Overview
overview
5Static
static
4TeraBox_1.30.0.2.exe
windows7-x64
4TeraBox_1.30.0.2.exe
windows10-2004-x64
4$PLUGINSDI...UI.dll
windows7-x64
3$PLUGINSDI...UI.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...sW.dll
windows7-x64
3$PLUGINSDI...sW.dll
windows10-2004-x64
3$TEMP/kernel.dll
windows7-x64
1$TEMP/kernel.dll
windows10-2004-x64
1AppUtil.dll
windows7-x64
1AppUtil.dll
windows10-2004-x64
1AutoUpdate...il.dll
windows7-x64
1AutoUpdate...il.dll
windows10-2004-x64
3AutoUpdate...te.exe
windows7-x64
1AutoUpdate...te.exe
windows10-2004-x64
1BugReport.exe
windows7-x64
3BugReport.exe
windows10-2004-x64
5Bull140U.dll
windows7-x64
1Bull140U.dll
windows10-2004-x64
1ChromeNati...st.exe
windows7-x64
1ChromeNati...st.exe
windows10-2004-x64
1HelpUtility.exe
windows7-x64
1HelpUtility.exe
windows10-2004-x64
1TeraBox.exe
windows7-x64
5TeraBox.exe
windows10-2004-x64
5TeraBoxHost.exe
windows7-x64
1TeraBoxHost.exe
windows10-2004-x64
1TeraBoxRender.exe
windows7-x64
1TeraBoxRender.exe
windows10-2004-x64
1TeraBoxWebService.exe
windows7-x64
1TeraBoxWebService.exe
windows10-2004-x64
1Analysis
-
max time kernel
144s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
31-03-2024 16:33
Behavioral task
behavioral1
Sample
TeraBox_1.30.0.2.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
TeraBox_1.30.0.2.exe
Resource
win10v2004-20240319-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/NsisInstallUI.dll
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NsisInstallUI.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsProcessW.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsProcessW.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
$TEMP/kernel.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$TEMP/kernel.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
AppUtil.dll
Resource
win7-20240215-en
Behavioral task
behavioral12
Sample
AppUtil.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
AutoUpdate/AutoUpdateUtil.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
AutoUpdate/AutoUpdateUtil.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
AutoUpdate/Autoupdate.exe
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
AutoUpdate/Autoupdate.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
BugReport.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
BugReport.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
Bull140U.dll
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
Bull140U.dll
Resource
win10v2004-20240319-en
Behavioral task
behavioral21
Sample
ChromeNativeMessagingHost.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
ChromeNativeMessagingHost.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
HelpUtility.exe
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
HelpUtility.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
TeraBox.exe
Resource
win7-20240220-en
Behavioral task
behavioral26
Sample
TeraBox.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
TeraBoxHost.exe
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
TeraBoxHost.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
TeraBoxRender.exe
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
TeraBoxRender.exe
Resource
win10v2004-20240319-en
Behavioral task
behavioral31
Sample
TeraBoxWebService.exe
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
TeraBoxWebService.exe
Resource
win10v2004-20240226-en
General
-
Target
TeraBox.exe
-
Size
6.8MB
-
MD5
cd2539c928a77b46c37a9b4da821fa97
-
SHA1
a8445e7cd4fc1083f7aa464f5adf9374aefeaa5d
-
SHA256
74eb8cb2e07ff1eee37441cddb6563bc298da45a738f4f32513da5a82a164bb5
-
SHA512
82ad8f18409419d52bee433e51929a9d16375ebc12d2ac2d8d9b592783f813e531d052394d5fcdbd4bad6d04993653f8ac7840c6a3048ea30dc8ca7d54ee142f
-
SSDEEP
98304:8zWVnRcmVlL/Evm5yvvF1wFCIxmKkVaekszxlWPl3JE/nP:6WVnR3KvLH8C49kVaeLdlWwn
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
TeraBox.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\International\Geo\Nation TeraBox.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
TeraBox.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 TeraBox.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 TeraBox.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 TeraBox.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 TeraBox.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
TeraBox.exeTeraBoxRender.exeTeraBoxRender.exeTeraBoxRender.exeTeraBoxRender.exeTeraBoxRender.exeTeraBoxHost.exepid process 2784 TeraBox.exe 2784 TeraBox.exe 2540 TeraBoxRender.exe 2812 TeraBoxRender.exe 2548 TeraBoxRender.exe 2660 TeraBoxRender.exe 2308 TeraBoxRender.exe 1696 TeraBoxHost.exe 1696 TeraBoxHost.exe 1696 TeraBoxHost.exe 2784 TeraBox.exe 2784 TeraBox.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
TeraBoxHost.exedescription pid process Token: SeManageVolumePrivilege 1696 TeraBoxHost.exe Token: SeBackupPrivilege 1696 TeraBoxHost.exe Token: SeSecurityPrivilege 1696 TeraBoxHost.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
TeraBox.exepid process 2784 TeraBox.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
TeraBox.exepid process 2784 TeraBox.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
TeraBox.exedescription pid process target process PID 2784 wrote to memory of 2540 2784 TeraBox.exe TeraBoxRender.exe PID 2784 wrote to memory of 2540 2784 TeraBox.exe TeraBoxRender.exe PID 2784 wrote to memory of 2540 2784 TeraBox.exe TeraBoxRender.exe PID 2784 wrote to memory of 2540 2784 TeraBox.exe TeraBoxRender.exe PID 2784 wrote to memory of 2812 2784 TeraBox.exe TeraBoxRender.exe PID 2784 wrote to memory of 2812 2784 TeraBox.exe TeraBoxRender.exe PID 2784 wrote to memory of 2812 2784 TeraBox.exe TeraBoxRender.exe PID 2784 wrote to memory of 2812 2784 TeraBox.exe TeraBoxRender.exe PID 2784 wrote to memory of 2168 2784 TeraBox.exe TeraBoxWebService.exe PID 2784 wrote to memory of 2168 2784 TeraBox.exe TeraBoxWebService.exe PID 2784 wrote to memory of 2168 2784 TeraBox.exe TeraBoxWebService.exe PID 2784 wrote to memory of 2168 2784 TeraBox.exe TeraBoxWebService.exe PID 2784 wrote to memory of 2548 2784 TeraBox.exe TeraBoxRender.exe PID 2784 wrote to memory of 2548 2784 TeraBox.exe TeraBoxRender.exe PID 2784 wrote to memory of 2548 2784 TeraBox.exe TeraBoxRender.exe PID 2784 wrote to memory of 2548 2784 TeraBox.exe TeraBoxRender.exe PID 2784 wrote to memory of 2660 2784 TeraBox.exe TeraBoxRender.exe PID 2784 wrote to memory of 2660 2784 TeraBox.exe TeraBoxRender.exe PID 2784 wrote to memory of 2660 2784 TeraBox.exe TeraBoxRender.exe PID 2784 wrote to memory of 2660 2784 TeraBox.exe TeraBoxRender.exe PID 2784 wrote to memory of 2308 2784 TeraBox.exe TeraBoxRender.exe PID 2784 wrote to memory of 2308 2784 TeraBox.exe TeraBoxRender.exe PID 2784 wrote to memory of 2308 2784 TeraBox.exe TeraBoxRender.exe PID 2784 wrote to memory of 2308 2784 TeraBox.exe TeraBoxRender.exe PID 2784 wrote to memory of 972 2784 TeraBox.exe TeraBoxHost.exe PID 2784 wrote to memory of 972 2784 TeraBox.exe TeraBoxHost.exe PID 2784 wrote to memory of 972 2784 TeraBox.exe TeraBoxHost.exe PID 2784 wrote to memory of 972 2784 TeraBox.exe TeraBoxHost.exe PID 2784 wrote to memory of 1696 2784 TeraBox.exe TeraBoxHost.exe PID 2784 wrote to memory of 1696 2784 TeraBox.exe TeraBoxHost.exe PID 2784 wrote to memory of 1696 2784 TeraBox.exe TeraBoxHost.exe PID 2784 wrote to memory of 1696 2784 TeraBox.exe TeraBoxHost.exe PID 2784 wrote to memory of 692 2784 TeraBox.exe TeraBoxHost.exe PID 2784 wrote to memory of 692 2784 TeraBox.exe TeraBoxHost.exe PID 2784 wrote to memory of 692 2784 TeraBox.exe TeraBoxHost.exe PID 2784 wrote to memory of 692 2784 TeraBox.exe TeraBoxHost.exe PID 2784 wrote to memory of 908 2784 TeraBox.exe AutoUpdate.exe PID 2784 wrote to memory of 908 2784 TeraBox.exe AutoUpdate.exe PID 2784 wrote to memory of 908 2784 TeraBox.exe AutoUpdate.exe PID 2784 wrote to memory of 908 2784 TeraBox.exe AutoUpdate.exe PID 2784 wrote to memory of 908 2784 TeraBox.exe AutoUpdate.exe PID 2784 wrote to memory of 908 2784 TeraBox.exe AutoUpdate.exe PID 2784 wrote to memory of 908 2784 TeraBox.exe AutoUpdate.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\TeraBox.exe"C:\Users\Admin\AppData\Local\Temp\TeraBox.exe"1⤵
- Checks computer location settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe"C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=gpu-process --field-trial-handle=2004,6816175084339473979,2898641024467457375,131072 --enable-features=CastMediaRouteProvider --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 6.1; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.30.0.2;PC;PC-Windows;6.1.7601;WindowsTeraBox" --lang=en-US --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --mojo-platform-channel-handle=2012 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe"C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,6816175084339473979,2898641024467457375,131072 --enable-features=CastMediaRouteProvider --lang=en-US --service-sandbox-type=network --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 6.1; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.30.0.2;PC;PC-Windows;6.1.7601;WindowsTeraBox" --lang=en-US --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --mojo-platform-channel-handle=2912 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe"C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe"2⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe"C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --field-trial-handle=2004,6816175084339473979,2898641024467457375,131072 --enable-features=CastMediaRouteProvider --lang=en-US --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 6.1; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.30.0.2;PC;PC-Windows;6.1.7601;WindowsTeraBox" --disable-extensions --ppapi-flash-path="C:\Users\Admin\AppData\Local\Temp\pepflashplayer.dll" --ppapi-flash-version=20.0.0.306 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵
- Suspicious behavior: EnumeratesProcesses
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe"C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --field-trial-handle=2004,6816175084339473979,2898641024467457375,131072 --enable-features=CastMediaRouteProvider --lang=en-US --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 6.1; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.30.0.2;PC;PC-Windows;6.1.7601;WindowsTeraBox" --disable-extensions --ppapi-flash-path="C:\Users\Admin\AppData\Local\Temp\pepflashplayer.dll" --ppapi-flash-version=20.0.0.306 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵
- Suspicious behavior: EnumeratesProcesses
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe"C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=gpu-process --field-trial-handle=2004,6816175084339473979,2898641024467457375,131072 --enable-features=CastMediaRouteProvider --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 6.1; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.30.0.2;PC;PC-Windows;6.1.7601;WindowsTeraBox" --lang=en-US --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --mojo-platform-channel-handle=2076 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe-PluginId 1502 -PluginPath "C:\Users\Admin\AppData\Local\Temp\kernel.dll" -ChannelName terabox.2784.0.1051558144\1530927846 -QuitEventName TERABOX_KERNEL_SDK_997C8EFA-C5ED-47A0-A6A8-D139CD6017F4 -TeraBoxId "" -IP "10.127.1.66" -PcGuid "TBIMXV2-O_5D35C2DA204C4C498B15006E83FE3D71-C_0-D_4d51303031302033202020202020202020202020-M_62A279F6AF31-V_DC7ED3BE" -Version "1.30.0.2" -DiskApiHttps 0 -StatisticHttps 0 -ReportCrash 12⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe"C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe" -PluginId 1502 -PluginPath "C:\Users\Admin\AppData\Local\Temp\kernel.dll" -ChannelName terabox.2784.0.1051558144\1530927846 -QuitEventName TERABOX_KERNEL_SDK_997C8EFA-C5ED-47A0-A6A8-D139CD6017F4 -TeraBoxId "" -IP "10.127.1.66" -PcGuid "TBIMXV2-O_5D35C2DA204C4C498B15006E83FE3D71-C_0-D_4d51303031302033202020202020202020202020-M_62A279F6AF31-V_DC7ED3BE" -Version "1.30.0.2" -DiskApiHttps 0 -StatisticHttps 0 -ReportCrash 12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe"C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe" -PluginId 1501 -PluginPath "C:\Users\Admin\AppData\Local\Temp\module\VastPlayer\VastPlayer.dll" -ChannelName terabox.2784.1.428538331\1663127011 -QuitEventName TERABOX_VIDEO_PLAY_SDK_997C8EFA-C5ED-47A0-A6A8-D139CD6017F4 -TeraBoxId "" -IP "10.127.1.66" -PcGuid "TBIMXV2-O_5D35C2DA204C4C498B15006E83FE3D71-C_0-D_4d51303031302033202020202020202020202020-M_62A279F6AF31-V_DC7ED3BE" -Version "1.30.0.2" -DiskApiHttps 0 -StatisticHttps 0 -ReportCrash 12⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\AutoUpdate\AutoUpdate.exe"C:\Users\Admin\AppData\Local\Temp\AutoUpdate\AutoUpdate.exe" -client_info "C:\Users\Admin\AppData\Local\Temp\TeraBox_status" -update_cfg_url "aHR0cHM6Ly90ZXJhYm94LmNvbS9hdXRvdXBkYXRl" -srvwnd 40182 -unlogin2⤵PID:908
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
959B
MD5d5e98140c51869fc462c8975620faa78
SHA107e032e020b72c3f192f0628a2593a19a70f069e
SHA2565c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e
SHA5129bd164cc4b9ef07386762d3775c6d9528b82d4a9dc508c3040104b8d41cfec52eb0b7e6f8dc47c5021ce2fe3ca542c4ae2b54fd02d76b0eabd9724484621a105
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6525274CBC2077D43D7D17A33C868C4F
Filesize192B
MD51c3a89dd0bb8e119cf3f65cef5dde403
SHA12c429665535df69f04e9ed0319052dcd92d284b8
SHA256fdb8e7493ded472d9545a044c9fae3b9d9961d4de1e15c29be6af4293da8f3e0
SHA5122e664df5fdb536d083d224378eacbba1a94862618778f16edc00422109c93a910677b9fd08b2b07e5406ea44e22a00a4ba60db632e3cd742f231811a72fd9735
-
Filesize
22KB
MD550e940a33557749e8967787951b0b1f3
SHA15569074d7d12835f7f4a04b93f1b91b3b3da3500
SHA2564a0fe43edb114b8df1ea5088966f71c35091e89a96894738cc61dbe59fe63559
SHA5124011d8a6619d9b9c002dbbea6cc70db7dc894760ad9938ecf63f32e717d49b9e4f983a411d31e2cb6a30aede455ebe60db74aa2f22497667793635b2b33f56b0
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
111B
MD52e98d2a75c1324f831b3982b310782ac
SHA148b52810d933c27052d509dc5dd67d25b4d45165
SHA25664a5d6b7d6bb0b5de5cdc7f32df1cdefdad082d1d33fd683e2ffb6d09fb083e9
SHA5123d8362a3e6425a9ea74f1cb17a4872b1b1348bba60e505c373763eb2b172563eeeeb93b7e5da56f70c2063d11fd54e7cafe655d66f75382ba086b77b6ee87ae4