File name:

TeamViewer11_Exit.hta

Full analysis: https://app.any.run/tasks/dee0895d-1b9e-4037-9236-70c3d1c850a2
Verdict: Malicious activity
Analysis date: March 18, 2024, 05:55:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/octet-stream
File info: data
MD5:

2703F13A3876449D71A78182793D883A

SHA1:

90D25BA6E6F61FE9A1A8AF67444021A415C30FEF

SHA256:

1A1FF5EC6C6C7150124555B7714A4BD62C8C9BF96FECF1931EE20891DA06BEF4

SSDEEP:

24:p37rysGWgjN9TLk/4TolcTCTVcxBOU9m9TnG10taZl5B1S:pf1GVN9Hkq4mCTVPtGitab5BE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads the Internet Settings

      • mshta.exe (PID: 1784)
      • mshta.exe (PID: 4008)
      • mshta.exe (PID: 552)
      • mshta.exe (PID: 2088)

    • Adds/modifies Windows certificates

      • mshta.exe (PID: 1784)
      • mshta.exe (PID: 4008)
      • mshta.exe (PID: 2088)
      • mshta.exe (PID: 552)

  • INFO

    • Reads Internet Explorer settings

      • mshta.exe (PID: 4008)
      • mshta.exe (PID: 1784)
      • mshta.exe (PID: 552)
      • mshta.exe (PID: 2088)

    • Manual execution by a user

      • mshta.exe (PID: 1784)
      • mshta.exe (PID: 552)
      • mshta.exe (PID: 2088)

    • Checks proxy server information

      • mshta.exe (PID: 4008)
      • mshta.exe (PID: 1784)
      • mshta.exe (PID: 552)
      • mshta.exe (PID: 2088)

    • Application launched itself

      • iexplore.exe (PID: 3100)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
7
Malicious processes
0
Suspicious processes
4

Behavior graph

Click at the process to see the details
start mshta.exe mshta.exe mshta.exe iexplore.exe iexplore.exe no specs iexplore.exe mshta.exe

Process information

PID
CMD
Path
Indicators
Parent process
548"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3100 CREDAT:2233609 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
552"C:\Windows\System32\mshta.exe" "C:\Users\admin\Desktop\TeamViewer11_Exit.hta" C:\Windows\System32\mshta.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
1784"C:\Windows\System32\mshta.exe" "C:\Users\admin\AppData\Local\Temp\TeamViewer11_Exit.hta" C:\Windows\System32\mshta.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2088"C:\Windows\System32\mshta.exe" "C:\Users\admin\Desktop\TeamViewer11_Exit.hta" C:\Windows\System32\mshta.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3100"C:\Program Files\Internet Explorer\iexplore.exe" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3780"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3100 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
4008"C:\Windows\System32\mshta.exe" "C:\Users\admin\AppData\Local\Temp\TeamViewer11_Exit.hta"C:\Windows\System32\mshta.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
Total events
29 724
Read events
29 029
Write events
464
Delete events
231

Modification events

(PID) Process:(4008) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(4008) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(4008) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(4008) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(4008) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(4008) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyServer
Value:
(PID) Process:(4008) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyOverride
Value:
(PID) Process:(4008) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoConfigURL
Value:
(PID) Process:(4008) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoDetect
Value:
(PID) Process:(4008) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005C010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
0
Suspicious files
7
Text files
8
Unknown types
11

Dropped files

PID
Process
Filename
Type
1784mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850Dbinary
MD5:94C20CE605229FE43B3B3589432E48F0
SHA256:5DCC71E9B3FAD70B52F7270C105535D82B475773BE2B0DC10DA3BD704436E807
3100iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118Ader
MD5:03286F86A6340EF1EB71162CA877B4CA
SHA256:F6E395EAB531C2331F213B764ECB38E1B4A1E883299D15C1D8B688291E26F20A
3100iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{470BAFE9-E4EC-11EE-AE0A-12A9866C77DE}.datbinary
MD5:08491EC85D71919F1E6DDACA10E804BC
SHA256:7D1E0B5B19D15191AD630CB9363B9D3BCBBE458CE98107256752B084A7312246
1784mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:31495E170113315ECD2D296C38E796E4
SHA256:D889E5F651DD0697E9A120A3C1A88C4BB0C100B26F4C6CDA3C51E84BFD1BA39F
1784mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\index[1].htmhtml
MD5:2D21874099B2E58A5A18B7098FF80F36
SHA256:2236DAAB42DD69551AAC36CE3BC90F1AB0DE9A6457BD652CE730A6D46B19DEF0
1784mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850Dbinary
MD5:65DC821FDDBE67920385ACBAD8827260
SHA256:FA7F499ADFB3A4B12FFEB3A38DBE0ED7CE8B23DF7BA3FCC10DDBC71DE58D5EB2
4008mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\index[2].htmhtml
MD5:709C4CD1CD15B181E957DA43ADD15716
SHA256:9C20DF8D6C2453AC5893110D71962C7BA82F45AE3AF967FF078241558B28BF80
4008mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C5EF16D6DA310F726628BDE0AA98666Cbinary
MD5:951540B93464A2FC01DC98A39DC6CF79
SHA256:4B5D496868FA2CF5786D0F74005E11830D034524EA3518DED01747CF5DB85A95
4008mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C5EF16D6DA310F726628BDE0AA98666Cbinary
MD5:5C6D7AB3EE45C02C8ADEAFFB2C66275D
SHA256:4F496994D42376F7DA7CB1A6BCE3632BC3A7010540615CA97682CD80C396A9C7
1784mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\favicon[1].icoimage
MD5:3B1B9A193322B703CED72D7819337CAF
SHA256:9E6F88A0E72D6A6374406BA80280CBCA99E6257E5746BEF21DED5D0EF9A9E0F5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
41
DNS requests
21
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4008
mshta.exe
GET
301
104.16.62.16:80
http://www.teamviewer.com/favicon.ico
unknown
—
—
unknown
1784
mshta.exe
GET
307
20.50.2.7:80
http://client.teamviewer.com/shutdown/index.aspx?lng=en
unknown
—
—
unknown
1784
mshta.exe
GET
304
87.248.205.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?95686c55b05a20ca
unknown
—
—
unknown
552
mshta.exe
GET
307
20.50.2.7:80
http://client.teamviewer.com/shutdown/index.aspx?lng=en
unknown
—
—
unknown
1784
mshta.exe
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
unknown
binary
1.42 Kb
unknown
1784
mshta.exe
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
unknown
binary
2.18 Kb
unknown
4008
mshta.exe
GET
200
104.18.38.233:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEBQhuWUyZF1LyUFQW83cEvI%3D
unknown
binary
471 b
unknown
4008
mshta.exe
GET
307
20.50.2.7:80
http://client.teamviewer.com/shutdown/index.aspx?lng=en
unknown
—
—
unknown
2088
mshta.exe
GET
307
20.50.2.7:80
http://client.teamviewer.com/shutdown/index.aspx?lng=en
unknown
—
—
unknown
3100
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
binary
314 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4008
mshta.exe
104.16.62.16:80
www.teamviewer.com
CLOUDFLARENET
—
shared
4008
mshta.exe
104.16.62.16:443
www.teamviewer.com
CLOUDFLARENET
—
shared
4008
mshta.exe
20.50.2.7:80
client.teamviewer.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
4008
mshta.exe
104.16.63.16:443
www.teamviewer.com
CLOUDFLARENET
—
shared
1784
mshta.exe
104.16.62.16:443
www.teamviewer.com
CLOUDFLARENET
—
shared
1784
mshta.exe
20.50.2.7:80
client.teamviewer.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
1784
mshta.exe
20.50.2.7:443
client.teamviewer.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown

DNS requests

Domain
IP
Reputation
www.teamviewer.com
  • 104.16.62.16
  • 104.16.63.16
shared
client.teamviewer.com
  • 20.50.2.7
shared
dns.msftncsi.com
  • 131.107.255.255
shared
ctldl.windowsupdate.com
  • 87.248.205.0
whitelisted
ocsp.comodoca.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
ocsp.usertrust.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
ocsp.sectigo.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 104.126.37.171
  • 104.126.37.170
  • 104.126.37.131
  • 104.126.37.139
  • 104.126.37.123
  • 104.126.37.136
  • 104.126.37.137
  • 104.126.37.178
  • 104.126.37.163
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
TeamViewer11_Exit.hta