Analysis

  • max time kernel
    141s
  • max time network
    162s
  • platform
    windows7_x64
  • resource
    win7v200430
  • submitted
    07/07/2020, 09:35

General

  • Target

    Teams_windows_x64_s_8D81D942A50991F-7-0_.exe

  • Size

    93.7MB

  • MD5

    dd8216c8debaf1a9bfe3a96d450158d4

  • SHA1

    0315df25ffe96681cf594a6a358d28e9610640b5

  • SHA256

    ac8f18a6311375f33748c435ddd77051d7a5f207fd0832415fe2684375e317a5

  • SHA512

    857803a93627bed65ea8335ea426288c4408930423531957d5b3d68815339f1673da1d39d5f8278f701763aaab6355aebf3441604ad761614be7c6bb36077b6b

Malware Config

Signatures

  • Loads dropped DLL 83 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs
  • Suspicious use of FindShellTrayWindow 11 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Modifies registry class 4319 IoCs
  • Adds Run entry to start application 2 TTPs 2 IoCs
  • Checks for installed software on the system 1 TTPs 4 IoCs
  • Executes dropped EXE 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Registers COM server for autorun 1 TTPs 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Teams_windows_x64_s_8D81D942A50991F-7-0_.exe
    "C:\Users\Admin\AppData\Local\Temp\Teams_windows_x64_s_8D81D942A50991F-7-0_.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:240
    • C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
      "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install . --exeName=Teams_windows_x64_s_8D81D942A50991F-7-0_.exe
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      • Suspicious use of FindShellTrayWindow
      • Modifies registry class
      • Checks for installed software on the system
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1020
      • C:\Users\Admin\AppData\Local\Microsoft\Teams\current\Squirrel.exe
        "C:\Users\Admin\AppData\Local\Microsoft\Teams\current\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
        3⤵
        • Loads dropped DLL
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1860
      • C:\Users\Admin\AppData\Local\Microsoft\Teams\current\Teams.exe
        "C:\Users\Admin\AppData\Local\Microsoft\Teams\current\Teams.exe" --squirrel-install 1.3.00.13565
        3⤵
        • Loads dropped DLL
        • Executes dropped EXE
        PID:516
      • C:\Users\Admin\AppData\Local\Microsoft\Teams\current\Teams.exe
        "C:\Users\Admin\AppData\Local\Microsoft\Teams\current\Teams.exe" --squirrel-firstrun
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Adds Run entry to start application
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SendNotifyMessage
        • Checks processor information in registry
        PID:1508
        • C:\Users\Admin\AppData\Local\Microsoft\Teams\current\Teams.exe
          "C:\Users\Admin\AppData\Local\Microsoft\Teams\current\Teams.exe" --type=gpu-process --enable-features=SharedArrayBuffer --disable-features=SpareRendererForSitePerProcess --no-sandbox --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --service-request-channel-token=568377515588734154 --mojo-platform-channel-handle=1032 /prefetch:2
          4⤵
          • Loads dropped DLL
          • Executes dropped EXE
          PID:1460
        • C:\Users\Admin\AppData\Local\Microsoft\Teams\current\Teams.exe
          "C:\Users\Admin\AppData\Local\Microsoft\Teams\current\Teams.exe" --type=renderer --no-sandbox --autoplay-policy=no-user-gesture-required --enable-features=SharedArrayBuffer --disable-features=SpareRendererForSitePerProcess --service-pipe-token=7262588018745555576 --lang=en-US --app-user-model-id=com.squirrel.Teams.Teams --app-path="C:\Users\Admin\AppData\Local\Microsoft\Teams\current\resources\app.asar" --user-agent="Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Teams/1.3.00.13565 Chrome/69.0.3497.128 Electron/4.2.12 Safari/537.36" --node-integration=false --webview-tag=false --no-sandbox --preload="C:\Users\Admin\AppData\Local\Microsoft\Teams\current\resources\app.asar\lib\renderer\preload_default.js" --disable-remote-module --background-color=#FFFFFFFF --electron-shared-settings=eyJjci5jb21wYW55IjoiRWxlY3Ryb24iLCJjci5kdW1wcyI6IiIsImNyLmVuYWJsZWQiOmZhbHNlLCJjci5wcm9kdWN0IjoiRWxlY3Ryb24iLCJjci5zZXNzaW9uIjoiIiwiY3IudXJsIjoiIiwiY3IudmVyc2lvbiI6InY0LjIuMTIifQ== --device-scale-factor=1 --num-raster-threads=1 --service-request-channel-token=7262588018745555576 --renderer-client-id=5 --mojo-platform-channel-handle=1536 /prefetch:1 --msteams-process-type=loadingWindow
          4⤵
          • Loads dropped DLL
          • Executes dropped EXE
          PID:1844
        • C:\Users\Admin\AppData\Local\Microsoft\Teams\current\Teams.exe
          "C:\Users\Admin\AppData\Local\Microsoft\Teams\current\Teams.exe" --type=renderer --no-sandbox --autoplay-policy=no-user-gesture-required --enable-features=SharedArrayBuffer --disable-features=SpareRendererForSitePerProcess --service-pipe-token=14304270443225705599 --lang=en-US --app-user-model-id=com.squirrel.Teams.Teams --app-path="C:\Users\Admin\AppData\Local\Microsoft\Teams\current\resources\app.asar" --user-agent="Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Teams/1.3.00.13565 Chrome/69.0.3497.128 Electron/4.2.12 Safari/537.36" --node-integration=false --webview-tag=false --no-sandbox --preload="C:\Users\Admin\AppData\Local\Microsoft\Teams\current\resources\app.asar\lib\renderer\notifications\preload_notifications.js" --disable-remote-module --background-color=#fff --electron-shared-settings=eyJjci5jb21wYW55IjoiRWxlY3Ryb24iLCJjci5kdW1wcyI6IiIsImNyLmVuYWJsZWQiOmZhbHNlLCJjci5wcm9kdWN0IjoiRWxlY3Ryb24iLCJjci5zZXNzaW9uIjoiIiwiY3IudXJsIjoiIiwiY3IudmVyc2lvbiI6InY0LjIuMTIifQ== --device-scale-factor=1 --num-raster-threads=1 --service-request-channel-token=14304270443225705599 --renderer-client-id=8 --mojo-platform-channel-handle=1920 /prefetch:1 --msteams-process-type=notificationsManager
          4⤵
          • Loads dropped DLL
          • Executes dropped EXE
          PID:2060
        • C:\Users\Admin\AppData\Local\Microsoft\Teams\current\Teams.exe
          "C:\Users\Admin\AppData\Local\Microsoft\Teams\current\Teams.exe" --type=gpu-process --enable-features=SharedArrayBuffer --disable-features=SpareRendererForSitePerProcess --no-sandbox --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --use-gl=swiftshader-webgl --service-request-channel-token=3366100442632735902 --mojo-platform-channel-handle=2016 /prefetch:2
          4⤵
          • Loads dropped DLL
          • Executes dropped EXE
          PID:2152
        • C:\Users\Admin\AppData\Local\Microsoft\Teams\current\Teams.exe
          "C:\Users\Admin\AppData\Local\Microsoft\Teams\current\Teams.exe" --type=renderer --no-sandbox --autoplay-policy=no-user-gesture-required --enable-features=SharedArrayBuffer --disable-features=SpareRendererForSitePerProcess --disable-gpu-compositing --service-pipe-token=6273333455237132630 --lang=en-US --app-user-model-id=com.squirrel.Teams.Teams --app-path="C:\Users\Admin\AppData\Local\Microsoft\Teams\current\resources\app.asar" --user-agent="Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Teams/1.3.00.13565 Chrome/69.0.3497.128 Electron/4.2.12 Safari/537.36" --node-integration=false --webview-tag=true --no-sandbox --preload="C:\Users\Admin\AppData\Local\Microsoft\Teams\current\resources\app.asar\lib\renderer\preload.js" --disable-remote-module --background-color=#fff --electron-shared-settings=eyJjci5jb21wYW55IjoiRWxlY3Ryb24iLCJjci5kdW1wcyI6IiIsImNyLmVuYWJsZWQiOmZhbHNlLCJjci5wcm9kdWN0IjoiRWxlY3Ryb24iLCJjci5zZXNzaW9uIjoiIiwiY3IudXJsIjoiIiwiY3IudmVyc2lvbiI6InY0LjIuMTIifQ== --device-scale-factor=1 --num-raster-threads=1 --service-request-channel-token=6273333455237132630 --renderer-client-id=10 --mojo-platform-channel-handle=2732 /prefetch:1 --msteams-process-type=mainWindow
          4⤵
          • Executes dropped EXE
          PID:2696
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.20091.2\x64\Microsoft.Teams.AddinLoader.dll"
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1432
        • C:\Windows\system32\regsvr32.exe
          /s /n /i:user "C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.20091.2\x64\Microsoft.Teams.AddinLoader.dll"
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          • Registers COM server for autorun
          PID:560
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\SysWOW64\regsvr32.exe" /s /n /i:user "C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.20091.2\x86\Microsoft.Teams.AddinLoader.dll"
        3⤵
        • Loads dropped DLL
        • Registers COM server for autorun
        PID:2076

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads