Analysis
-
max time kernel
20s -
max time network
26s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
18-07-2023 10:17
Behavioral task
behavioral1
Sample
TeamViewer_Setup.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
TeamViewer_Setup.exe
Resource
win10v2004-20230703-en
Errors
General
-
Target
TeamViewer_Setup.exe
-
Size
470KB
-
MD5
17e792b0bb256533ce3fda3a2c4a093a
-
SHA1
901d60993c45332419f9f8619dec044e2a9fc41a
-
SHA256
4c477e0e78863415e64ce9656ef2d1db0e45e60d02ccd21ad52ae51f637815f1
-
SHA512
e5cea3e26bb612067546e7eb8e21689a98a1c6ff032ff466eface6cee1cb8c547880efe1bc9e2046e121e637e6fa032fb311b1b22aa18d501bfbc15970e448eb
-
SSDEEP
6144:hqly+DJZKBI0FyYeY4eoiJ+sCFv1A4Inlz+:SOyYrZos+xFvIl6
Malware Config
Signatures
-
Processes:
reg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
VanillaRat
VanillaRat is an advanced remote administration tool coded in C#.
-
Vanilla Rat payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/944-133-0x0000000000130000-0x00000000001AE000-memory.dmp vanillarat -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\EsetNOD32 = "C:\\Windows\\System32\\dllhоst.exe" reg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe -
Drops file in System32 directory 2 IoCs
Processes:
TeamViewer_Setup.exedescription ioc process File created C:\Windows\SysWOW64\install.cmd TeamViewer_Setup.exe File created C:\Windows\SysWOW64\dllhоst.exe TeamViewer_Setup.exe -
Modifies data under HKEY_USERS 15 IoCs
Processes:
LogonUI.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "243" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe -
Modifies registry key 1 TTPs 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
TeamViewer_Setup.exeshutdown.exedescription pid process Token: SeDebugPrivilege 944 TeamViewer_Setup.exe Token: SeShutdownPrivilege 952 shutdown.exe Token: SeRemoteShutdownPrivilege 952 shutdown.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
LogonUI.exepid process 1944 LogonUI.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
TeamViewer_Setup.execmd.execmd.exedescription pid process target process PID 944 wrote to memory of 2112 944 TeamViewer_Setup.exe cmd.exe PID 944 wrote to memory of 2112 944 TeamViewer_Setup.exe cmd.exe PID 944 wrote to memory of 2112 944 TeamViewer_Setup.exe cmd.exe PID 944 wrote to memory of 1496 944 TeamViewer_Setup.exe cmd.exe PID 944 wrote to memory of 1496 944 TeamViewer_Setup.exe cmd.exe PID 944 wrote to memory of 1496 944 TeamViewer_Setup.exe cmd.exe PID 2112 wrote to memory of 1928 2112 cmd.exe reg.exe PID 2112 wrote to memory of 1928 2112 cmd.exe reg.exe PID 2112 wrote to memory of 1928 2112 cmd.exe reg.exe PID 1496 wrote to memory of 4320 1496 cmd.exe reg.exe PID 1496 wrote to memory of 4320 1496 cmd.exe reg.exe PID 1496 wrote to memory of 4320 1496 cmd.exe reg.exe PID 1496 wrote to memory of 952 1496 cmd.exe shutdown.exe PID 1496 wrote to memory of 952 1496 cmd.exe shutdown.exe PID 1496 wrote to memory of 952 1496 cmd.exe shutdown.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\TeamViewer_Setup.exe"C:\Users\Admin\AppData\Local\Temp\TeamViewer_Setup.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v EsetNOD32 /t REG_SZ /d C:\Windows\System32\dllhоst.exe /f2⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v EsetNOD32 /t REG_SZ /d C:\Windows\System32\dllhоst.exe /f3⤵
- Adds Run key to start application
- Modifies registry key
PID:1928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\System32\install.cmd2⤵
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- UAC bypass
- Modifies registry key
PID:4320 -
C:\Windows\SysWOW64\shutdown.exeshutdown -r -t 13⤵
- Suspicious use of AdjustPrivilegeToken
PID:952
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa398a055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1944
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
139B
MD56bb1de604664795e452c73659ff8ced7
SHA193587cb366f8f46ad592f4eb9850837e1cafef73
SHA25669e87d18a60bc161d236af5471c6598b6897e297d2b26f0b3e9a63bd4475501f
SHA512e71dda2217b6bf338e8ade43249d7a726ee93d504760c11694232b1d4b15d41557d8f61f451f6c8b67f86b9acc16e214d2dc479fed24c4e67bd1169dff553bcd