Analysis

  • max time kernel
    143s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240319-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-03-2024 16:33

General

  • Target

    TeraBox_1.30.0.2.exe

  • Size

    85.5MB

  • MD5

    b2bc076b79b0396934a117c51b4eb58c

  • SHA1

    d842893ce4a9ca332aa0f43323112c9edf227599

  • SHA256

    721582ffe4abce8f7488a3b31c4c948b8ba9f439065437c6c9bd1c950f9446b9

  • SHA512

    a8838d54a24e60c718b5bb5cca626a1eda5201243a21fbd60b793af599734c7be7bfa0603011b9a1ab8c9f74fa0f00ca434bf7b2229c8e8cbc259d7c8258ae29

  • SSDEEP

    1572864:3lMIOWHKFpO9wbJ8ZY6RrAU82sycuVrwAWMSe65sc5MhQj7ejBgc+dWMZVtZK2XE:3ljHn9w9J6RuPTANzSj5saMoejt+wMZW

Score
4/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TeraBox_1.30.0.2.exe
    "C:\Users\Admin\AppData\Local\Temp\TeraBox_1.30.0.2.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    PID:3940
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3928 --field-trial-handle=2536,i,8161505972217706694,705854963991409854,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:4556

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\nsm7E98.tmp\NsisInstallUI.dll

      Filesize

      2.1MB

      MD5

      93a820253b303c46ca5b6ba1e9ccec8d

      SHA1

      e691405b2906037008aa9e21817f579bf6c122ed

      SHA256

      6291ca8ac49760517bc06ed1f180d98ecd98b7993b32bcf6e350aa3993a42937

      SHA512

      708bce83e878a2a7c3dbbd888db5916e553c641915aaa182629612e8981c77a6110390569755566490615aaf6f5b4a637f47c4e8a103a158f42284b8c3bf1c6a

    • C:\Users\Admin\AppData\Local\Temp\nsm7E98.tmp\System.dll

      Filesize

      12KB

      MD5

      8cf2ac271d7679b1d68eefc1ae0c5618

      SHA1

      7cc1caaa747ee16dc894a600a4256f64fa65a9b8

      SHA256

      6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba

      SHA512

      ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3

    • C:\Users\Admin\AppData\Local\Temp\nsm7E98.tmp\nsProcessW.dll

      Filesize

      4KB

      MD5

      f0438a894f3a7e01a4aae8d1b5dd0289

      SHA1

      b058e3fcfb7b550041da16bf10d8837024c38bf6

      SHA256

      30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

      SHA512

      f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

    • memory/3940-17-0x0000000003AF0000-0x0000000003B00000-memory.dmp

      Filesize

      64KB

    • memory/3940-126-0x0000000003AF0000-0x0000000003B00000-memory.dmp

      Filesize

      64KB