URL:

https://download.teamviewer.com/full

Full analysis: https://app.any.run/tasks/a2b67a12-c3fe-44bc-aec5-afb6137ff057
Verdict: Malicious activity
Analysis date: September 01, 2020, 08:31:32
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
teamviewer
Indicators:
MD5:

D4342D29DA28FBBA7BD8936A3D35B360

SHA1:

D98F476C68FF21DA1D9A18AB8ECC58B3AC56C575

SHA256:

1C15C2A589037C2FD5346B3E9D9B230195AA1655CA041F10B1D9D37AE16F9B5E

SSDEEP:

3:N8SElkTJip:2SK7p

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • TeamViewer_Setup.exe (PID: 2472)
      • tv_w32.exe (PID: 1452)
      • TeamViewer_.exe (PID: 272)
      • TeamViewer_.exe (PID: 2544)

    • Loads dropped or rewritten executable

      • TeamViewer_.exe (PID: 272)
      • TeamViewer_.exe (PID: 2544)
      • TeamViewer.exe (PID: 3636)
      • TeamViewer.exe (PID: 2832)
      • TeamViewer_Setup.exe (PID: 2472)
      • tv_w32.exe (PID: 1452)

    • Changes settings of System certificates

      • TeamViewer.exe (PID: 2832)

    • Actions looks like stealing of personal data

      • TeamViewer.exe (PID: 2832)

    • TEAMVIEWER was detected

      • TeamViewer.exe (PID: 2832)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 1488)
      • iexplore.exe (PID: 1892)
      • TeamViewer_Setup.exe (PID: 2472)
      • TeamViewer_.exe (PID: 272)
      • TeamViewer_.exe (PID: 2544)

    • Application launched itself

      • TeamViewer_.exe (PID: 272)
      • TeamViewer.exe (PID: 3636)

    • Creates files in the user directory

      • TeamViewer.exe (PID: 3636)

    • Adds / modifies Windows certificates

      • TeamViewer.exe (PID: 2832)

    • Starts Internet Explorer

      • TeamViewer.exe (PID: 2832)

  • INFO

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 1892)
      • iexplore.exe (PID: 1488)
      • iexplore.exe (PID: 636)
      • iexplore.exe (PID: 2732)

    • Changes internet zones settings

      • iexplore.exe (PID: 1488)
      • iexplore.exe (PID: 636)

    • Manual execution by user

      • rundll32.exe (PID: 384)

    • Application launched itself

      • iexplore.exe (PID: 1488)
      • iexplore.exe (PID: 636)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 1892)
      • iexplore.exe (PID: 1488)
      • TeamViewer.exe (PID: 2832)

    • Creates files in the user directory

      • iexplore.exe (PID: 1892)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 1488)

    • Changes settings of System certificates

      • iexplore.exe (PID: 1488)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 1488)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
55
Monitored processes
11
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start iexplore.exe iexplore.exe rundll32.exe no specs teamviewer_setup.exe teamviewer_.exe teamviewer_.exe teamviewer.exe no specs #TEAMVIEWER teamviewer.exe tv_w32.exe iexplore.exe no specs iexplore.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
272"C:\Users\admin\AppData\Local\Temp\TeamViewer\TeamViewer_.exe" C:\Users\admin\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
TeamViewer_Setup.exe
User:
admin
Company:
TeamViewer
Integrity Level:
MEDIUM
Description:
TeamViewer Remote Control Application Installer
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\teamviewer\teamviewer_.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
384"C:\Windows\System32\rundll32.exe" C:\Windows\System32\shell32.dll,Control_RunDLL C:\Windows\System32\main.cplC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
636"C:\Program Files\Internet Explorer\iexplore.exe" https://www.teamviewer.com/documents/?lng=en&version=15.9.4%20NI&cid=146015264C:\Program Files\Internet Explorer\iexplore.exe—TeamViewer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1452"C:\Users\admin\AppData\Local\Temp\TeamViewer\tv_w32.exe" --action hooks --log C:\Users\admin\AppData\Roaming\TeamViewer\TeamViewer15_Logfile.log C:\Users\admin\AppData\Local\Temp\TeamViewer\tv_w32.exe
TeamViewer.exe
User:
SYSTEM
Company:
TeamViewer Germany GmbH
Integrity Level:
SYSTEM
Description:
TeamViewer
Exit code:
0
Version:
15.9.4.0
Modules
Images
c:\users\admin\appdata\local\temp\teamviewer\tv_w32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\advapi32.dll
1488"C:\Program Files\Internet Explorer\iexplore.exe" https://download.teamviewer.com/fullC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
1892"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1488 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2472"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\TeamViewer_Setup.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\TeamViewer_Setup.exe
iexplore.exe
User:
admin
Company:
TeamViewer Germany GmbH
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\po2hn1x2\teamviewer_setup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2544C:\Users\admin\AppData\Local\Temp\TeamViewer\TeamViewer_.exe /RUNC:\Users\admin\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
TeamViewer_.exe
User:
admin
Company:
TeamViewer
Integrity Level:
MEDIUM
Description:
TeamViewer Remote Control Application Installer
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\teamviewer\teamviewer_.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2732"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:636 CREDAT:275457 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\iertutil.dll
2832"C:\Users\admin\AppData\Local\Temp\TeamViewer\TeamViewer.exe" --noInstallation --dreC:\Users\admin\AppData\Local\Temp\TeamViewer\TeamViewer.exe
TeamViewer.exe
User:
admin
Company:
TeamViewer Germany GmbH
Integrity Level:
HIGH
Description:
TeamViewer
Exit code:
0
Version:
15.9.4.0
Modules
Images
c:\users\admin\appdata\local\temp\teamviewer\teamviewer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\user32.dll
Total events
2 427
Read events
1 895
Write events
524
Delete events
8

Modification events

(PID) Process:(1488) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
1721625684
(PID) Process:(1488) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30834746
(PID) Process:(1488) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1488) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1488) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1488) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(1488) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(1488) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000A3000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(1488) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(1488) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
66
Suspicious files
11
Text files
71
Unknown types
8

Dropped files

PID
Process
Filename
Type
1488iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
1892iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab357C.tmp —
MD5:—
SHA256:—
1892iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar357D.tmp —
MD5:—
SHA256:—
1892iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\TeamViewer_Setup[1].exe —
MD5:—
SHA256:—
1488iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF8FB3F1D5643B705D.TMP —
MD5:—
SHA256:—
1488iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\TeamViewer_Setup.exe.831a6a3.partial:Zone.Identifier —
MD5:—
SHA256:—
1892iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_CCF564BE5A3C924B17DDEBDEB5236E12der
MD5:—
SHA256:—
1892iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AF3BA1CDD96BBC740C9CE3754F348BED_3088340646E0C95720E43FF6BD5A298Dder
MD5:—
SHA256:—
1892iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_CCF564BE5A3C924B17DDEBDEB5236E12binary
MD5:—
SHA256:—
1892iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AF3BA1CDD96BBC740C9CE3754F348BED_3088340646E0C95720E43FF6BD5A298Dbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
12
DNS requests
13
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1892
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAilokbNS1yMg9cCtLurU0k%3D
US
der
471 b
whitelisted
1892
iexplore.exe
GET
200
93.184.220.29:80
http://status.rapidssl.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRhhZrQET0hvbSHUJmNfBKqR%2FiT7wQUU8oXWfxrwAMhLxqu5KqoHIJW2nUCEAIyZi%2FaW%2FZd4Wt7ckxxAEg%3D
US
der
471 b
shared
1892
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAilokbNS1yMg9cCtLurU0k%3D
US
der
471 b
whitelisted
1892
iexplore.exe
GET
200
93.184.220.29:80
http://status.rapidssl.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRhhZrQET0hvbSHUJmNfBKqR%2FiT7wQUU8oXWfxrwAMhLxqu5KqoHIJW2nUCEAIyZi%2FaW%2FZd4Wt7ckxxAEg%3D
US
der
471 b
shared
1488
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2832
TeamViewer.exe
52.168.20.22:443
client.teamviewer.com
Microsoft Corporation
US
whitelisted
1892
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2832
TeamViewer.exe
217.146.21.139:5938
router10.teamviewer.com
ANEXIA Internetdienstleistungs GmbH
LU
suspicious
1892
iexplore.exe
104.16.62.16:443
download.teamviewer.com
Cloudflare Inc
US
shared
1488
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
download.teamviewer.com
  • 104.16.62.16
  • 104.16.63.16
shared
api.bing.com
  • 13.107.13.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
status.rapidssl.com
  • 93.184.220.29
shared
dl.teamviewer.com
  • 104.16.62.16
  • 104.16.63.16
whitelisted
router10.teamviewer.com
  • 217.146.21.139
  • 213.227.168.151
  • 188.172.198.138
  • 217.146.23.150
  • 159.8.229.238
suspicious
www.teamviewer.com
  • 104.16.62.16
  • 104.16.63.16
shared
client.teamviewer.com
  • 52.168.20.22
shared

Threats

PID
Process
Class
Message
2832
TeamViewer.exe
Potential Corporate Privacy Violation
REMOTE [PTsecurity] TeamViewer
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://download.teamviewer.com/full