Analysis

  • max time kernel
    148s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    15-01-2024 05:41

General

  • Target

    $TEMP/TeamViewer/Version5/TeamViewer.exe

  • Size

    4.8MB

  • MD5

    163d51041a322b849ce16c2c019d8335

  • SHA1

    4b1458abe96fd493dcebd1cf7831ba9f28d6c7f4

  • SHA256

    e6279ef293ac389c7d0f91f529d70c601aa30fb5f1c88b14715347b2be1caf18

  • SHA512

    b9195ccf9781a795eb114fa9f65c89f4d68d8a6d9aadc2e89086d0f31a097167c7d91a1b6467abf5409c4896f49e68cc45656061cb0ee9f38c0bff75925e54cf

  • SSDEEP

    98304:VAj+gvcIommkHwzP7qXDbd3yjpiuxbrOTMklzuZknEX0lvY5jq18ne5QV+3u:VAq2cIomZQzzqV3yliuxm/MKE8vYT

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$TEMP\TeamViewer\Version5\TeamViewer.exe
    "C:\Users\Admin\AppData\Local\Temp\$TEMP\TeamViewer\Version5\TeamViewer.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1916

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C3948BE6E525B8A8CEE9FAC91C9E392_EEB8C7E9A435DC539B7A34AD155842C4

    Filesize

    5B

    MD5

    5bfa51f3a417b98e7443eca90fc94703

    SHA1

    8c015d80b8a23f780bdd215dc842b0f5551f63bd

    SHA256

    bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

    SHA512

    4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C3948BE6E525B8A8CEE9FAC91C9E392_EEB8C7E9A435DC539B7A34AD155842C4

    Filesize

    412B

    MD5

    90cade1afd5686a7d0fb361cfd554eb5

    SHA1

    abcb77844b96579a01e4626c0498f369da451f41

    SHA256

    a7afbaa9b558411b7922db5997a30f6de239ec783edb5829e33eb72ca7a7fee2

    SHA512

    2a04a0cfc297dbba8fa64a337ad45c1b3c1aa080e805b27a0ecfb9b3cbc74e7a5d6ffcf722b536d1db34b3fbf13b7266840c9711ede07b37e41c5fa167b413d5

  • memory/1916-0-0x00000000022D0000-0x00000000022E9000-memory.dmp

    Filesize

    100KB

  • memory/1916-25-0x0000000002F10000-0x0000000002F11000-memory.dmp

    Filesize

    4KB

  • memory/1916-26-0x0000000002F10000-0x0000000002F11000-memory.dmp

    Filesize

    4KB