Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/12/2024, 13:47

General

  • Target

    TeraBox_sl_b_1.35.0.4.exe

  • Size

    85.7MB

  • MD5

    6a91158eae5293fc435649efd565f0ad

  • SHA1

    1988fdb9e28454f3fbc63e01f24475516924e735

  • SHA256

    0ec7ca9a453c0fe7ac1b91dbae74a8b77e788c490b65365896d2d319128431d6

  • SHA512

    8fe16d57cf354e09674d5160a363ee74748850628251d36b88069dfa41ce96e1b6d7510bf630f7106c0cd4293cbb88fd950e3add2520981b6cc0f0bffd0aedc4

  • SSDEEP

    1572864:UytVxQY8XDSbjByvcK//fz2+f6feJF7+DGAndY8KXkX3w4Y1X8iwGrZd0Zr75Nuw:UytXQebjYcg/fiUTAngkXyB8ixvwu

Score
4/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.35.0.4.exe
    "C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.35.0.4.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:1372

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsy8EE4.tmp\NsisInstallUI.dll

    Filesize

    1.8MB

    MD5

    e430cf975738925189d99853a1ac7861

    SHA1

    a4ecd06fea113aed02b4801f4f4471fe15a6216e

    SHA256

    2ee1c094a8428dda38976745e823d1106c0dba2b1f25ccefcb1dc759a0cd5491

    SHA512

    83c8dd4f4c6c11a902012256faab6be30acc7b52810d68a254fb3b8884a98f9b8a3ab9b66b845e9d075a97a800875c9a99387a01d10abd89a05a9cc16cfe0312

  • C:\Users\Admin\AppData\Local\Temp\nsy8EE4.tmp\System.dll

    Filesize

    12KB

    MD5

    8cf2ac271d7679b1d68eefc1ae0c5618

    SHA1

    7cc1caaa747ee16dc894a600a4256f64fa65a9b8

    SHA256

    6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba

    SHA512

    ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3

  • C:\Users\Admin\AppData\Local\Temp\nsy8EE4.tmp\nsProcessW.dll

    Filesize

    4KB

    MD5

    f0438a894f3a7e01a4aae8d1b5dd0289

    SHA1

    b058e3fcfb7b550041da16bf10d8837024c38bf6

    SHA256

    30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

    SHA512

    f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

  • memory/1372-17-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

    Filesize

    64KB

  • memory/1372-113-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

    Filesize

    64KB