Overview
overview
6Static
static
4Terabox_1.32.0.1.exe
windows7-x64
6Terabox_1.32.0.1.exe
windows10-2004-x64
4$PLUGINSDI...UI.dll
windows7-x64
3$PLUGINSDI...UI.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...sW.dll
windows7-x64
3$PLUGINSDI...sW.dll
windows10-2004-x64
3$TEMP/kernel.dll
windows7-x64
3$TEMP/kernel.dll
windows10-2004-x64
3AppUtil.dll
windows7-x64
3AppUtil.dll
windows10-2004-x64
3AutoUpdate...il.dll
windows7-x64
3AutoUpdate...il.dll
windows10-2004-x64
3AutoUpdate...te.exe
windows7-x64
3AutoUpdate...te.exe
windows10-2004-x64
3BugReport.exe
windows7-x64
3BugReport.exe
windows10-2004-x64
5Bull140U.dll
windows7-x64
3Bull140U.dll
windows10-2004-x64
3ChromeNati...st.exe
windows7-x64
1ChromeNati...st.exe
windows10-2004-x64
3HelpUtility.exe
windows7-x64
3HelpUtility.exe
windows10-2004-x64
3TeraBox.exe
windows7-x64
5TeraBox.exe
windows10-2004-x64
5TeraBoxHost.exe
windows7-x64
3TeraBoxHost.exe
windows10-2004-x64
3TeraBoxRender.exe
windows7-x64
3TeraBoxRender.exe
windows10-2004-x64
3TeraBoxWebService.exe
windows7-x64
3TeraBoxWebService.exe
windows10-2004-x64
3Analysis
-
max time kernel
147s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/10/2024, 16:10
Behavioral task
behavioral1
Sample
Terabox_1.32.0.1.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Terabox_1.32.0.1.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/NsisInstallUI.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NsisInstallUI.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsProcessW.dll
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsProcessW.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$TEMP/kernel.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
$TEMP/kernel.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
AppUtil.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
AppUtil.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
AutoUpdate/AutoUpdateUtil.dll
Resource
win7-20240729-en
Behavioral task
behavioral14
Sample
AutoUpdate/AutoUpdateUtil.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
AutoUpdate/Autoupdate.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
AutoUpdate/Autoupdate.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
BugReport.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
BugReport.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
Bull140U.dll
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
Bull140U.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
ChromeNativeMessagingHost.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
ChromeNativeMessagingHost.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
HelpUtility.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
HelpUtility.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
TeraBox.exe
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
TeraBox.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
TeraBoxHost.exe
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
TeraBoxHost.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
TeraBoxRender.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
TeraBoxRender.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
TeraBoxWebService.exe
Resource
win7-20240708-en
Behavioral task
behavioral32
Sample
TeraBoxWebService.exe
Resource
win10v2004-20240802-en
General
-
Target
AutoUpdate/Autoupdate.exe
-
Size
2.8MB
-
MD5
eec7155c48e1715f5d4eb489b01b717e
-
SHA1
6e054c9389e20930779e3a3e33250813d4f1115e
-
SHA256
8b0d7c1ab782922b44e283f958697dd2e3b427b8a6def2efabac3dd380b0fe9f
-
SHA512
c7c57bf484d90fcaf9b32fd35d435cbac5c64575dbc099f26d069ef8904c0c865bf0b4b72fcbbde335c701f07a9974bd7df8444879caf9fe230e05fe33c9a88e
-
SSDEEP
49152:Y7L6oPOReVwkTVcXj/SZTLvIkP4qghnX+fw58hG7UBg:Y7NQeZVcX7aIFqgJXMS3
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Autoupdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TeraBoxRender.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TeraBoxRender.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TeraBoxRender.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TeraBoxHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TeraBox.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TeraBoxWebService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TeraBoxRender.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TeraBoxRender.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TeraBoxHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TeraBoxHost.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 Autoupdate.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde Autoupdate.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 604 Autoupdate.exe 2788 TeraBox.exe 2788 TeraBox.exe 2788 TeraBox.exe 1572 TeraBoxRender.exe 2804 TeraBoxRender.exe 320 TeraBoxRender.exe 1680 TeraBoxRender.exe 1748 TeraBoxRender.exe 2828 TeraBoxHost.exe 2828 TeraBoxHost.exe 2828 TeraBoxHost.exe 2788 TeraBox.exe 2788 TeraBox.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 604 Autoupdate.exe Token: SeIncreaseQuotaPrivilege 604 Autoupdate.exe Token: SeAssignPrimaryTokenPrivilege 604 Autoupdate.exe Token: SeManageVolumePrivilege 2828 TeraBoxHost.exe Token: SeBackupPrivilege 2828 TeraBoxHost.exe Token: SeSecurityPrivilege 2828 TeraBoxHost.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2788 TeraBox.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2788 TeraBox.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 2788 wrote to memory of 1572 2788 TeraBox.exe 34 PID 2788 wrote to memory of 1572 2788 TeraBox.exe 34 PID 2788 wrote to memory of 1572 2788 TeraBox.exe 34 PID 2788 wrote to memory of 1572 2788 TeraBox.exe 34 PID 2788 wrote to memory of 2804 2788 TeraBox.exe 35 PID 2788 wrote to memory of 2804 2788 TeraBox.exe 35 PID 2788 wrote to memory of 2804 2788 TeraBox.exe 35 PID 2788 wrote to memory of 2804 2788 TeraBox.exe 35 PID 2788 wrote to memory of 2020 2788 TeraBox.exe 36 PID 2788 wrote to memory of 2020 2788 TeraBox.exe 36 PID 2788 wrote to memory of 2020 2788 TeraBox.exe 36 PID 2788 wrote to memory of 2020 2788 TeraBox.exe 36 PID 2788 wrote to memory of 1680 2788 TeraBox.exe 37 PID 2788 wrote to memory of 1680 2788 TeraBox.exe 37 PID 2788 wrote to memory of 1680 2788 TeraBox.exe 37 PID 2788 wrote to memory of 1680 2788 TeraBox.exe 37 PID 2788 wrote to memory of 320 2788 TeraBox.exe 38 PID 2788 wrote to memory of 320 2788 TeraBox.exe 38 PID 2788 wrote to memory of 320 2788 TeraBox.exe 38 PID 2788 wrote to memory of 320 2788 TeraBox.exe 38 PID 2788 wrote to memory of 1748 2788 TeraBox.exe 39 PID 2788 wrote to memory of 1748 2788 TeraBox.exe 39 PID 2788 wrote to memory of 1748 2788 TeraBox.exe 39 PID 2788 wrote to memory of 1748 2788 TeraBox.exe 39 PID 2788 wrote to memory of 2832 2788 TeraBox.exe 42 PID 2788 wrote to memory of 2832 2788 TeraBox.exe 42 PID 2788 wrote to memory of 2832 2788 TeraBox.exe 42 PID 2788 wrote to memory of 2832 2788 TeraBox.exe 42 PID 2788 wrote to memory of 2828 2788 TeraBox.exe 43 PID 2788 wrote to memory of 2828 2788 TeraBox.exe 43 PID 2788 wrote to memory of 2828 2788 TeraBox.exe 43 PID 2788 wrote to memory of 2828 2788 TeraBox.exe 43 PID 2788 wrote to memory of 2400 2788 TeraBox.exe 44 PID 2788 wrote to memory of 2400 2788 TeraBox.exe 44 PID 2788 wrote to memory of 2400 2788 TeraBox.exe 44 PID 2788 wrote to memory of 2400 2788 TeraBox.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\AutoUpdate\Autoupdate.exe"C:\Users\Admin\AppData\Local\Temp\AutoUpdate\Autoupdate.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:604 -
C:\Users\Admin\AppData\Local\Temp\TeraBox.exeC:\Users\Admin\AppData\Local\Temp\TeraBox.exe NoUpdate2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe"C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=gpu-process --field-trial-handle=1972,1015773598528231234,15370391438395265364,131072 --enable-features=CastMediaRouteProvider --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 6.1; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.32.0.1;PC;PC-Windows;6.1.7601;WindowsTeraBox" --lang=en-US --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --mojo-platform-channel-handle=1980 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1572
-
-
C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe"C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1972,1015773598528231234,15370391438395265364,131072 --enable-features=CastMediaRouteProvider --lang=en-US --service-sandbox-type=network --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 6.1; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.32.0.1;PC;PC-Windows;6.1.7601;WindowsTeraBox" --lang=en-US --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --mojo-platform-channel-handle=2616 /prefetch:83⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2804
-
-
C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe"C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2020
-
-
C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe"C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --field-trial-handle=1972,1015773598528231234,15370391438395265364,131072 --enable-features=CastMediaRouteProvider --lang=en-US --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 6.1; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.32.0.1;PC;PC-Windows;6.1.7601;WindowsTeraBox" --disable-extensions --ppapi-flash-path="C:\Users\Admin\AppData\Local\Temp\pepflashplayer.dll" --ppapi-flash-version=20.0.0.306 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2916 /prefetch:13⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1680
-
-
C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe"C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --field-trial-handle=1972,1015773598528231234,15370391438395265364,131072 --enable-features=CastMediaRouteProvider --lang=en-US --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 6.1; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.32.0.1;PC;PC-Windows;6.1.7601;WindowsTeraBox" --disable-extensions --ppapi-flash-path="C:\Users\Admin\AppData\Local\Temp\pepflashplayer.dll" --ppapi-flash-version=20.0.0.306 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2932 /prefetch:13⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:320
-
-
C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe"C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=gpu-process --field-trial-handle=1972,1015773598528231234,15370391438395265364,131072 --enable-features=CastMediaRouteProvider --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 6.1; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.32.0.1;PC;PC-Windows;6.1.7601;WindowsTeraBox" --lang=en-US --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --mojo-platform-channel-handle=1980 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1748
-
-
C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe-PluginId 1502 -PluginPath "C:\Users\Admin\AppData\Local\Temp\kernel.dll" -ChannelName terabox.2788.0.289508701\914896603 -QuitEventName TERABOX_KERNEL_SDK_997C8EFA-C5ED-47A0-A6A8-D139CD6017F4 -TeraBoxId "" -IP "10.127.0.181" -PcGuid "TBIMXV2-O_447953DC7DAA46B794E52BEBD70578A8-C_0-D_3332313238333038313435362020202020202020-M_C6DA928D33CD-V_82E76340" -Version "1.32.0.1" -DiskApiHttps 0 -StatisticHttps 0 -ReportCrash 13⤵
- System Location Discovery: System Language Discovery
PID:2832
-
-
C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe"C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe" -PluginId 1502 -PluginPath "C:\Users\Admin\AppData\Local\Temp\kernel.dll" -ChannelName terabox.2788.0.289508701\914896603 -QuitEventName TERABOX_KERNEL_SDK_997C8EFA-C5ED-47A0-A6A8-D139CD6017F4 -TeraBoxId "" -IP "10.127.0.181" -PcGuid "TBIMXV2-O_447953DC7DAA46B794E52BEBD70578A8-C_0-D_3332313238333038313435362020202020202020-M_C6DA928D33CD-V_82E76340" -Version "1.32.0.1" -DiskApiHttps 0 -StatisticHttps 0 -ReportCrash 13⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2828
-
-
C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe"C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe" -PluginId 1501 -PluginPath "C:\Users\Admin\AppData\Local\Temp\module\VastPlayer\VastPlayer.dll" -ChannelName terabox.2788.1.2011409629\344370079 -QuitEventName TERABOX_VIDEO_PLAY_SDK_997C8EFA-C5ED-47A0-A6A8-D139CD6017F4 -TeraBoxId "" -IP "10.127.0.181" -PcGuid "TBIMXV2-O_447953DC7DAA46B794E52BEBD70578A8-C_0-D_3332313238333038313435362020202020202020-M_C6DA928D33CD-V_82E76340" -Version "1.32.0.1" -DiskApiHttps 0 -StatisticHttps 0 -ReportCrash 13⤵
- System Location Discovery: System Language Discovery
PID:2400
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
959B
MD5d5e98140c51869fc462c8975620faa78
SHA107e032e020b72c3f192f0628a2593a19a70f069e
SHA2565c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e
SHA5129bd164cc4b9ef07386762d3775c6d9528b82d4a9dc508c3040104b8d41cfec52eb0b7e6f8dc47c5021ce2fe3ca542c4ae2b54fd02d76b0eabd9724484621a105
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6525274CBC2077D43D7D17A33C868C4F
Filesize192B
MD59397639ad105f2aa7740ebd455dfaefd
SHA1dbf46dbe526e2e8b85d785050849a8e538632a9f
SHA256d772b9f58200a2811984f4f09e03d57dfb2bcda876ac47dde91e82002022875a
SHA51240b9d6569454a2688455c32acf2b55a592b6b6c53e6d1c91efba3f51b3e570c59a7f5e731e5ad3df593c1d23560ea24bd2cfe3856e264418a1437be04c6bf8a4
-
Filesize
164B
MD51dda42eaff77800d2c8ecd58149952e7
SHA103a7ce7a9c63b9355a65c7f3227e36ccca1e4b38
SHA256698a1555543583b10a2601d7cd82b430ccaeb679c7339d029a7b3b791fbafdec
SHA512ffce7f26ac47ff095c93d16e112cf783c01eb5d9b8ff20d63ecb22150eb88d4de41f6a78a2c1945d49a9a9e5780e2a0f63b9548b07d1f82709198a55ab17dc51
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b