271de5aed87a398dedf889c16d7927e90f07facb4774a073cd4f365073fe51f8

Resubmissions

29-02-2024 21:17

max time kernel
92s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-02-2024 21:17

Target

TeraBox_sl_b_1.28.0.3.exe
Size

85.5MB
MD5

e1aad2c0bfbccec454765e8a030c8856
SHA1

95dd1d5a2a597f27321868d398a9701bcf0b49dc
SHA256

271de5aed87a398dedf889c16d7927e90f07facb4774a073cd4f365073fe51f8
SHA512

6167a3f6f3e405832292491e466b18dc3fded745f4f0bb5d7cb86e00a6bdcd510aa146558ed22a6a00d60ae25befa5ec123d55d65b2a2a2e6ab2d9b2c78d4530
SSDEEP

1572864:HSgue/UMXkXd9CUAMIaulHaT3hxHbpuH1yv7EjDe40REbstaa0ONE71pO2EY8fvp:ygue/Ui+d9tAYulHaT3hxpv70Doubsa

Score

4^/10

Loads dropped DLL 3 IoCs

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 28 IoCs

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsh4037.tmp\NsisInstallUI.dll

Filesize
2.1MB

MD5
7aad5c0c2a4a8e2d4f6c463b63dc0609

SHA1
f257472d5a8e441c9300a9e4dd63f6b559a98bd0

SHA256
03e2ac88d13ab95dbe53b037c458cc57e3ada6153022d9d2a4097aea938f89b6

SHA512
418498124c939a44fb1bf3ce9113bed5cf419475c430e566e93a7c493037f788d82edb4318a4f9f833e1ffb6f3dbeb145ad3ccb82517ecf4cb82bac64dd42ccf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh4037.tmp\System.dll

Filesize
12KB

MD5
8cf2ac271d7679b1d68eefc1ae0c5618

SHA1
7cc1caaa747ee16dc894a600a4256f64fa65a9b8

SHA256
6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba

SHA512
ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh4037.tmp\nsProcessW.dll

Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
memory/3244-17-0x0000000003210000-0x0000000003220000-memory.dmp

Filesize
64KB

Download
memory/3244-126-0x0000000003210000-0x0000000003220000-memory.dmp

Filesize
64KB

Download