Overview

overview

10

Static

static

TeraBox_1.12.5.8.exe

windows7-x64

10

TeraBox_1.12.5.8.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    146s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-es
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-eslocale:es-esos:windows10-2004-x64systemwindows
  • submitted
    30-12-2022 05:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    TeraBox_1.12.5.8.exe

  • Size

    79.6MB

  • MD5

    307ecfb9554db41fd38711f3896275e9

  • SHA1

    562f88a68415dcff6ed771bce542071cf745e6d6

  • SHA256

    adfc360f409f6d91f405ee2f523a65ef53f2fab23df62627ef610bc47ca9c4fa

  • SHA512

    d5570a69103522bb2e541173a1c8ff43737d353dc76ba9ac896b6f55fc112976a8cbf7797c6924aec161b150e616d2c69df3de472664dd48e426a7d96a9cf20b

  • SSDEEP

    1572864:oJrltsdCBfCio2l2y+g3xkGcsQ492KW9tyTzIUjaOA1S1o23q2+XmFg:ylqmfYOrxVce92KCKIUj5bk2g

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TeraBox_1.12.5.8.exe
    "C:\Users\Admin\AppData\Local\Temp\TeraBox_1.12.5.8.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    PID:4344

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsd841B.tmp\NsisInstallUI.dll
    Filesize

    2.0MB

    MD5

    8e0dbee28c2982770d3070d1c5af0a8e

    SHA1

    66a419649dc0c4a1402a6b4994555f3008e0d0c5

    SHA256

    3832b553afb67bf638235229b67bf0f356d2ef30cf27aeb860b4235b96b35d65

    SHA512

    7c6c67363a54799641b83c22bf68ad155379434762e5ee376dfdfede244e1fa9b2f635d0675b0ff6c39ba34c9fc125b358f0e334c505f57af5c375b1dbb30a7c

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\nsd841B.tmp\System.dll
    Filesize

    12KB

    MD5

    8cf2ac271d7679b1d68eefc1ae0c5618

    SHA1

    7cc1caaa747ee16dc894a600a4256f64fa65a9b8

    SHA256

    6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba

    SHA512

    ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\nsd841B.tmp\nsProcessW.dll
    Filesize

    4KB

    MD5

    f0438a894f3a7e01a4aae8d1b5dd0289

    SHA1

    b058e3fcfb7b550041da16bf10d8837024c38bf6

    SHA256

    30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

    SHA512

    f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

    Download Submit