Analysis

  • max time kernel
    145s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    19-06-2024 20:26

General

  • Target

    AutoUpdate/Autoupdate.exe

  • Size

    2.8MB

  • MD5

    94c5b0443f1c39b71b22931509bf1985

  • SHA1

    35cb27275187b8c0da72d00b8551aaf2c1059794

  • SHA256

    7260c2623c4277b045d97e87a677d41bbfd11647109a4d648c311310889cebfb

  • SHA512

    a08a897095239f367c51b36724f54aa961420e07f76185075902efd7ee023eb8f0a6c8b49769158fbf9372377028182515995b0ac0b7277e12a2640a3e6a3721

  • SSDEEP

    49152:57L6oPOReVwkTVcXj/SZTLvIkP4qgh7Xufw58hG7UB:57NQeZVcX7aIFqgtX8S

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AutoUpdate\Autoupdate.exe
    "C:\Users\Admin\AppData\Local\Temp\AutoUpdate\Autoupdate.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1244
    • C:\Users\Admin\AppData\Local\Temp\TeraBox.exe
      C:\Users\Admin\AppData\Local\Temp\TeraBox.exe NoUpdate
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1932
      • C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
        "C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=gpu-process --field-trial-handle=2028,732539179716811645,6399189127447276855,131072 --enable-features=CastMediaRouteProvider --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 6.1; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.31.0.1;PC;PC-Windows;6.1.7601;WindowsTeraBox" --lang=en-US --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --mojo-platform-channel-handle=2040 /prefetch:2
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2856
      • C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
        "C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,732539179716811645,6399189127447276855,131072 --enable-features=CastMediaRouteProvider --lang=en-US --service-sandbox-type=network --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 6.1; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.31.0.1;PC;PC-Windows;6.1.7601;WindowsTeraBox" --lang=en-US --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --mojo-platform-channel-handle=3040 /prefetch:8
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1344
      • C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
        "C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --field-trial-handle=2028,732539179716811645,6399189127447276855,131072 --enable-features=CastMediaRouteProvider --lang=en-US --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 6.1; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.31.0.1;PC;PC-Windows;6.1.7601;WindowsTeraBox" --disable-extensions --ppapi-flash-path="C:\Users\Admin\AppData\Local\Temp\pepflashplayer.dll" --ppapi-flash-version=20.0.0.306 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1976
      • C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
        "C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --field-trial-handle=2028,732539179716811645,6399189127447276855,131072 --enable-features=CastMediaRouteProvider --lang=en-US --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 6.1; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.31.0.1;PC;PC-Windows;6.1.7601;WindowsTeraBox" --disable-extensions --ppapi-flash-path="C:\Users\Admin\AppData\Local\Temp\pepflashplayer.dll" --ppapi-flash-version=20.0.0.306 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:288
      • C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe
        "C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe"
        3⤵
          PID:1924
        • C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
          "C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=gpu-process --field-trial-handle=2028,732539179716811645,6399189127447276855,131072 --enable-features=CastMediaRouteProvider --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 6.1; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.31.0.1;PC;PC-Windows;6.1.7601;WindowsTeraBox" --lang=en-US --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --mojo-platform-channel-handle=2180 /prefetch:2
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1376
        • C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
          -PluginId 1502 -PluginPath "C:\Users\Admin\AppData\Local\Temp\kernel.dll" -ChannelName terabox.1932.0.553451165\183935057 -QuitEventName TERABOX_KERNEL_SDK_997C8EFA-C5ED-47A0-A6A8-D139CD6017F4 -TeraBoxId "" -IP "10.127.1.114" -PcGuid "TBIMXV2-O_226EC872D85D4F408B1ADEBAE8F71DB2-C_0-D_4444303031302033202020202020202020202020-M_FE0070C7CB2B-V_91B18CF6" -Version "1.31.0.1" -DiskApiHttps 0 -StatisticHttps 0 -ReportCrash 1
          3⤵
            PID:1188
          • C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
            "C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe" -PluginId 1502 -PluginPath "C:\Users\Admin\AppData\Local\Temp\kernel.dll" -ChannelName terabox.1932.0.553451165\183935057 -QuitEventName TERABOX_KERNEL_SDK_997C8EFA-C5ED-47A0-A6A8-D139CD6017F4 -TeraBoxId "" -IP "10.127.1.114" -PcGuid "TBIMXV2-O_226EC872D85D4F408B1ADEBAE8F71DB2-C_0-D_4444303031302033202020202020202020202020-M_FE0070C7CB2B-V_91B18CF6" -Version "1.31.0.1" -DiskApiHttps 0 -StatisticHttps 0 -ReportCrash 1
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2044
          • C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
            "C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe" -PluginId 1501 -PluginPath "C:\Users\Admin\AppData\Local\Temp\module\VastPlayer\VastPlayer.dll" -ChannelName terabox.1932.1.611277149\88016828 -QuitEventName TERABOX_VIDEO_PLAY_SDK_997C8EFA-C5ED-47A0-A6A8-D139CD6017F4 -TeraBoxId "" -IP "10.127.1.114" -PcGuid "TBIMXV2-O_226EC872D85D4F408B1ADEBAE8F71DB2-C_0-D_4444303031302033202020202020202020202020-M_FE0070C7CB2B-V_91B18CF6" -Version "1.31.0.1" -DiskApiHttps 0 -StatisticHttps 0 -ReportCrash 1
            3⤵
              PID:2088

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6525274CBC2077D43D7D17A33C868C4F

          Filesize

          959B

          MD5

          d5e98140c51869fc462c8975620faa78

          SHA1

          07e032e020b72c3f192f0628a2593a19a70f069e

          SHA256

          5c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e

          SHA512

          9bd164cc4b9ef07386762d3775c6d9528b82d4a9dc508c3040104b8d41cfec52eb0b7e6f8dc47c5021ce2fe3ca542c4ae2b54fd02d76b0eabd9724484621a105

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6525274CBC2077D43D7D17A33C868C4F

          Filesize

          192B

          MD5

          30d17002ebac0bc81c334d87e78701c3

          SHA1

          a2660ec8742ab940e7e705facf8755e5d27cc448

          SHA256

          339dbe16c9f733f045d704eca04a4f43c267b15b4d0504e37fc2a99ecea41387

          SHA512

          119bcca827ea93cb8fed73d74d9d0bd1e0e1090f082869ad2cf4a19e1cb50755f57ba737f49213a74c7c727a1830cad351e054a5ce7f6f6bf13c4d1a18286287

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          88d5656f316cc8d64011d101924abcba

          SHA1

          1175e853790bfe6406f9905b471f488be2738a72

          SHA256

          4e4b1dc183b156e84f0b769408788d08b45ef9ded4ed461a9c43b4669c4943c3

          SHA512

          b815a68500e39b343f5377994dd27963515a394e9663688ce904e6a8023cb1b838feb0ca08131f118b5f05b7c6c388f0565d8bba1aba267a84896e73e70b343c

        • C:\Users\Admin\AppData\Local\Temp\AutoUpdate\config.ini

          Filesize

          164B

          MD5

          718e0118cbf9724812a82f0f790a6821

          SHA1

          bd2e9f045255c3805349aed979b2e57ee340340c

          SHA256

          0b3d0c699349b77605b4cf8f0641fd517eeeda73b721e5a57b75eb54d271de7a

          SHA512

          e0da1d77d94afb258402ab04ff0478322f51b7736abc662783ca7841432920ef91326620932725dc5923547a112abbbe58ae6cbe8dcf4086e0add28bf5f219ae

        • C:\Users\Admin\AppData\Local\Temp\Cab2B56.tmp

          Filesize

          67KB

          MD5

          2d3dcf90f6c99f47e7593ea250c9e749

          SHA1

          51be82be4a272669983313565b4940d4b1385237

          SHA256

          8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

          SHA512

          9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

        • C:\Users\Admin\AppData\Local\Temp\Tar3AEF.tmp

          Filesize

          160KB

          MD5

          7186ad693b8ad9444401bd9bcd2217c2

          SHA1

          5c28ca10a650f6026b0df4737078fa4197f3bac1

          SHA256

          9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

          SHA512

          135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

        • memory/1244-0-0x0000000000370000-0x0000000000371000-memory.dmp

          Filesize

          4KB

        • memory/1932-46-0x000000000105A000-0x000000000105B000-memory.dmp

          Filesize

          4KB

        • memory/1932-47-0x0000000001050000-0x00000000016B1000-memory.dmp

          Filesize

          6.4MB

        • memory/1932-66-0x0000000001050000-0x00000000016B1000-memory.dmp

          Filesize

          6.4MB

        • memory/1932-1205-0x0000000001050000-0x00000000016B1000-memory.dmp

          Filesize

          6.4MB

        • memory/2044-1407-0x00000000001A0000-0x00000000001A1000-memory.dmp

          Filesize

          4KB

        • memory/2044-1421-0x00000000001C0000-0x00000000001C1000-memory.dmp

          Filesize

          4KB

        • memory/2044-1406-0x0000000000190000-0x0000000000191000-memory.dmp

          Filesize

          4KB

        • memory/2044-1402-0x0000000000190000-0x0000000000191000-memory.dmp

          Filesize

          4KB

        • memory/2044-1409-0x00000000001A0000-0x00000000001A1000-memory.dmp

          Filesize

          4KB

        • memory/2044-1411-0x00000000001A0000-0x00000000001A1000-memory.dmp

          Filesize

          4KB

        • memory/2044-1414-0x00000000001B0000-0x00000000001B1000-memory.dmp

          Filesize

          4KB

        • memory/2044-1416-0x00000000001B0000-0x00000000001B1000-memory.dmp

          Filesize

          4KB

        • memory/2044-1419-0x00000000001C0000-0x00000000001C1000-memory.dmp

          Filesize

          4KB

        • memory/2044-1404-0x0000000000190000-0x0000000000191000-memory.dmp

          Filesize

          4KB

        • memory/2044-1424-0x00000000003D0000-0x00000000003D1000-memory.dmp

          Filesize

          4KB

        • memory/2044-1426-0x00000000003D0000-0x00000000003D1000-memory.dmp

          Filesize

          4KB

        • memory/2044-1429-0x00000000003E0000-0x00000000003E1000-memory.dmp

          Filesize

          4KB

        • memory/2044-1431-0x00000000003E0000-0x00000000003E1000-memory.dmp

          Filesize

          4KB

        • memory/2044-1432-0x00000000003F0000-0x00000000003F1000-memory.dmp

          Filesize

          4KB

        • memory/2044-1436-0x00000000003F0000-0x00000000003F1000-memory.dmp

          Filesize

          4KB

        • memory/2044-1434-0x00000000003F0000-0x00000000003F1000-memory.dmp

          Filesize

          4KB

        • memory/2044-1437-0x0000000068790000-0x0000000069BBC000-memory.dmp

          Filesize

          20.2MB