File name:

TeamViewer11_Exit.hta

Full analysis: https://app.any.run/tasks/dee0895d-1b9e-4037-9236-70c3d1c850a2
Verdict: Malicious activity
Analysis date: March 18, 2024, 05:55:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/octet-stream
File info: data
MD5:

2703F13A3876449D71A78182793D883A

SHA1:

90D25BA6E6F61FE9A1A8AF67444021A415C30FEF

SHA256:

1A1FF5EC6C6C7150124555B7714A4BD62C8C9BF96FECF1931EE20891DA06BEF4

SSDEEP:

24:p37rysGWgjN9TLk/4TolcTCTVcxBOU9m9TnG10taZl5B1S:pf1GVN9Hkq4mCTVPtGitab5BE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads the Internet Settings

      • mshta.exe (PID: 4008)
      • mshta.exe (PID: 552)
      • mshta.exe (PID: 1784)
      • mshta.exe (PID: 2088)

    • Adds/modifies Windows certificates

      • mshta.exe (PID: 4008)
      • mshta.exe (PID: 1784)
      • mshta.exe (PID: 2088)
      • mshta.exe (PID: 552)

  • INFO

    • Checks proxy server information

      • mshta.exe (PID: 1784)
      • mshta.exe (PID: 552)
      • mshta.exe (PID: 4008)
      • mshta.exe (PID: 2088)

    • Manual execution by a user

      • mshta.exe (PID: 1784)
      • mshta.exe (PID: 552)
      • mshta.exe (PID: 2088)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 1784)
      • mshta.exe (PID: 4008)
      • mshta.exe (PID: 552)
      • mshta.exe (PID: 2088)

    • Application launched itself

      • iexplore.exe (PID: 3100)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
7
Malicious processes
0
Suspicious processes
4

Behavior graph

Click at the process to see the details
start mshta.exe mshta.exe mshta.exe iexplore.exe iexplore.exe no specs iexplore.exe mshta.exe

Process information

PID
CMD
Path
Indicators
Parent process
548"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3100 CREDAT:2233609 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
552"C:\Windows\System32\mshta.exe" "C:\Users\admin\Desktop\TeamViewer11_Exit.hta" C:\Windows\System32\mshta.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
1784"C:\Windows\System32\mshta.exe" "C:\Users\admin\AppData\Local\Temp\TeamViewer11_Exit.hta" C:\Windows\System32\mshta.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2088"C:\Windows\System32\mshta.exe" "C:\Users\admin\Desktop\TeamViewer11_Exit.hta" C:\Windows\System32\mshta.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3100"C:\Program Files\Internet Explorer\iexplore.exe" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3780"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3100 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
4008"C:\Windows\System32\mshta.exe" "C:\Users\admin\AppData\Local\Temp\TeamViewer11_Exit.hta"C:\Windows\System32\mshta.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
Total events
29 724
Read events
29 029
Write events
464
Delete events
231

Modification events

(PID) Process:(4008) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(4008) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(4008) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(4008) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(4008) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(4008) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyServer
Value:
(PID) Process:(4008) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyOverride
Value:
(PID) Process:(4008) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoConfigURL
Value:
(PID) Process:(4008) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoDetect
Value:
(PID) Process:(4008) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005C010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
0
Suspicious files
7
Text files
8
Unknown types
11

Dropped files

PID
Process
Filename
Type
1784mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:FDC76E964EF1FBBF365833691AB6DAB3
SHA256:423AB01A5B3ED556DF3814AB3EA6E3A38BEF34848A669A100B97AE96F3FFAE43
4008mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C5EF16D6DA310F726628BDE0AA98666Cbinary
MD5:5C6D7AB3EE45C02C8ADEAFFB2C66275D
SHA256:4F496994D42376F7DA7CB1A6BCE3632BC3A7010540615CA97682CD80C396A9C7
4008mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\index[2].htmhtml
MD5:709C4CD1CD15B181E957DA43ADD15716
SHA256:9C20DF8D6C2453AC5893110D71962C7BA82F45AE3AF967FF078241558B28BF80
1784mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850Dbinary
MD5:94C20CE605229FE43B3B3589432E48F0
SHA256:5DCC71E9B3FAD70B52F7270C105535D82B475773BE2B0DC10DA3BD704436E807
1784mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Eder
MD5:C4589D928BDE093A8B3C4AC1B2E9A472
SHA256:C04B0BCC650D2A58D5F3846C775FDD29C4257063540FC79AC1C5043AEEE22FE1
3100iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\favicon[2].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
1784mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\favicon[1].icoimage
MD5:3B1B9A193322B703CED72D7819337CAF
SHA256:9E6F88A0E72D6A6374406BA80280CBCA99E6257E5746BEF21DED5D0EF9A9E0F5
3100iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118Ader
MD5:03286F86A6340EF1EB71162CA877B4CA
SHA256:F6E395EAB531C2331F213B764ECB38E1B4A1E883299D15C1D8B688291E26F20A
3100iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF9637C4DB00086840.TMPgmc
MD5:1C785CF579438F915561EFE97CAF5581
SHA256:2AA19FBB84AF38938619E0E692AE27F58B4C76966AC4EF0F0397954576B52276
3100iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\{470BAFEC-E4EC-11EE-AE0A-12A9866C77DE}.datbinary
MD5:F86B2C1DF53E067D6E2DB31273EBB95F
SHA256:DA5AD953C2FFA237EB95A756C851AF1C8FA7CDD4AC5805B9A93F328286BC799A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
41
DNS requests
21
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4008
mshta.exe
GET
301
104.16.62.16:80
http://www.teamviewer.com/favicon.ico
unknown
—
—
—
1784
mshta.exe
GET
307
20.50.2.7:80
http://client.teamviewer.com/shutdown/index.aspx?lng=en
unknown
—
—
—
1784
mshta.exe
GET
304
87.248.205.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?95686c55b05a20ca
unknown
—
—
—
552
mshta.exe
GET
307
20.50.2.7:80
http://client.teamviewer.com/shutdown/index.aspx?lng=en
unknown
—
—
—
1784
mshta.exe
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
unknown
binary
1.42 Kb
—
1784
mshta.exe
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
unknown
binary
2.18 Kb
—
4008
mshta.exe
GET
200
104.18.38.233:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEBQhuWUyZF1LyUFQW83cEvI%3D
unknown
binary
471 b
—
4008
mshta.exe
GET
307
20.50.2.7:80
http://client.teamviewer.com/shutdown/index.aspx?lng=en
unknown
—
—
—
3100
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
binary
314 b
—
2088
mshta.exe
GET
307
20.50.2.7:80
http://client.teamviewer.com/shutdown/index.aspx?lng=en
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4008
mshta.exe
104.16.62.16:80
www.teamviewer.com
CLOUDFLARENET
—
unknown
4008
mshta.exe
104.16.62.16:443
www.teamviewer.com
CLOUDFLARENET
—
unknown
4008
mshta.exe
20.50.2.7:80
client.teamviewer.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
4008
mshta.exe
104.16.63.16:443
www.teamviewer.com
CLOUDFLARENET
—
unknown
1784
mshta.exe
104.16.62.16:443
www.teamviewer.com
CLOUDFLARENET
—
unknown
1784
mshta.exe
20.50.2.7:80
client.teamviewer.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
1784
mshta.exe
20.50.2.7:443
client.teamviewer.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown

DNS requests

Domain
IP
Reputation
www.teamviewer.com
  • 104.16.62.16
  • 104.16.63.16
unknown
client.teamviewer.com
  • 20.50.2.7
unknown
dns.msftncsi.com
  • 131.107.255.255
unknown
ctldl.windowsupdate.com
  • 87.248.205.0
unknown
ocsp.comodoca.com
  • 104.18.38.233
  • 172.64.149.23
unknown
ocsp.usertrust.com
  • 104.18.38.233
  • 172.64.149.23
unknown
ocsp.sectigo.com
  • 104.18.38.233
  • 172.64.149.23
unknown
api.bing.com
  • 13.107.5.80
unknown
www.bing.com
  • 104.126.37.171
  • 104.126.37.170
  • 104.126.37.131
  • 104.126.37.139
  • 104.126.37.123
  • 104.126.37.136
  • 104.126.37.137
  • 104.126.37.178
  • 104.126.37.163
unknown
ocsp.digicert.com
  • 192.229.221.95
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
TeamViewer11_Exit.hta