Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

6

Static

static

4

Terabox_1.32.0.1.exe

windows7-x64

6

Terabox_1.32.0.1.exe

windows10-2004-x64

4

$PLUGINSDI...UI.dll

windows7-x64

3

$PLUGINSDI...UI.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...sW.dll

windows7-x64

3

$PLUGINSDI...sW.dll

windows10-2004-x64

3

$TEMP/kernel.dll

windows7-x64

3

$TEMP/kernel.dll

windows10-2004-x64

3

AppUtil.dll

windows7-x64

3

AppUtil.dll

windows10-2004-x64

3

AutoUpdate...il.dll

windows7-x64

3

AutoUpdate...il.dll

windows10-2004-x64

3

AutoUpdate...te.exe

windows7-x64

3

AutoUpdate...te.exe

windows10-2004-x64

3

BugReport.exe

windows7-x64

3

BugReport.exe

windows10-2004-x64

5

Bull140U.dll

windows7-x64

3

Bull140U.dll

windows10-2004-x64

3

ChromeNati...st.exe

windows7-x64

1

ChromeNati...st.exe

windows10-2004-x64

3

HelpUtility.exe

windows7-x64

3

HelpUtility.exe

windows10-2004-x64

3

TeraBox.exe

windows7-x64

5

TeraBox.exe

windows10-2004-x64

5

TeraBoxHost.exe

windows7-x64

3

TeraBoxHost.exe

windows10-2004-x64

3

TeraBoxRender.exe

windows7-x64

3

TeraBoxRender.exe

windows10-2004-x64

3

TeraBoxWebService.exe

windows7-x64

3

TeraBoxWebService.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Terabox_1.32.0.1.exe

  • Size

    85.5MB

  • Sample

    241002-tmtn8svglm

  • MD5

    b73657d85fe21f889cdbaf4f1724ff57

  • SHA1

    c10e0f8cf0abda003931c5b27ce2416a076b0478

  • SHA256

    9ed5767db68fb669b3f18a0565cae471ee3800b94a187c4512e5a6691797c511

  • SHA512

    b013b7015e90043e2d8c021d9ea9a87505c36ffcb4619eb5fd06bd0e2c5742c3bc3fddc3a448112def652ab26d5372fee4a2d6f95c3c5ce09a000ffb7bf457f1

  • SSDEEP

    1572864:yBumaBVNigHypMDTKWRhvRL7b3NWPVQ6kzjn:yBumaRigyp8TDRhvRD3APVr6jn

Score
6/10
discoverylinkpdfpersistenceprivilege_escalationqr

Malware Config

Targets

    • Target

      Terabox_1.32.0.1.exe

    • Size

      85.5MB

    • MD5

      b73657d85fe21f889cdbaf4f1724ff57

    • SHA1

      c10e0f8cf0abda003931c5b27ce2416a076b0478

    • SHA256

      9ed5767db68fb669b3f18a0565cae471ee3800b94a187c4512e5a6691797c511

    • SHA512

      b013b7015e90043e2d8c021d9ea9a87505c36ffcb4619eb5fd06bd0e2c5742c3bc3fddc3a448112def652ab26d5372fee4a2d6f95c3c5ce09a000ffb7bf457f1

    • SSDEEP

      1572864:yBumaBVNigHypMDTKWRhvRL7b3NWPVQ6kzjn:yBumaRigyp8TDRhvRD3APVr6jn

    Score
    6/10
    discoverypersistenceprivilege_escalation

    • Adds Run key to start application

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation
    behavioral1behavioral2

    • Target

      $PLUGINSDIR/NsisInstallUI.dll

    • Size

      1.8MB

    • MD5

      69b36f5513e880105fe0994feef54e70

    • SHA1

      57b689dbf36719e17a9f16ad5245c8605d59d4c0

    • SHA256

      531d1191eded0bf76abb40f0367efa2f4e4554123dc2373cf23ee3af983b6d5f

    • SHA512

      c5c09d81a601f8060acf6d9eeaa9e417843bb37b81d5de6b5c70fb404a529c2b906d4bb0995d574dd5a3b4986e3cbe20882aa3e8349e31ff26bdb832692596bd

    • SSDEEP

      24576:PHI9QRkU8s2UDY3r58zoPOfxLcbyTRsr5:fyQn8jUE7HmKbQi

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      8cf2ac271d7679b1d68eefc1ae0c5618

    • SHA1

      7cc1caaa747ee16dc894a600a4256f64fa65a9b8

    • SHA256

      6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba

    • SHA512

      ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3

    • SSDEEP

      192:BenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XB9IwL:B8+Qlt70Fj/lQRY/9VjjlL

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/nsProcessW.dll

    • Size

      4KB

    • MD5

      f0438a894f3a7e01a4aae8d1b5dd0289

    • SHA1

      b058e3fcfb7b550041da16bf10d8837024c38bf6

    • SHA256

      30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

    • SHA512

      f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

    • SSDEEP

      48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      $TEMP/kernel.dll

    • Size

      7.5MB

    • MD5

      3addcb27ffbfeecf0cf1f4980e0b0baf

    • SHA1

      dde794a1bb1fba39d30334b0abce6010092c5d27

    • SHA256

      15c2a89dc69cc532d59c40946f4764aeff284fd01734c2f5783efd60ce14f40a

    • SHA512

      3f2ed545f5f913f645506829192291098a7981afdc761f5cb996c299abe0cd5befc1585b0bafd189a5505b3543cadb340df50fbf9551de4c84b9d193628a082b

    • SSDEEP

      196608:4uoz1uHMDYjG4mJmvoG7nAbyrxpetNvjr:4uozPoumvozbyOr

    Score
    3/10
    discovery
    behavioral10behavioral9

    • Target

      AppUtil.dll

    • Size

      1.5MB

    • MD5

      2b01d156bf9857a17daa46979218fa4c

    • SHA1

      591285020e8525ca51d1021ef8b4267d22b07329

    • SHA256

      b36a5d808f8e64ba0635c72c7c9049453a98edf160083df05a0311dff471030f

    • SHA512

      8afcfdf2d745cc634fa9440b7792b5d1477b1a15838a787aab9f4be4ee5cf0b81e08f4322a96ece37ff31f19fa4bf1f74463b3c908f0d532d1b25cee0d59bd3e

    • SSDEEP

      24576:Wbp2vEtmbb6kMjihOgysnGc7EiHhP2C1oPObTSFXhPq2QW8/Ec+M6e:WbpLtmbe7dSvAObTAXhPq2QWEEc+M6e

    Score
    3/10
    discovery
    behavioral11behavioral12

    • Target

      AutoUpdate/AutoUpdateUtil.dll

    • Size

      198KB

    • MD5

      bf5e773b31cea30b6a8388c719cf0342

    • SHA1

      db300c09fce3c878225146f0ef1d07dcc15e54af

    • SHA256

      7a7e10507d07f8da2866233143e77ce7a3590c745300f08334d8e6308ab39115

    • SHA512

      52d37d86de26635caf46f49fd3c03d2530b57402a3dfbb21e6281c0331ec6e53a730ef0ab55c39d56eaf92308fe2efeb8c1ea4cfe1fed0b03f459fbe450e7a06

    • SSDEEP

      3072:QOq3B8kyfQQC2mC2gbvCsGowP96rH0Vu3b1vJ4gMdTPVj+HO1fn0HdH:/q3BJ4vCCa9Vgxy+Wvol

    Score
    3/10
    discovery
    behavioral13behavioral14

    • Target

      AutoUpdate/Autoupdate.exe

    • Size

      2.8MB

    • MD5

      eec7155c48e1715f5d4eb489b01b717e

    • SHA1

      6e054c9389e20930779e3a3e33250813d4f1115e

    • SHA256

      8b0d7c1ab782922b44e283f958697dd2e3b427b8a6def2efabac3dd380b0fe9f

    • SHA512

      c7c57bf484d90fcaf9b32fd35d435cbac5c64575dbc099f26d069ef8904c0c865bf0b4b72fcbbde335c701f07a9974bd7df8444879caf9fe230e05fe33c9a88e

    • SSDEEP

      49152:Y7L6oPOReVwkTVcXj/SZTLvIkP4qghnX+fw58hG7UBg:Y7NQeZVcX7aIFqgJXMS3

    Score
    3/10
    discovery
    behavioral15behavioral16

    • Target

      BugReport.exe

    • Size

      1.4MB

    • MD5

      af676ec6b1a87284061a679538c1422d

    • SHA1

      9c1d6d32e39bb11c5d649d16096e8ed8b0feaa6a

    • SHA256

      f859fae55c74a33afa97b2536e4116d8ef68090774f5349935f8fe127bc60e09

    • SHA512

      4ee5f972bc9f84e92ba7ed9e5227165a8e9cdc977fb4aa4ba44471cfe7738dce2537edd5652d447444cf92313d9cd1a5846f46ef5ee0854477d09df251752797

    • SSDEEP

      24576:EvlG+2O6nLOdc1G0BNmo5Suno0i1eBU2Jqh5Xok4NJFXuKrAHPr8qFTtK0x5Apv0:EvlzEy0BNmoYuLqHMuKsHPr8qFTNMpv0

    Score
    5/10
    discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral17behavioral18

    • Target

      Bull140U.dll

    • Size

      3.2MB

    • MD5

      aed059c46be32077f7b63ab9349eee76

    • SHA1

      cc84ed3fe63e110f489111d7acefe9effb389aac

    • SHA256

      b7234ea6641f484834412a6edf820a56b7b26257e8780bff70f1c9d7cf02b9ee

    • SHA512

      f829e6d503f88f3cb50c1142a024368ca8cd787a9a85f6955fa5092cb5c06f679bdf5377718f97e1077a89a8606c3698839e344524f9d43629cdf02a4306da27

    • SSDEEP

      49152:LucCrMMcHiNTP0aVY+cTiPA+uo8TWg3QIY0Qk7kcnZwnlmd:kkCtVYfbnosNjI

    Score
    3/10
    discovery
    behavioral19behavioral20

    • Target

      ChromeNativeMessagingHost.exe

    • Size

      126KB

    • MD5

      4c66734f2a19397055268103a85bac36

    • SHA1

      c7edc91d6af3a68180766aa81270a9d7893240b9

    • SHA256

      e64fdae21ca4287e2f8c1b6affa0f58d8d1f9b5fd4f385732e3b69e183ada963

    • SHA512

      ba274d14c95752f2f4c22d0049e184d9506a1361726078e25b633a8d6d42f9e30de3fdf5b1515bee4a3417f0a4fe83f10913be2a28f75af46e304ea60fcba5a4

    • SSDEEP

      1536:e3g0SyOZkuKe2nzGik0QkDYhH5RKA2CEKlXR4LYO1L7nnnvnTPei:e3g0SywqqhH5RKA2k1R48O1fnvT2

    Score
    3/10
    discovery
    behavioral21behavioral22

    • Target

      HelpUtility.exe

    • Size

      148KB

    • MD5

      c5f97adf5bf9e5b8ec6fdb6b22e6649e

    • SHA1

      6786159e95cf4813260210bc1eb02fb5a191c0c7

    • SHA256

      706dce2d0d1dcbcb0695c84c9210ff5be6eab590ab41d77c7adbf15fd7e76257

    • SHA512

      c64b2a68acd8fa28f8c43e012107098de8b5930bd8b3e3665a25f0eb0a4b6a366bada8936bc93c6abf9f8ec57aa0edd657514752a07242b83254eb523322ddb2

    • SSDEEP

      3072:1SiN9E5e6zYYtEuk8Uu93C7aWoHWoFuz3JB0b7QrO1fnlnu:1SiGzV5LYcbdvln

    Score
    3/10
    discovery
    behavioral23behavioral24

    • Target

      TeraBox.exe

    • Size

      6.3MB

    • MD5

      117c541f80c5e6706e722f9431d9fef6

    • SHA1

      d19eb357c221f4802e0c342da69bcdd463400b80

    • SHA256

      e6435157581258557202d04b08ebda3c87d52e5354ccc33825d80673c6b16e30

    • SHA512

      8239044b8b08d5743d09118c5db1a0e5dac8b77482b8d9b6146130df397d4a1b00427b6049bc82f14e6f6cf67a5dc8cdc3387931e28544277fe4fd9c912c0328

    • SSDEEP

      98304:bADvoVCPjkvi5FIQlaFR/Hi+u1QdaTyJqypAVx+lJy8ygx:8DvovjTaeJ3KGl08X

    Score
    5/10
    discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral25behavioral26

    • Target

      TeraBoxHost.exe

    • Size

      379KB

    • MD5

      d239f47d0c68f48b6f695db3ead3ab60

    • SHA1

      e02acf65e2e5d1e33f2916f2bbf49b17cc5aeb8d

    • SHA256

      8453de254c58f4ce51b57a59ce7d5f65af9fc96893db32699832d5f7992fb322

    • SHA512

      6ff9d00fa380109ad6407cef7ad14b728c3c242d294fef9af5145936f53136e634ed9f06bc5c39a9e117e6a3c8a755d2c514da66fb4d24688409fa28a7ff1a7c

    • SSDEEP

      6144:OeciLlYdzhjHdlWQcedXd81grK6GtY1sbXdNPcz+vL:YQq9l+0GTPcz

    Score
    3/10
    discovery
    behavioral27behavioral28

    • Target

      TeraBoxRender.exe

    • Size

      737KB

    • MD5

      68d8a519fd42a57a6baa3342a9e1f18a

    • SHA1

      5d23a6e49be5482c1ffabffb8333c69aa67b3faf

    • SHA256

      c29560d9ee9854f31506b063f21e97af8ad5194c2a749353dbf87c9d8ac5c984

    • SHA512

      1e5cf1b9e8d7190c82d033a1b469111da08aca5631910f45940a5f9b2486ac0f3b85abb974b58b41a767ce5e539a8c77d45861cc79420383f4a2b43cfdf5131c

    • SSDEEP

      6144:uWF5wFO09j7KPQ7QK50g0umuUHlb5xVtq+2zi0VvD6:uBFLj7x8dg0iUHlb5xV12G0

    Score
    3/10
    discovery
    behavioral29behavioral30

    • Target

      TeraBoxWebService.exe

    • Size

      1.1MB

    • MD5

      1e77999ac64fd309a200921c646ef7c0

    • SHA1

      53679977c98b484e24e7d8c0810c695c99c98be5

    • SHA256

      5700ddbcd18561e1bd14c1de034fff226038e36e3bfd2451b5678fd6028d5aab

    • SHA512

      e1cd7332d9aaf6dd1de0cd053e47d54334b6fadd2fdf78fba33420cd9437d3ace463222bd62ef974a68ac0f752d052f73e45a92899e0ff4a926612ee07d34b17

    • SSDEEP

      12288:fzfoNHJMAdkx/GzpOmeSKeYD6ebL5UHk8UZw3ulzQxIH9cAPxTmsE0yl+V:fcNpMZx/SOeYD6KNF8UW3ul7HdPB+lQ

    Score
    3/10
    discovery
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

2
T1546

Change Default File Association

1
T1546.001

Component Object Model Hijacking

1
T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

2
T1546

Change Default File Association

1
T1546.001

Component Object Model Hijacking

1
T1546.015

Defense Evasion

Modify Registry

3
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

qrlinkpdf
Score
4/10

behavioral1

discoverypersistenceprivilege_escalation
Score
6/10

behavioral2

discovery
Score
4/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

discovery
Score
3/10

behavioral16

discovery
Score
3/10

behavioral17

discovery
Score
3/10

behavioral18

discovery
Score
5/10

behavioral19

discovery
Score
3/10

behavioral20

discovery
Score
3/10

behavioral21

Score
1/10

behavioral22

discovery
Score
3/10

behavioral23

discovery
Score
3/10

behavioral24

discovery
Score
3/10

behavioral25

discovery
Score
5/10

behavioral26

discovery
Score
5/10

behavioral27

discovery
Score
3/10

behavioral28

discovery
Score
3/10

behavioral29

discovery
Score
3/10

behavioral30

discovery
Score
3/10

behavioral31

discovery
Score
3/10

behavioral32

discovery
Score
3/10