Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

17/01/2025, 13:15

250117-qhg8vsypcz 4

17/01/2025, 11:29

250117-nlw53swmar 4

09/01/2025, 21:28

250109-1bc1ns1qgt 4

05/01/2025, 19:25

250105-x44gjstlew 10

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/01/2025, 19:25

General

  • Target

    TeraBox.exe

  • Size

    6.8MB

  • MD5

    cd2539c928a77b46c37a9b4da821fa97

  • SHA1

    a8445e7cd4fc1083f7aa464f5adf9374aefeaa5d

  • SHA256

    74eb8cb2e07ff1eee37441cddb6563bc298da45a738f4f32513da5a82a164bb5

  • SHA512

    82ad8f18409419d52bee433e51929a9d16375ebc12d2ac2d8d9b592783f813e531d052394d5fcdbd4bad6d04993653f8ac7840c6a3048ea30dc8ca7d54ee142f

  • SSDEEP

    98304:8zWVnRcmVlL/Evm5yvvF1wFCIxmKkVaekszxlWPl3JE/nP:6WVnR3KvLH8C49kVaeLdlWwn

Score
5/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TeraBox.exe
    "C:\Users\Admin\AppData\Local\Temp\TeraBox.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3884
    • C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
      "C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=gpu-process --field-trial-handle=2588,17098330449500167,4113563945902679210,131072 --enable-features=CastMediaRouteProvider --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 10.0; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.30.0.2;PC;PC-Windows;10.0.19041;WindowsTeraBox" --lang=en-US --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --mojo-platform-channel-handle=2584 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      PID:1752
    • C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
      "C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2588,17098330449500167,4113563945902679210,131072 --enable-features=CastMediaRouteProvider --lang=en-US --service-sandbox-type=network --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 10.0; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.30.0.2;PC;PC-Windows;10.0.19041;WindowsTeraBox" --lang=en-US --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --mojo-platform-channel-handle=2812 /prefetch:8
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:5020
    • C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
      "C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --field-trial-handle=2588,17098330449500167,4113563945902679210,131072 --enable-features=CastMediaRouteProvider --lang=en-US --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 10.0; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.30.0.2;PC;PC-Windows;10.0.19041;WindowsTeraBox" --disable-extensions --ppapi-flash-path="C:\Users\Admin\AppData\Local\Temp\pepflashplayer.dll" --ppapi-flash-version=20.0.0.306 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:1
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4992
    • C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
      "C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --field-trial-handle=2588,17098330449500167,4113563945902679210,131072 --enable-features=CastMediaRouteProvider --lang=en-US --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 10.0; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.30.0.2;PC;PC-Windows;10.0.19041;WindowsTeraBox" --disable-extensions --ppapi-flash-path="C:\Users\Admin\AppData\Local\Temp\pepflashplayer.dll" --ppapi-flash-version=20.0.0.306 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2232
    • C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe
      "C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4316
    • C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
      -PluginId 1502 -PluginPath "C:\Users\Admin\AppData\Local\Temp\kernel.dll" -ChannelName terabox.3884.0.1409925766\105547888 -QuitEventName TERABOX_KERNEL_SDK_997C8EFA-C5ED-47A0-A6A8-D139CD6017F4 -TeraBoxId "" -IP "10.127.0.117" -PcGuid "TBIMXV2-O_9245D5C37DC640B183AB355FCE494DAE-C_0-D_232138804165-M_CE95CE932DF6-V_7ABA2722" -Version "1.30.0.2" -DiskApiHttps 0 -StatisticHttps 0 -ReportCrash 1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1152
    • C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
      "C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe" -PluginId 1502 -PluginPath "C:\Users\Admin\AppData\Local\Temp\kernel.dll" -ChannelName terabox.3884.0.1409925766\105547888 -QuitEventName TERABOX_KERNEL_SDK_997C8EFA-C5ED-47A0-A6A8-D139CD6017F4 -TeraBoxId "" -IP "10.127.0.117" -PcGuid "TBIMXV2-O_9245D5C37DC640B183AB355FCE494DAE-C_0-D_232138804165-M_CE95CE932DF6-V_7ABA2722" -Version "1.30.0.2" -DiskApiHttps 0 -StatisticHttps 0 -ReportCrash 1
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2404
    • C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
      "C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --field-trial-handle=2588,17098330449500167,4113563945902679210,131072 --enable-features=CastMediaRouteProvider --lang=en-US --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 10.0; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.30.0.2;PC;PC-Windows;10.0.19041;WindowsTeraBox" --disable-extensions --ppapi-flash-path="C:\Users\Admin\AppData\Local\Temp\pepflashplayer.dll" --ppapi-flash-version=20.0.0.306 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4332
    • C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
      "C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe" -PluginId 1501 -PluginPath "C:\Users\Admin\AppData\Local\Temp\module\VastPlayer\VastPlayer.dll" -ChannelName terabox.3884.1.926613751\208116362 -QuitEventName TERABOX_VIDEO_PLAY_SDK_997C8EFA-C5ED-47A0-A6A8-D139CD6017F4 -TeraBoxId "" -IP "10.127.0.117" -PcGuid "TBIMXV2-O_9245D5C37DC640B183AB355FCE494DAE-C_0-D_232138804165-M_CE95CE932DF6-V_7ABA2722" -Version "1.30.0.2" -DiskApiHttps 0 -StatisticHttps 0 -ReportCrash 1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2032
    • C:\Users\Admin\AppData\Local\Temp\AutoUpdate\AutoUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\AutoUpdate\AutoUpdate.exe" -client_info "C:\Users\Admin\AppData\Local\Temp\TeraBox_status" -update_cfg_url "aHR0cHM6Ly90ZXJhYm94LmNvbS9hdXRvdXBkYXRl" -srvwnd 9029e -unlogin
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2604
    • C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
      "C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=gpu-process --field-trial-handle=2588,17098330449500167,4113563945902679210,131072 --enable-features=CastMediaRouteProvider --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 10.0; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.30.0.2;PC;PC-Windows;10.0.19041;WindowsTeraBox" --lang=en-US --gpu-preferences=MAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAIAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --mojo-platform-channel-handle=2872 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4492

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\AutoUpdate\Download\AutoUpdate.xml

    Filesize

    24KB

    MD5

    906be7fbe146e96496b33a7242d0530e

    SHA1

    ca12256ee07e545481d5976866cac075611a7851

    SHA256

    2062be2948d43f3c4caa5d069714f92e9714c319ea4e3a39defb17a9e0c3315e

    SHA512

    33e17c4a73173a003b8c87d71394f6dc6d8872a280c84c3c7bbfd7b40d3f056f3cd38e52e28f1419bfca91931196fb2387371013c850a66d60fe56ed837c1f5a

  • C:\Users\Admin\AppData\Local\Temp\TeraBox\browsercache\Cache\f_000016

    Filesize

    215KB

    MD5

    d79b35ccf8e6af6714eb612714349097

    SHA1

    eb3ccc9ed29830df42f3fd129951cb8b791aaf98

    SHA256

    c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365

    SHA512

    f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

  • C:\Users\Admin\AppData\Local\Temp\TeraBox\browsercache\Code Cache\js\index-dir\the-real-index

    Filesize

    600B

    MD5

    eb6d2db3b9357878fd8ee7d42cf76e78

    SHA1

    fb03934d123c764dcf9dc2f048d756a55feb010b

    SHA256

    28a382af7baf5d43ac0daa3e2087a9b7b1898a0964e4700df7a9496a778d02b2

    SHA512

    a4e9a85f6c45fc42c513e0295bf770d73e3a82fa918d34347ae451ab4664bd612578e18e831eaded1c16fb47dfe1d7ef25b98843707495309cc1383850f00809

  • C:\Users\Admin\AppData\Local\Temp\TeraBox\browsercache\Code Cache\js\index-dir\the-real-index~RFe582110.TMP

    Filesize

    48B

    MD5

    266fba951847330f78bc21e923cca75b

    SHA1

    d9108f7278ec19a85d1a732628f5d3daa1b16985

    SHA256

    0ff54eb8dc635279acbe22a93b7e64329163e6ffcf42b1a57495927d45bd7e1d

    SHA512

    161933f0079bfd66d8b4e3755b65382ddc3c8559dc9d9b28925ae998bfbdf5f8a5c1f15411bdc5c9821a5ae06fe606a6bf771588e6640ea60d9e06829981cd7d

  • C:\Users\Admin\AppData\Local\Temp\TeraBox\browsercache\Local Storage\leveldb\CURRENT

    Filesize

    16B

    MD5

    46295cac801e5d4857d09837238a6394

    SHA1

    44e0fa1b517dbf802b18faf0785eeea6ac51594b

    SHA256

    0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

    SHA512

    8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

  • C:\Users\Admin\AppData\Local\Temp\TeraBox\browsercache\Network Persistent State

    Filesize

    1KB

    MD5

    b5593b3f2903e13f93b99a1c082fadb4

    SHA1

    e94247fd7b2ee0962d2d624b7f0b82b95f438c28

    SHA256

    05d310139286d0b440841bdbd4bbba12c1c3be0a76e310e87b23e778ec7524dc

    SHA512

    7ede3e8a9aeb5ef7afffd9c98ea5ac21dd3da53a05c2efa60835f12243e7392a7b6e1c56d10ef378381d3122054a5b32ff6b46185dba1068eade37b1872ffb33

  • C:\Users\Admin\AppData\Local\Temp\TeraBox\browsercache\Network Persistent State~RFe58d4cf.TMP

    Filesize

    59B

    MD5

    78bfcecb05ed1904edce3b60cb5c7e62

    SHA1

    bf77a7461de9d41d12aa88fba056ba758793d9ce

    SHA256

    c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572

    SHA512

    2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73

  • C:\Users\Admin\AppData\Local\Temp\TeraBox_status

    Filesize

    114B

    MD5

    fd51191e4e472233db6493cac75ce33f

    SHA1

    dbf6a03956dd3b4a41ee0ae564eaef67d1c95acc

    SHA256

    7f9f9704fdbe6fae728e31b25e64d7ce6ca386a1503b090f54d68890ff50f362

    SHA512

    16e1dc6bfdba20604e09a8b95c10fd8bcf60e43f17a5dcfccb6e17be1d1deae14eb9245a91541893daab35abd80c48e854a0c48ae4109ae8b71cc760c088143e

  • memory/2404-153-0x0000000003680000-0x0000000003681000-memory.dmp

    Filesize

    4KB

  • memory/2404-157-0x00000000036E0000-0x00000000036E1000-memory.dmp

    Filesize

    4KB

  • memory/2404-158-0x00000000659C0000-0x0000000066DEC000-memory.dmp

    Filesize

    20.2MB

  • memory/2404-154-0x00000000036B0000-0x00000000036B1000-memory.dmp

    Filesize

    4KB

  • memory/2404-156-0x00000000036D0000-0x00000000036D1000-memory.dmp

    Filesize

    4KB

  • memory/2404-155-0x00000000036C0000-0x00000000036C1000-memory.dmp

    Filesize

    4KB

  • memory/2404-151-0x0000000001620000-0x0000000001621000-memory.dmp

    Filesize

    4KB

  • memory/2404-152-0x0000000001630000-0x0000000001631000-memory.dmp

    Filesize

    4KB

  • memory/3884-5-0x0000000000C2A000-0x0000000000C2B000-memory.dmp

    Filesize

    4KB

  • memory/3884-210-0x0000000000C20000-0x0000000001305000-memory.dmp

    Filesize

    6.9MB

  • memory/3884-24-0x0000000000C20000-0x0000000001305000-memory.dmp

    Filesize

    6.9MB