#

The way the software is run, will dictate the artefact locations on the disk.

#Anydesk download will not run portable#

There are also several options within AnyDesk that will allow the attacker to lock the victim out of their own machine, giving complete control to the attacker.ĪnyDesk have taken steps to present the victim with alerts, and even disallow certain actions by the remote device, but the scammers utilise social engineering techniques to bypass these easily.ĪnyDesk can be downloaded from the AnyDesk website here Technical AspectsĪnyDesk can be run in two ways installed like a tradition piece of software, or as a portable executable (PE). It is the scammer’s tool of choice because it is very easy to download and set up.

#Anydesk download will not run for free#

Click here to view this research on my YouTube channel What is AnyDesk?ĪnyDesk is a legitimate, non-malicious piece of software that is used by companies world wide to manage their IT systems, and can be used for free to help family members with IT issues.