Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

17/01/2025, 13:15

250117-qhg8vsypcz 4

17/01/2025, 11:29

250117-nlw53swmar 4

09/01/2025, 21:28

250109-1bc1ns1qgt 4

05/01/2025, 19:25

250105-x44gjstlew 10

Analysis

  • max time kernel
    143s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    05/01/2025, 19:25

General

  • Target

    TeraBox.exe

  • Size

    6.8MB

  • MD5

    cd2539c928a77b46c37a9b4da821fa97

  • SHA1

    a8445e7cd4fc1083f7aa464f5adf9374aefeaa5d

  • SHA256

    74eb8cb2e07ff1eee37441cddb6563bc298da45a738f4f32513da5a82a164bb5

  • SHA512

    82ad8f18409419d52bee433e51929a9d16375ebc12d2ac2d8d9b592783f813e531d052394d5fcdbd4bad6d04993653f8ac7840c6a3048ea30dc8ca7d54ee142f

  • SSDEEP

    98304:8zWVnRcmVlL/Evm5yvvF1wFCIxmKkVaekszxlWPl3JE/nP:6WVnR3KvLH8C49kVaeLdlWwn

Score
5/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TeraBox.exe
    "C:\Users\Admin\AppData\Local\Temp\TeraBox.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2512
    • C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
      "C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=gpu-process --field-trial-handle=1996,2161545047545991150,16246963184711739605,131072 --enable-features=CastMediaRouteProvider --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 6.1; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.30.0.2;PC;PC-Windows;6.1.7601;WindowsTeraBox" --lang=en-US --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --mojo-platform-channel-handle=2004 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2724
    • C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe
      "C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2900
    • C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
      "C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,2161545047545991150,16246963184711739605,131072 --enable-features=CastMediaRouteProvider --lang=en-US --service-sandbox-type=network --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 6.1; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.30.0.2;PC;PC-Windows;6.1.7601;WindowsTeraBox" --lang=en-US --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --mojo-platform-channel-handle=2768 /prefetch:8
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2148
    • C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
      "C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --field-trial-handle=1996,2161545047545991150,16246963184711739605,131072 --enable-features=CastMediaRouteProvider --lang=en-US --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 6.1; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.30.0.2;PC;PC-Windows;6.1.7601;WindowsTeraBox" --disable-extensions --ppapi-flash-path="C:\Users\Admin\AppData\Local\Temp\pepflashplayer.dll" --ppapi-flash-version=20.0.0.306 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3112 /prefetch:1
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2732
    • C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
      "C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --field-trial-handle=1996,2161545047545991150,16246963184711739605,131072 --enable-features=CastMediaRouteProvider --lang=en-US --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 6.1; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.30.0.2;PC;PC-Windows;6.1.7601;WindowsTeraBox" --disable-extensions --ppapi-flash-path="C:\Users\Admin\AppData\Local\Temp\pepflashplayer.dll" --ppapi-flash-version=20.0.0.306 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3124 /prefetch:1
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2624
    • C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
      "C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=gpu-process --field-trial-handle=1996,2161545047545991150,16246963184711739605,131072 --enable-features=CastMediaRouteProvider --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 6.1; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.30.0.2;PC;PC-Windows;6.1.7601;WindowsTeraBox" --lang=en-US --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --mojo-platform-channel-handle=2004 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2152
    • C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
      -PluginId 1502 -PluginPath "C:\Users\Admin\AppData\Local\Temp\kernel.dll" -ChannelName terabox.2512.0.529210535\738296690 -QuitEventName TERABOX_KERNEL_SDK_997C8EFA-C5ED-47A0-A6A8-D139CD6017F4 -TeraBoxId "" -IP "10.127.0.213" -PcGuid "TBIMXV2-O_9668CD2BBA7B471283BF610288A0AA62-C_0-D_3332313238333038313435362020202020202020-M_E67A421F41DB-V_96A6B8AD" -Version "1.30.0.2" -DiskApiHttps 0 -StatisticHttps 0 -ReportCrash 1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2740
    • C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
      "C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe" -PluginId 1502 -PluginPath "C:\Users\Admin\AppData\Local\Temp\kernel.dll" -ChannelName terabox.2512.0.529210535\738296690 -QuitEventName TERABOX_KERNEL_SDK_997C8EFA-C5ED-47A0-A6A8-D139CD6017F4 -TeraBoxId "" -IP "10.127.0.213" -PcGuid "TBIMXV2-O_9668CD2BBA7B471283BF610288A0AA62-C_0-D_3332313238333038313435362020202020202020-M_E67A421F41DB-V_96A6B8AD" -Version "1.30.0.2" -DiskApiHttps 0 -StatisticHttps 0 -ReportCrash 1
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2588
    • C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
      "C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe" -PluginId 1501 -PluginPath "C:\Users\Admin\AppData\Local\Temp\module\VastPlayer\VastPlayer.dll" -ChannelName terabox.2512.1.1849219407\658166098 -QuitEventName TERABOX_VIDEO_PLAY_SDK_997C8EFA-C5ED-47A0-A6A8-D139CD6017F4 -TeraBoxId "" -IP "10.127.0.213" -PcGuid "TBIMXV2-O_9668CD2BBA7B471283BF610288A0AA62-C_0-D_3332313238333038313435362020202020202020-M_E67A421F41DB-V_96A6B8AD" -Version "1.30.0.2" -DiskApiHttps 0 -StatisticHttps 0 -ReportCrash 1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3028
    • C:\Users\Admin\AppData\Local\Temp\AutoUpdate\AutoUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\AutoUpdate\AutoUpdate.exe" -client_info "C:\Users\Admin\AppData\Local\Temp\TeraBox_status" -update_cfg_url "aHR0cHM6Ly90ZXJhYm94LmNvbS9hdXRvdXBkYXRl" -srvwnd 40206 -unlogin
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2364

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6525274CBC2077D43D7D17A33C868C4F

    Filesize

    959B

    MD5

    d5e98140c51869fc462c8975620faa78

    SHA1

    07e032e020b72c3f192f0628a2593a19a70f069e

    SHA256

    5c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e

    SHA512

    9bd164cc4b9ef07386762d3775c6d9528b82d4a9dc508c3040104b8d41cfec52eb0b7e6f8dc47c5021ce2fe3ca542c4ae2b54fd02d76b0eabd9724484621a105

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6525274CBC2077D43D7D17A33C868C4F

    Filesize

    192B

    MD5

    19020f81bfff3682dce3213ffc9734c6

    SHA1

    4c53462d6e80e587ab797b73ac72758266605b15

    SHA256

    ed90a891c55c936eaeb04822d4d1b4a7aab86ba3edbae292a3fa45b62de56ba1

    SHA512

    f1774c2b3c3dd49e4762b794e85893613a666fa732d027351590c098752f4cb791d553e9181f7ba2524b3057e838a2bbcae80541612bac3f17c4a040f9615664

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1f00953dcd06af19e4053b88bc0b8ee0

    SHA1

    6493fe1a8a028f39368533874b7f8bb732450467

    SHA256

    356ba181d72c04f7a1ea674e1a7f6a2bb3e7a04c55ed65c9f860411c1c00bf37

    SHA512

    097256434cfcd57a20849e2acea7cabc5477a3ce79ebdb27e6c37e7c94e6f9fe2fbe96dc4092a046908ec9d5eee8badeb2feff3e08566b0a189086af72e08281

  • C:\Users\Admin\AppData\Local\Temp\AutoUpdate\Download\AutoUpdate.xml

    Filesize

    24KB

    MD5

    906be7fbe146e96496b33a7242d0530e

    SHA1

    ca12256ee07e545481d5976866cac075611a7851

    SHA256

    2062be2948d43f3c4caa5d069714f92e9714c319ea4e3a39defb17a9e0c3315e

    SHA512

    33e17c4a73173a003b8c87d71394f6dc6d8872a280c84c3c7bbfd7b40d3f056f3cd38e52e28f1419bfca91931196fb2387371013c850a66d60fe56ed837c1f5a

  • C:\Users\Admin\AppData\Local\Temp\CabC5A2.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarC67F.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Temp\TeraBox_status

    Filesize

    112B

    MD5

    493d5bf575650b327bb4ecd437e8e70a

    SHA1

    0b5c1c42ee41a55989da60cbac7dd49a592399ab

    SHA256

    9832ea680969caa9ee53577a200829ff56d9c541716646889726e74ce738555c

    SHA512

    6b6216f9b0133b74f0b22efdd13747d0a4cbf96ca924603853859973e1ca5e52c4264dc7a0e549e7a72ec2b3d09d748346deb78f71ed42fbcef833fabc3f150c

  • memory/2512-5-0x0000000000DBA000-0x0000000000DBB000-memory.dmp

    Filesize

    4KB

  • memory/2512-29-0x0000000000DB0000-0x0000000001495000-memory.dmp

    Filesize

    6.9MB

  • memory/2512-837-0x0000000000DB0000-0x0000000001495000-memory.dmp

    Filesize

    6.9MB

  • memory/2512-1564-0x000000000B050000-0x000000000B850000-memory.dmp

    Filesize

    8.0MB

  • memory/2512-1565-0x000000000B050000-0x000000000B850000-memory.dmp

    Filesize

    8.0MB

  • memory/2512-7-0x0000000000DB0000-0x0000000001495000-memory.dmp

    Filesize

    6.9MB

  • memory/2588-1599-0x00000000001A0000-0x00000000001A1000-memory.dmp

    Filesize

    4KB

  • memory/2588-1616-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

  • memory/2588-1603-0x00000000001A0000-0x00000000001A1000-memory.dmp

    Filesize

    4KB

  • memory/2588-1601-0x00000000001A0000-0x00000000001A1000-memory.dmp

    Filesize

    4KB

  • memory/2588-1608-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2588-1606-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2588-1611-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/2588-1613-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/2588-1618-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

  • memory/2588-1596-0x0000000000190000-0x0000000000191000-memory.dmp

    Filesize

    4KB

  • memory/2588-1623-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/2588-1621-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/2588-1624-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB

  • memory/2588-1626-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB

  • memory/2588-1628-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB

  • memory/2588-1629-0x0000000067970000-0x0000000068D9C000-memory.dmp

    Filesize

    20.2MB

  • memory/2588-1598-0x0000000000190000-0x0000000000191000-memory.dmp

    Filesize

    4KB

  • memory/2588-1594-0x0000000000190000-0x0000000000191000-memory.dmp

    Filesize

    4KB