5382c8f1ba894ca640bac19559d50aee07a5c4255028ce83bcdd642957ea3e1a

Analysis

max time kernel
133s
max time network
29s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
11-04-2023 19:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tv.exe
Size

40.3MB
MD5

c8c6692a2bdc9d362f7370e63188927c
SHA1

74bff8889fc24b8a3bc2a7076ef344a361dced7a
SHA256

5382c8f1ba894ca640bac19559d50aee07a5c4255028ce83bcdd642957ea3e1a
SHA512

53a35769dbc3b71cb1545d100b815c9abcb9fbcb50da6909358f0624e07e32dfee33a5a8cbabbb7d217111f19dd4719759920d0a6e246a9851bad795137e108c
SSDEEP

786432:O0Wkxr+c26TGFS7yZrTjhNJHVt3DKMfmeUMhimMjRlsw77D9hNhez:hzk6TWSGZ9TTnmZNOc7xhNhez

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
852	TeamViewer_.exe

Loads dropped DLL 16 IoCs

pid	Process
908	tv.exe
908	tv.exe
852	TeamViewer_.exe
852	TeamViewer_.exe
852	TeamViewer_.exe
852	TeamViewer_.exe
852	TeamViewer_.exe
852	TeamViewer_.exe
852	TeamViewer_.exe
852	TeamViewer_.exe
852	TeamViewer_.exe
852	TeamViewer_.exe
852	TeamViewer_.exe
852	TeamViewer_.exe
852	TeamViewer_.exe
852	TeamViewer_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
852	TeamViewer_.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 852	908	tv.exe	27
PID 908 wrote to memory of 852	908	tv.exe	27
PID 908 wrote to memory of 852	908	tv.exe	27
PID 908 wrote to memory of 852	908	tv.exe	27
PID 908 wrote to memory of 852	908	tv.exe	27
PID 908 wrote to memory of 852	908	tv.exe	27
PID 908 wrote to memory of 852	908	tv.exe	27

C:\Users\Admin\AppData\Local\Temp\tv.exe
"C:\Users\Admin\AppData\Local\Temp\tv.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:908
- C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
  "C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer_.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:852

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer_.exe

Filesize
39.5MB

MD5
af7555aff8a9a3d97a5486642b6303bd

SHA1
fa1d8883c6e93bd524b4905fd4e1a467d6221f22

SHA256
1d66ce0598f81de7fd499deaf91ae638f428908870d6857abb87b266549d84b6

SHA512
00f4fa7313a88230db8437498ba3091a3f41b247e2fb9d935818f5fa6ac1df4ffa2bace59f1cc02647b9de59eda122d98d315e4e5a6f8cf2cc3a8d4d81a8c925

Download Submit
C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer_.exe

Filesize
39.5MB

MD5
af7555aff8a9a3d97a5486642b6303bd

SHA1
fa1d8883c6e93bd524b4905fd4e1a467d6221f22

SHA256
1d66ce0598f81de7fd499deaf91ae638f428908870d6857abb87b266549d84b6

SHA512
00f4fa7313a88230db8437498ba3091a3f41b247e2fb9d935818f5fa6ac1df4ffa2bace59f1cc02647b9de59eda122d98d315e4e5a6f8cf2cc3a8d4d81a8c925

Download Submit
C:\Users\Admin\AppData\Local\Temp\TeamViewer\tvinfo.ini

Filesize
32B

MD5
8dc7b09b9fbcd5fd96c3a8bdf3bad902

SHA1
5ac23bc1570874becc04e78ecdd855461e42e10d

SHA256
8732d50f90c1abdd2a044951870a16ce3f906e933cf8c8cf5ecd76bfc38590dc

SHA512
affeb53a0c0dfaf59a757718009151099ea8914ead3f1fd028d7b72e22c39c5393161ad1e7cd76a0505b5dc6ba4608d60ec1679334d15dcac1b36bb0062eb863

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso6837.tmp\TvGetVersion.dll

Filesize
203KB

MD5
465ad8b483c5e8bbfee17aa15ea3b488

SHA1
ad984431df286cd6c10796b49c248e6afb4d55bf

SHA256
943149b2cf028bbe593375e255ed834c129f97ed2dab9c3779d871446dc177df

SHA512
8c137cff4aeeee2556233a07d7df9c183c38a36c40d904a89f22d73cc13b3941d71708da89dfe908f335f6c39e4c70b376dd437924e15ac697876f612bdf01d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy71E8.tmp\InstallOptions.dll

Filesize
15KB

MD5
033ee34c40e8fa85bf2739bcb2f3e186

SHA1
2ca942f35f77f37df3fc6097acac34f2e77341b7

SHA256
c91c1796338a265b49039c0b2c7a312d764b99e5174fb2dae455ca54f8f41ec7

SHA512
2204e0b8721b8d85c51bd068b1695b16ee096bfc1d1cd5843f48fd04032aeee2b6a91ce82978a4b3414f3d966ec5b36fb337a4149dae3a1d0445935d964d247f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy71E8.tmp\TvGetVersion.dll

Filesize
222KB

MD5
b9e0c430596b2435971079edd15d3f0c

SHA1
fc214c6757e3539729e42f754c6b9768fd44a942

SHA256
c1ec07d1faf59ecdc0c8c1cd258b2feb6d41321471a8c1b10b00100c7106bd7e

SHA512
93dc70fc6fcc4c0f4bc5fc5819446dc465360ef459a0be408bd07a78229f297da12d602b0667145d9716514e8f3da3582b1c4c0e3e9524e39c4a0c8fe7d4e25b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy71E8.tmp\UserInfo.dll

Filesize
4KB

MD5
9b0db6a6056e8e51ac35e602aeab769f

SHA1
b541c6d2635141cdc3a74f59d55db8df4a92e7ac

SHA256
925d80c31702a95d58ede91ee97fd842de78ca6dde69156a6c1a755fba93cd5c

SHA512
83fe9d346835940a37e0e0a18d041c9d13fc95a0e9ece3bc18e555cf0e8e7ddf7b42dba422b1e55ace31db3c9fc807e0b44e93b8f07f5acb943eaaf77b4f0ac6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy71E8.tmp\start_unicode.ini

Filesize
2KB

MD5
bddaa786ecd0be186e4648f26c78c1e3

SHA1
a08e22358079799845bd28e6e9d59364eec504af

SHA256
feb09fb9d581bca2713ff3fe098d3396c579d09e4234140ff852bdb482f73d97

SHA512
d66bc2f35846e2485d27bb1a2034a053826097105272b13670cdd0037dc44e6bf3787fcc023a2a2425f81c9330d4b892656c601552403ab5258778c4d824da25

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy71E8.tmp\start_unicode.ini

Filesize
2KB

MD5
ec44a6ae27c5a9150fa82ba7716588fa

SHA1
0975a4944158d38123f0f1e33f98eb0c3ca311ed

SHA256
d51da90b36c5c4d23d0b00f04e02a05777cea42478d813e8f0381d59a8ce5317

SHA512
7f72e174baa2ca8763effef9a1e2db1a62947942d365a15ea8e3a80afcd9a39ba3f2ad0101f9d38b90fbb7a1414e27b6826c112d7df44345e84eb6a64d65271d

Download Submit
\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer_.exe

Filesize
39.5MB

MD5
af7555aff8a9a3d97a5486642b6303bd

SHA1
fa1d8883c6e93bd524b4905fd4e1a467d6221f22

SHA256
1d66ce0598f81de7fd499deaf91ae638f428908870d6857abb87b266549d84b6

SHA512
00f4fa7313a88230db8437498ba3091a3f41b247e2fb9d935818f5fa6ac1df4ffa2bace59f1cc02647b9de59eda122d98d315e4e5a6f8cf2cc3a8d4d81a8c925

Download Submit
\Users\Admin\AppData\Local\Temp\nso6837.tmp\TvGetVersion.dll

Filesize
203KB

MD5
465ad8b483c5e8bbfee17aa15ea3b488

SHA1
ad984431df286cd6c10796b49c248e6afb4d55bf

SHA256
943149b2cf028bbe593375e255ed834c129f97ed2dab9c3779d871446dc177df

SHA512
8c137cff4aeeee2556233a07d7df9c183c38a36c40d904a89f22d73cc13b3941d71708da89dfe908f335f6c39e4c70b376dd437924e15ac697876f612bdf01d6

Download Submit
\Users\Admin\AppData\Local\Temp\nsy71E8.tmp\InstallOptions.dll

Filesize
15KB

MD5
033ee34c40e8fa85bf2739bcb2f3e186

SHA1
2ca942f35f77f37df3fc6097acac34f2e77341b7

SHA256
c91c1796338a265b49039c0b2c7a312d764b99e5174fb2dae455ca54f8f41ec7

SHA512
2204e0b8721b8d85c51bd068b1695b16ee096bfc1d1cd5843f48fd04032aeee2b6a91ce82978a4b3414f3d966ec5b36fb337a4149dae3a1d0445935d964d247f

Download Submit
\Users\Admin\AppData\Local\Temp\nsy71E8.tmp\InstallOptions.dll

Filesize
15KB

MD5
033ee34c40e8fa85bf2739bcb2f3e186

SHA1
2ca942f35f77f37df3fc6097acac34f2e77341b7

SHA256
c91c1796338a265b49039c0b2c7a312d764b99e5174fb2dae455ca54f8f41ec7

SHA512
2204e0b8721b8d85c51bd068b1695b16ee096bfc1d1cd5843f48fd04032aeee2b6a91ce82978a4b3414f3d966ec5b36fb337a4149dae3a1d0445935d964d247f

Download Submit
\Users\Admin\AppData\Local\Temp\nsy71E8.tmp\InstallOptions.dll

Filesize
15KB

MD5
033ee34c40e8fa85bf2739bcb2f3e186

SHA1
2ca942f35f77f37df3fc6097acac34f2e77341b7

SHA256
c91c1796338a265b49039c0b2c7a312d764b99e5174fb2dae455ca54f8f41ec7

SHA512
2204e0b8721b8d85c51bd068b1695b16ee096bfc1d1cd5843f48fd04032aeee2b6a91ce82978a4b3414f3d966ec5b36fb337a4149dae3a1d0445935d964d247f

Download Submit
\Users\Admin\AppData\Local\Temp\nsy71E8.tmp\InstallOptions.dll

Filesize
15KB

MD5
033ee34c40e8fa85bf2739bcb2f3e186

SHA1
2ca942f35f77f37df3fc6097acac34f2e77341b7

SHA256
c91c1796338a265b49039c0b2c7a312d764b99e5174fb2dae455ca54f8f41ec7

SHA512
2204e0b8721b8d85c51bd068b1695b16ee096bfc1d1cd5843f48fd04032aeee2b6a91ce82978a4b3414f3d966ec5b36fb337a4149dae3a1d0445935d964d247f

Download Submit
\Users\Admin\AppData\Local\Temp\nsy71E8.tmp\InstallOptions.dll

Filesize
15KB

MD5
033ee34c40e8fa85bf2739bcb2f3e186

SHA1
2ca942f35f77f37df3fc6097acac34f2e77341b7

SHA256
c91c1796338a265b49039c0b2c7a312d764b99e5174fb2dae455ca54f8f41ec7

SHA512
2204e0b8721b8d85c51bd068b1695b16ee096bfc1d1cd5843f48fd04032aeee2b6a91ce82978a4b3414f3d966ec5b36fb337a4149dae3a1d0445935d964d247f

Download Submit
\Users\Admin\AppData\Local\Temp\nsy71E8.tmp\System.dll

Filesize
11KB

MD5
0ff2d70cfdc8095ea99ca2dabbec3cd7

SHA1
10c51496d37cecd0e8a503a5a9bb2329d9b38116

SHA256
982c5fb7ada7d8c9bc3e419d1c35da6f05bc5dd845940c179af3a33d00a36a8b

SHA512
cb5fc0b3194f469b833c2c9abf493fcec5251e8609881b7f5e095b9bd09ed468168e95dda0ba415a7d8d6b7f0dee735467c0ed8e52b223eb5359986891ba6e2e

Download Submit
\Users\Admin\AppData\Local\Temp\nsy71E8.tmp\TvGetVersion.dll

Filesize
222KB

MD5
b9e0c430596b2435971079edd15d3f0c

SHA1
fc214c6757e3539729e42f754c6b9768fd44a942

SHA256
c1ec07d1faf59ecdc0c8c1cd258b2feb6d41321471a8c1b10b00100c7106bd7e

SHA512
93dc70fc6fcc4c0f4bc5fc5819446dc465360ef459a0be408bd07a78229f297da12d602b0667145d9716514e8f3da3582b1c4c0e3e9524e39c4a0c8fe7d4e25b

Download Submit
\Users\Admin\AppData\Local\Temp\nsy71E8.tmp\TvGetVersion.dll

Filesize
222KB

MD5
b9e0c430596b2435971079edd15d3f0c

SHA1
fc214c6757e3539729e42f754c6b9768fd44a942

SHA256
c1ec07d1faf59ecdc0c8c1cd258b2feb6d41321471a8c1b10b00100c7106bd7e

SHA512
93dc70fc6fcc4c0f4bc5fc5819446dc465360ef459a0be408bd07a78229f297da12d602b0667145d9716514e8f3da3582b1c4c0e3e9524e39c4a0c8fe7d4e25b

Download Submit
\Users\Admin\AppData\Local\Temp\nsy71E8.tmp\TvGetVersion.dll

Filesize
222KB

MD5
b9e0c430596b2435971079edd15d3f0c

SHA1
fc214c6757e3539729e42f754c6b9768fd44a942

SHA256
c1ec07d1faf59ecdc0c8c1cd258b2feb6d41321471a8c1b10b00100c7106bd7e

SHA512
93dc70fc6fcc4c0f4bc5fc5819446dc465360ef459a0be408bd07a78229f297da12d602b0667145d9716514e8f3da3582b1c4c0e3e9524e39c4a0c8fe7d4e25b

Download Submit
\Users\Admin\AppData\Local\Temp\nsy71E8.tmp\TvGetVersion.dll

Filesize
222KB

MD5
b9e0c430596b2435971079edd15d3f0c

SHA1
fc214c6757e3539729e42f754c6b9768fd44a942

SHA256
c1ec07d1faf59ecdc0c8c1cd258b2feb6d41321471a8c1b10b00100c7106bd7e

SHA512
93dc70fc6fcc4c0f4bc5fc5819446dc465360ef459a0be408bd07a78229f297da12d602b0667145d9716514e8f3da3582b1c4c0e3e9524e39c4a0c8fe7d4e25b

Download Submit
\Users\Admin\AppData\Local\Temp\nsy71E8.tmp\TvGetVersion.dll

Filesize
222KB

MD5
b9e0c430596b2435971079edd15d3f0c

SHA1
fc214c6757e3539729e42f754c6b9768fd44a942

SHA256
c1ec07d1faf59ecdc0c8c1cd258b2feb6d41321471a8c1b10b00100c7106bd7e

SHA512
93dc70fc6fcc4c0f4bc5fc5819446dc465360ef459a0be408bd07a78229f297da12d602b0667145d9716514e8f3da3582b1c4c0e3e9524e39c4a0c8fe7d4e25b

Download Submit
\Users\Admin\AppData\Local\Temp\nsy71E8.tmp\UserInfo.dll

Filesize
4KB

MD5
9b0db6a6056e8e51ac35e602aeab769f

SHA1
b541c6d2635141cdc3a74f59d55db8df4a92e7ac

SHA256
925d80c31702a95d58ede91ee97fd842de78ca6dde69156a6c1a755fba93cd5c

SHA512
83fe9d346835940a37e0e0a18d041c9d13fc95a0e9ece3bc18e555cf0e8e7ddf7b42dba422b1e55ace31db3c9fc807e0b44e93b8f07f5acb943eaaf77b4f0ac6

Download Submit
\Users\Admin\AppData\Local\Temp\nsy71E8.tmp\UserInfo.dll

Filesize
4KB

MD5
9b0db6a6056e8e51ac35e602aeab769f

SHA1
b541c6d2635141cdc3a74f59d55db8df4a92e7ac

SHA256
925d80c31702a95d58ede91ee97fd842de78ca6dde69156a6c1a755fba93cd5c

SHA512
83fe9d346835940a37e0e0a18d041c9d13fc95a0e9ece3bc18e555cf0e8e7ddf7b42dba422b1e55ace31db3c9fc807e0b44e93b8f07f5acb943eaaf77b4f0ac6

Download Submit
\Users\Admin\AppData\Local\Temp\nsy71E8.tmp\linker.dll

Filesize
45KB

MD5
4ac3f0ab2e423515ed9c575333342054

SHA1
a3e4f2b2135157f964d471564044b023a64f2532

SHA256
f223d6c72f86544b358a6301daf60ccdd86198f32e3447a1860acf3f59f2dae9

SHA512
8fbd5b4989be51c27fa15af155d2921bea9aa5d0557a22d4224256e678dfe7dcaa5f80917a748c31dc9c9a91573e4618e2497ccfd47eefd7a0fa08c12366a1e5

Download Submit
memory/852-324-0x0000000000680000-0x000000000068E000-memory.dmp

Filesize
56KB

Download