Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
4TeraBox_1.30.0.2.exe
windows7-x64
10TeraBox_1.30.0.2.exe
windows10-2004-x64
4$PLUGINSDI...UI.dll
windows7-x64
3$PLUGINSDI...UI.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...sW.dll
windows7-x64
3$PLUGINSDI...sW.dll
windows10-2004-x64
3$TEMP/kernel.dll
windows7-x64
3$TEMP/kernel.dll
windows10-2004-x64
3AppUtil.dll
windows7-x64
3AppUtil.dll
windows10-2004-x64
3AutoUpdate...il.dll
windows7-x64
3AutoUpdate...il.dll
windows10-2004-x64
3AutoUpdate...te.exe
windows7-x64
3AutoUpdate...te.exe
windows10-2004-x64
3BugReport.exe
windows7-x64
3BugReport.exe
windows10-2004-x64
5Bull140U.dll
windows7-x64
3Bull140U.dll
windows10-2004-x64
3ChromeNati...st.exe
windows7-x64
1ChromeNati...st.exe
windows10-2004-x64
3HelpUtility.exe
windows7-x64
3HelpUtility.exe
windows10-2004-x64
3TeraBox.exe
windows7-x64
5TeraBox.exe
windows10-2004-x64
5TeraBoxHost.exe
windows7-x64
3TeraBoxHost.exe
windows10-2004-x64
3TeraBoxRender.exe
windows7-x64
3TeraBoxRender.exe
windows10-2004-x64
3TeraBoxWebService.exe
windows7-x64
3TeraBoxWebService.exe
windows10-2004-x64
3Resubmissions
17/01/2025, 13:15
250117-qhg8vsypcz 417/01/2025, 11:29
250117-nlw53swmar 409/01/2025, 21:28
250109-1bc1ns1qgt 405/01/2025, 19:25
250105-x44gjstlew 10Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/01/2025, 19:25
Behavioral task
behavioral1
Sample
TeraBox_1.30.0.2.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
TeraBox_1.30.0.2.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/NsisInstallUI.dll
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NsisInstallUI.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsProcessW.dll
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsProcessW.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
$TEMP/kernel.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
$TEMP/kernel.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
AppUtil.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
AppUtil.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
AutoUpdate/AutoUpdateUtil.dll
Resource
win7-20241010-en
Behavioral task
behavioral14
Sample
AutoUpdate/AutoUpdateUtil.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
AutoUpdate/Autoupdate.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
AutoUpdate/Autoupdate.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
BugReport.exe
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
BugReport.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
Bull140U.dll
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
Bull140U.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
ChromeNativeMessagingHost.exe
Resource
win7-20241023-en
Behavioral task
behavioral22
Sample
ChromeNativeMessagingHost.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
HelpUtility.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
HelpUtility.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
TeraBox.exe
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
TeraBox.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
TeraBoxHost.exe
Resource
win7-20241010-en
Behavioral task
behavioral28
Sample
TeraBoxHost.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
TeraBoxRender.exe
Resource
win7-20240729-en
Behavioral task
behavioral30
Sample
TeraBoxRender.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
TeraBoxWebService.exe
Resource
win7-20240708-en
Behavioral task
behavioral32
Sample
TeraBoxWebService.exe
Resource
win10v2004-20241007-en
General
-
Target
$PLUGINSDIR/System.dll
-
Size
12KB
-
MD5
8cf2ac271d7679b1d68eefc1ae0c5618
-
SHA1
7cc1caaa747ee16dc894a600a4256f64fa65a9b8
-
SHA256
6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
-
SHA512
ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3
-
SSDEEP
192:BenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XB9IwL:B8+Qlt70Fj/lQRY/9VjjlL
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 708 2520 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3064 wrote to memory of 2520 3064 rundll32.exe 30 PID 3064 wrote to memory of 2520 3064 rundll32.exe 30 PID 3064 wrote to memory of 2520 3064 rundll32.exe 30 PID 3064 wrote to memory of 2520 3064 rundll32.exe 30 PID 3064 wrote to memory of 2520 3064 rundll32.exe 30 PID 3064 wrote to memory of 2520 3064 rundll32.exe 30 PID 3064 wrote to memory of 2520 3064 rundll32.exe 30 PID 2520 wrote to memory of 708 2520 rundll32.exe 31 PID 2520 wrote to memory of 708 2520 rundll32.exe 31 PID 2520 wrote to memory of 708 2520 rundll32.exe 31 PID 2520 wrote to memory of 708 2520 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 2203⤵
- Program crash
PID:708
-
-