Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

17/01/2025, 13:15

250117-qhg8vsypcz 4

17/01/2025, 11:29

250117-nlw53swmar 4

09/01/2025, 21:28

250109-1bc1ns1qgt 4

05/01/2025, 19:25

250105-x44gjstlew 10

Analysis

  • max time kernel
    143s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    05/01/2025, 19:25

General

  • Target

    AutoUpdate/Autoupdate.exe

  • Size

    2.8MB

  • MD5

    8ccf980ea54f3605d4360645416ad152

  • SHA1

    99231ce34e0ff68dd417c2246a5ca71d147f96fe

  • SHA256

    40a650cb5d37d6a5b3d8674f50ae3f6e243ac80f595f64d0b72f97854d5f20df

  • SHA512

    644c51032536934bf1ebce9c93e97d201f18fffd21d31fb083853c7084c8fc63a35c02907bf91be0301805103a892c3f03164f5543daa976b22788b364be1a21

  • SSDEEP

    49152:x7L6oPOReVwkTVcXj/SZTLvIkP4qghgZnfw58hG7UB:x7NQeZVcX7aIFqgiZfS

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AutoUpdate\Autoupdate.exe
    "C:\Users\Admin\AppData\Local\Temp\AutoUpdate\Autoupdate.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1052
    • C:\Users\Admin\AppData\Local\Temp\TeraBox.exe
      C:\Users\Admin\AppData\Local\Temp\TeraBox.exe NoUpdate
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2824
      • C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
        "C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=gpu-process --field-trial-handle=1976,7397467728434938708,13181655845129804123,131072 --enable-features=CastMediaRouteProvider --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 6.1; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.30.0.2;PC;PC-Windows;6.1.7601;WindowsTeraBox" --lang=en-US --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --mojo-platform-channel-handle=1984 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1724
      • C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
        "C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1976,7397467728434938708,13181655845129804123,131072 --enable-features=CastMediaRouteProvider --lang=en-US --service-sandbox-type=network --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 6.1; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.30.0.2;PC;PC-Windows;6.1.7601;WindowsTeraBox" --lang=en-US --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --mojo-platform-channel-handle=2376 /prefetch:8
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2312
      • C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
        "C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --field-trial-handle=1976,7397467728434938708,13181655845129804123,131072 --enable-features=CastMediaRouteProvider --lang=en-US --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 6.1; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.30.0.2;PC;PC-Windows;6.1.7601;WindowsTeraBox" --disable-extensions --ppapi-flash-path="C:\Users\Admin\AppData\Local\Temp\pepflashplayer.dll" --ppapi-flash-version=20.0.0.306 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2832 /prefetch:1
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:592
      • C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
        "C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --field-trial-handle=1976,7397467728434938708,13181655845129804123,131072 --enable-features=CastMediaRouteProvider --lang=en-US --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 6.1; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.30.0.2;PC;PC-Windows;6.1.7601;WindowsTeraBox" --disable-extensions --ppapi-flash-path="C:\Users\Admin\AppData\Local\Temp\pepflashplayer.dll" --ppapi-flash-version=20.0.0.306 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2840 /prefetch:1
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:872
      • C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe
        "C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1628
      • C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
        "C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=gpu-process --field-trial-handle=1976,7397467728434938708,13181655845129804123,131072 --enable-features=CastMediaRouteProvider --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 6.1; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.30.0.2;PC;PC-Windows;6.1.7601;WindowsTeraBox" --lang=en-US --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --mojo-platform-channel-handle=2080 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:788
      • C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
        -PluginId 1502 -PluginPath "C:\Users\Admin\AppData\Local\Temp\kernel.dll" -ChannelName terabox.2824.0.667959619\1224988541 -QuitEventName TERABOX_KERNEL_SDK_997C8EFA-C5ED-47A0-A6A8-D139CD6017F4 -TeraBoxId "" -IP "10.127.0.235" -PcGuid "TBIMXV2-O_BB438880CBBD404D83BA00D62AB5DBCA-C_0-D_3332313238333038313435362020202020202020-M_E62D5E492327-V_68378FB8" -Version "1.30.0.2" -DiskApiHttps 0 -StatisticHttps 0 -ReportCrash 1
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3048
      • C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
        "C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe" -PluginId 1502 -PluginPath "C:\Users\Admin\AppData\Local\Temp\kernel.dll" -ChannelName terabox.2824.0.667959619\1224988541 -QuitEventName TERABOX_KERNEL_SDK_997C8EFA-C5ED-47A0-A6A8-D139CD6017F4 -TeraBoxId "" -IP "10.127.0.235" -PcGuid "TBIMXV2-O_BB438880CBBD404D83BA00D62AB5DBCA-C_0-D_3332313238333038313435362020202020202020-M_E62D5E492327-V_68378FB8" -Version "1.30.0.2" -DiskApiHttps 0 -StatisticHttps 0 -ReportCrash 1
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2392
      • C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
        "C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe" -PluginId 1501 -PluginPath "C:\Users\Admin\AppData\Local\Temp\module\VastPlayer\VastPlayer.dll" -ChannelName terabox.2824.1.661021133\1432239655 -QuitEventName TERABOX_VIDEO_PLAY_SDK_997C8EFA-C5ED-47A0-A6A8-D139CD6017F4 -TeraBoxId "" -IP "10.127.0.235" -PcGuid "TBIMXV2-O_BB438880CBBD404D83BA00D62AB5DBCA-C_0-D_3332313238333038313435362020202020202020-M_E62D5E492327-V_68378FB8" -Version "1.30.0.2" -DiskApiHttps 0 -StatisticHttps 0 -ReportCrash 1
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1616

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6525274CBC2077D43D7D17A33C868C4F

    Filesize

    959B

    MD5

    d5e98140c51869fc462c8975620faa78

    SHA1

    07e032e020b72c3f192f0628a2593a19a70f069e

    SHA256

    5c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e

    SHA512

    9bd164cc4b9ef07386762d3775c6d9528b82d4a9dc508c3040104b8d41cfec52eb0b7e6f8dc47c5021ce2fe3ca542c4ae2b54fd02d76b0eabd9724484621a105

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6525274CBC2077D43D7D17A33C868C4F

    Filesize

    192B

    MD5

    c7a9909eb5aa55de03cf7225e37c4c01

    SHA1

    27479f0ef7d21ddf4a001794209163b0171c13d4

    SHA256

    b1aef76ab0fa1abc4ad0d7a288ddf6db88689267f58cba1013aeb54fe38d702a

    SHA512

    16d3a9084079918dcb1068fa47170a356fdefb999fda6c156617e13f291d0868deb337755157083a34816a8c50d5797ff2a07c2c6cbd514226fe43084f336860

  • C:\Users\Admin\AppData\Local\Temp\AutoUpdate\config.ini

    Filesize

    164B

    MD5

    ceca7cb8228df6288c57001dccca3e01

    SHA1

    4bb42d9b5e78fc5437dd2782b523a5344c7740c1

    SHA256

    ebed9436875e76473121a8d96bd4d92baa48efbb1228b77c90d09961714ca513

    SHA512

    3c7e4849e0fa00bd4552c5c5e5db7bb715dcdc57d1cef383d222e8e93ce0e933ef8a4cde19375da82e65800e559d4a602e34ac91ed78d0cd7613b33cdd421f62

  • C:\Users\Admin\AppData\Local\Temp\CabF8D.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar106A.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • memory/1052-0-0x0000000000580000-0x0000000000581000-memory.dmp

    Filesize

    4KB

  • memory/2392-1523-0x0000000000380000-0x0000000000381000-memory.dmp

    Filesize

    4KB

  • memory/2392-1530-0x0000000000390000-0x0000000000391000-memory.dmp

    Filesize

    4KB

  • memory/2392-1553-0x0000000067D60000-0x000000006918C000-memory.dmp

    Filesize

    20.2MB

  • memory/2392-1552-0x00000000004D0000-0x00000000004D1000-memory.dmp

    Filesize

    4KB

  • memory/2392-1550-0x00000000004D0000-0x00000000004D1000-memory.dmp

    Filesize

    4KB

  • memory/2392-1518-0x00000000002D0000-0x00000000002D1000-memory.dmp

    Filesize

    4KB

  • memory/2392-1522-0x00000000002D0000-0x00000000002D1000-memory.dmp

    Filesize

    4KB

  • memory/2392-1520-0x00000000002D0000-0x00000000002D1000-memory.dmp

    Filesize

    4KB

  • memory/2392-1548-0x00000000004D0000-0x00000000004D1000-memory.dmp

    Filesize

    4KB

  • memory/2392-1525-0x0000000000380000-0x0000000000381000-memory.dmp

    Filesize

    4KB

  • memory/2392-1527-0x0000000000380000-0x0000000000381000-memory.dmp

    Filesize

    4KB

  • memory/2392-1545-0x00000000003C0000-0x00000000003C1000-memory.dmp

    Filesize

    4KB

  • memory/2392-1532-0x0000000000390000-0x0000000000391000-memory.dmp

    Filesize

    4KB

  • memory/2392-1537-0x00000000003A0000-0x00000000003A1000-memory.dmp

    Filesize

    4KB

  • memory/2392-1535-0x00000000003A0000-0x00000000003A1000-memory.dmp

    Filesize

    4KB

  • memory/2392-1542-0x00000000003B0000-0x00000000003B1000-memory.dmp

    Filesize

    4KB

  • memory/2392-1540-0x00000000003B0000-0x00000000003B1000-memory.dmp

    Filesize

    4KB

  • memory/2392-1547-0x00000000003C0000-0x00000000003C1000-memory.dmp

    Filesize

    4KB

  • memory/2824-41-0x0000000000840000-0x0000000000F25000-memory.dmp

    Filesize

    6.9MB

  • memory/2824-16-0x000000000084A000-0x000000000084B000-memory.dmp

    Filesize

    4KB

  • memory/2824-1512-0x000000000AEE0000-0x000000000B6E0000-memory.dmp

    Filesize

    8.0MB

  • memory/2824-1511-0x000000000AEE0000-0x000000000B6E0000-memory.dmp

    Filesize

    8.0MB

  • memory/2824-17-0x0000000000840000-0x0000000000F25000-memory.dmp

    Filesize

    6.9MB