Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Classes\projects\shell\open\command] '' = '"%LOCALAPPDATA%\Programs\teamwork-projects-desktop\Teamwork Desktop.exe" "%1"'
Malicious functions
Injects code into
the following user processes:
- teamwork desktop.exe
Modifies file system
Creates the following files
- %TEMP%\nsx196.tmp\system.dll
- %APPDATA%\teamwork desktop\partitions\projects\code cache\wasm\index-dir\temp-index
- %APPDATA%\teamwork desktop\partitions\projects\code cache\js\index-dir\temp-index
- %APPDATA%\teamwork desktop\code cache\wasm\index
- %APPDATA%\teamwork desktop\code cache\js\index
- %APPDATA%\teamwork desktop\local storage\leveldb\log
- %APPDATA%\teamwork desktop\local storage\leveldb\000001.dbtmp
- %APPDATA%\teamwork desktop\local storage\leveldb\manifest-000001
- %APPDATA%\teamwork desktop\partitions\projects\code cache\wasm\index
- %APPDATA%\teamwork desktop\partitions\projects\code cache\js\index
- %APPDATA%\teamwork desktop\partitions\projects\local storage\leveldb\log
- %APPDATA%\teamwork desktop\partitions\projects\local storage\leveldb\000001.dbtmp
- %APPDATA%\teamwork desktop\partitions\projects\local storage\leveldb\manifest-000001
- %HOMEPATH%\desktop\teamwork desktop.lnk
- %TEMP%\nsx196.tmp\winshell.dll
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\uninstall teamwork desktop.exe
- %APPDATA%\teamwork desktop\code cache\wasm\index-dir\temp-index
- %LOCALAPPDATA%\teamwork-projects-desktop-updater\package.7z
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\vulkan-1.dll
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\vk_swiftshader.dll
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\swiftshader\libglesv2.dll
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\swiftshader\libegl.dll
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\resources\elevate.exe
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\libglesv2.dll
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\libegl.dll
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\ffmpeg.dll
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\d3dcompiler_47.dll
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\teamwork desktop.exe
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\vk_swiftshader_icd.json
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\v8_context_snapshot.bin
- %APPDATA%\microsoft\windows\start menu\programs\teamwork desktop.lnk
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\pt-pt.pak
- %APPDATA%\teamwork desktop\gpucache\index
- %APPDATA%\teamwork desktop\4ca29336-7876-4a7e-b676-264c2e3d1df3.tmp
- %APPDATA%\teamwork desktop\8756b19e-4206-436e-ae67-81d0b5648620.tmp
- %APPDATA%\teamwork desktop\ce31e155-98e1-4c10-a09f-9188f7c9e191.tmp
- %APPDATA%\teamwork desktop\partitions\projects\b4551f98-f56a-43e3-97a0-8b7bfe1b5acf.tmp
- %APPDATA%\teamwork desktop\partitions\projects\cache\f_000001
- %APPDATA%\teamwork desktop\en-us-9-0.bdic
- %APPDATA%\teamwork desktop\cache\f_000001
- %APPDATA%\teamwork desktop\dictionaries\en-us-9-0.bdic
- %APPDATA%\teamwork desktop\fontlookuptablecache\font_unique_name_table.pb
- %APPDATA%\teamwork desktop\.updaterid
- %APPDATA%\teamwork desktop\partitions\projects\gpucache\data_3
- %APPDATA%\teamwork desktop\partitions\projects\gpucache\data_2
- %APPDATA%\teamwork desktop\partitions\projects\gpucache\data_1
- %APPDATA%\teamwork desktop\partitions\projects\gpucache\data_0
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\snapshot_blob.bin
- %APPDATA%\teamwork desktop\code cache\js\index-dir\temp-index
- %APPDATA%\teamwork desktop\cache\data_2
- %APPDATA%\teamwork desktop\cache\data_1
- %APPDATA%\teamwork desktop\cache\data_0
- %APPDATA%\teamwork desktop\cache\index
- %APPDATA%\teamwork desktop\partitions\projects\cache\data_3
- %APPDATA%\teamwork desktop\partitions\projects\cache\data_2
- %APPDATA%\teamwork desktop\partitions\projects\cache\data_1
- %APPDATA%\teamwork desktop\partitions\projects\cache\data_0
- %APPDATA%\teamwork desktop\partitions\projects\cache\index
- %APPDATA%\teamwork desktop\partitions\projects\cookies
- %APPDATA%\teamwork desktop\partitions\projects\cookies-journal
- %APPDATA%\teamwork desktop\gpucache\data_3
- %APPDATA%\teamwork desktop\gpucache\data_2
- %APPDATA%\teamwork desktop\gpucache\data_1
- %APPDATA%\teamwork desktop\cache\data_3
- %APPDATA%\teamwork desktop\gpucache\data_0
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\resources\app.asar
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\resources\app-update.yml
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\resources.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\bn.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\fr.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\fil.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\fi.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\fa.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\et.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\es.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\es-419.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\en-us.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\en-gb.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\el.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\de.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\da.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\cs.pak
- %APPDATA%\teamwork desktop\partitions\projects\ed7dc9d7-6250-4349-ab7d-5c7abe793592.tmp
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\he.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\bg.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\ar.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\am.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\icudtl.dat
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\chrome_200_percent.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\chrome_100_percent.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\licenses.chromium.html
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\license.electron.txt
- %TEMP%\nsx196.tmp\nsis7z.dll
- %TEMP%\nsx196.tmp\package.7z
- %TEMP%\nsx196.tmp\inetc.dll
- %TEMP%\nsx196.tmp\nsprocess.dll
- %TEMP%\nsx196.tmp\spiderbanner.dll
- %TEMP%\nsx196.tmp\stdutils.dll
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\ca.pak
- %APPDATA%\teamwork desktop\partitions\projects\gpucache\index
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\hi.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\id.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\hr.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\zh-tw.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\zh-cn.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\vi.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\uk.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\tr.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\th.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\te.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\ta.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\sw.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\sv.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\sr.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\sl.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\sk.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\hu.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\ru.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\gu.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\pt-br.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\pl.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\nl.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\nb.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\ms.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\mr.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\ml.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\lv.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\lt.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\ko.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\kn.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\ja.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\it.pak
- %LOCALAPPDATA%\programs\teamwork-projects-desktop\locales\ro.pak
- %TEMP%\3632f0b5-e636-4af3-8264-8a2f9d533b22.tmp
Deletes the following files
- %TEMP%\nsx196.tmp\inetc.dll
- %TEMP%\nsx196.tmp\nsis7z.dll
- %TEMP%\nsx196.tmp\nsprocess.dll
- %TEMP%\nsx196.tmp\spiderbanner.dll
- %TEMP%\nsx196.tmp\stdutils.dll
- %TEMP%\nsx196.tmp\system.dll
- %TEMP%\nsx196.tmp\winshell.dll
- %APPDATA%\teamwork desktop\preferences~rf8649b.tmp
- %APPDATA%\teamwork desktop\partitions\projects\code cache\js\index-dir\the-real-index~rf92396.tmp
- %APPDATA%\teamwork desktop\partitions\projects\network persistent state~rf94172.tmp
- %APPDATA%\teamwork desktop\network persistent state~rf941df.tmp
Moves the following files
- from %TEMP%\nsx196.tmp\package.7z to %LOCALAPPDATA%\teamwork-projects-desktop-updater\package.7z
- from %APPDATA%\teamwork desktop\partitions\projects\local storage\leveldb\000001.dbtmp to %APPDATA%\teamwork desktop\partitions\projects\local storage\leveldb\current
- from %APPDATA%\teamwork desktop\local storage\leveldb\000001.dbtmp to %APPDATA%\teamwork desktop\local storage\leveldb\current
- from %APPDATA%\teamwork desktop\partitions\projects\code cache\js\index-dir\temp-index to %APPDATA%\teamwork desktop\partitions\projects\code cache\js\index-dir\the-real-index
- from %APPDATA%\teamwork desktop\partitions\projects\code cache\wasm\index-dir\temp-index to %APPDATA%\teamwork desktop\partitions\projects\code cache\wasm\index-dir\the-real-index
- from %APPDATA%\teamwork desktop\code cache\js\index-dir\temp-index to %APPDATA%\teamwork desktop\code cache\js\index-dir\the-real-index
- from %APPDATA%\teamwork desktop\code cache\wasm\index-dir\temp-index to %APPDATA%\teamwork desktop\code cache\wasm\index-dir\the-real-index
- from %APPDATA%\teamwork desktop\partitions\projects\b4551f98-f56a-43e3-97a0-8b7bfe1b5acf.tmp to %APPDATA%\teamwork desktop\partitions\projects\preferences
- from %APPDATA%\teamwork desktop\ce31e155-98e1-4c10-a09f-9188f7c9e191.tmp to %APPDATA%\teamwork desktop\preferences
- from %APPDATA%\teamwork desktop\preferences to %APPDATA%\teamwork desktop\preferences~rf8649b.tmp
- from %APPDATA%\teamwork desktop\4ca29336-7876-4a7e-b676-264c2e3d1df3.tmp to %APPDATA%\teamwork desktop\network persistent state
- from %APPDATA%\teamwork desktop\partitions\projects\ed7dc9d7-6250-4349-ab7d-5c7abe793592.tmp to %APPDATA%\teamwork desktop\partitions\projects\network persistent state
- from %APPDATA%\teamwork desktop\partitions\projects\code cache\js\index-dir\the-real-index to %APPDATA%\teamwork desktop\partitions\projects\code cache\js\index-dir\the-real-index~rf92396.tmp
- from %APPDATA%\teamwork desktop\partitions\projects\network persistent state to %APPDATA%\teamwork desktop\partitions\projects\network persistent state~rf94172.tmp
- from %APPDATA%\teamwork desktop\network persistent state to %APPDATA%\teamwork desktop\network persistent state~rf941df.tmp
Substitutes the following files
- %APPDATA%\teamwork desktop\preferences
- %APPDATA%\teamwork desktop\partitions\projects\code cache\js\index-dir\the-real-index
Network activity
Connects to
- 'tw#####.s3.amazonaws.com':443
- 'microsoft.com':80
- 're####ctor.gvt1.com':443
- 'te###ork.com':443
- 'x.##2.us':80
TCP
- 'tw#####.s3.amazonaws.com':443
- 're####ctor.gvt1.com':443
- 'r5######aigzrn7l.gvt1.com':443
- 'r5######i5h7lner.gvt1.com':443
- 'te###ork.com':443
UDP
- DNS ASK tw#####.s3.amazonaws.com
- DNS ASK microsoft.com
- DNS ASK re####ctor.gvt1.com
- DNS ASK r5######aigzrn7l.gvt1.com
- DNS ASK r5######i5h7lner.gvt1.com
- DNS ASK te###ork.com
- DNS ASK x.##2.us
- 'r5######aigzrn7l.gvt1.com':443
- 'r5######i5h7lner.gvt1.com':443
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: ''
- ClassName: 'Chrome_MessageWindow' WindowName: '%APPDATA%\Teamwork Desktop'
Creates and executes the following
- '%LOCALAPPDATA%\programs\teamwork-projects-desktop\teamwork desktop.exe'
- '%LOCALAPPDATA%\programs\teamwork-projects-desktop\teamwork desktop.exe' --type=gpu-process --field-trial-handle=1000,3542330579425399539,8626535815179128064,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSi...
- '%LOCALAPPDATA%\programs\teamwork-projects-desktop\teamwork desktop.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1000,3542330579425399539,8626535815179128064,131072 --enable-features=WebComponentsV0Enabled --disable-featur...
- '%LOCALAPPDATA%\programs\teamwork-projects-desktop\teamwork desktop.exe' --type=renderer --field-trial-handle=1000,3542330579425399539,8626535815179128064,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteB...
