Analysis
- user interaction
yes - max time kernel
26s - max time network
21s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
14/10/2026, 03:50
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://teraboxapp.com/s/1aLtWGz2VkHlCCJV-BjnXVw
Resource
win11-20260911-en
9 signatures
600 seconds
General
- Target https://teraboxapp.com/s/1aLtWGz2VkHlCCJV-BjnXVw
- Sample261014-eecnesvx6p
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4456 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3980 chrome.exe 3980 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe - Suspicious use of AdjustPrivilegeToken 52 IoCs
description pid Process Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe Token: SeShutdownPrivilege 3980 chrome.exe Token: SeCreatePagefilePrivilege 3980 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe 3980 chrome.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3980 wrote to memory of 2028 3980 chrome.exe 81 PID 3980 wrote to memory of 1948 3980 chrome.exe 82 PID 3980 wrote to memory of 1948 3980 chrome.exe 82 PID 3980 wrote to memory of 4456 3980 chrome.exe 83 PID 3980 wrote to memory of 4548 3980 chrome.exe 84 PID 3980 wrote to memory of 4548 3980 chrome.exe 84 PID 3980 wrote to memory of 3904 3980 chrome.exe 85 PID 3980 wrote to memory of 4640 3980 chrome.exe 86 PID 3980 wrote to memory of 3904 3980 chrome.exe 85 PID 3980 wrote to memory of 4640 3980 chrome.exe 86 PID 3980 wrote to memory of 5004 3980 chrome.exe 89 PID 3980 wrote to memory of 5004 3980 chrome.exe 89 PID 3980 wrote to memory of 3928 3980 chrome.exe 91 PID 3980 wrote to memory of 3928 3980 chrome.exe 91 PID 3980 wrote to memory of 4528 3980 chrome.exe 92
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://teraboxapp.com/s/1aLtWGz2VkHlCCJV-BjnXVw1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff83de4c728,0x7ff83de4c734,0x7ff83de4c7402⤵PID:2028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,5951788425920192557,17232182490312437633,262144 --field-trial-handle=1940,i,3405636073024741464,16828479360419609250,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=1928 /prefetch:22⤵PID:1948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2204,i,4896227069084272647,7348945378654445337,524288 --field-trial-handle=1940,i,3405636073024741464,16828479360419609250,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2212 /prefetch:112⤵
- System Time Discovery
PID:4456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2336,i,11167511205657637027,11521494088644855360,524288 --field-trial-handle=1940,i,3405636073024741464,16828479360419609250,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2676 /prefetch:132⤵PID:4548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,16941756940696518091,7700386175533544363,2097152 --field-trial-handle=1940,i,3405636073024741464,16828479360419609250,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:3904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,3834420808633029133,9292256175649368111,2097152 --field-trial-handle=1940,i,3405636073024741464,16828479360419609250,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3308 /prefetch:12⤵PID:4640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4464,i,11467194485562105203,6418826933287157791,2097152 --field-trial-handle=1940,i,3405636073024741464,16828479360419609250,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4480 /prefetch:92⤵PID:5004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4764,i,15800372771137308536,1076740445204528989,2097152 --field-trial-handle=1940,i,3405636073024741464,16828479360419609250,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4776 /prefetch:12⤵PID:3928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5656,i,1989090730932203908,2710705067854080536,524288 --field-trial-handle=1940,i,3405636073024741464,16828479360419609250,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5732 /prefetch:142⤵PID:4528
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:1144
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3604
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\55f582d0-42f2-4c3f-94c5-5de4e0b25c91.tmp
- Size 131KB
- SHA256 dd5f809bee0fd76bea60d3411c2cbed5960dcdd7cf11aedefeb0f24115a175d1
- MD5 b1609ffc20ffa68d0683bfa7c195b364
- SHA1 ff0ff63b16ac382355b5fd8c2fc1bb522cfa7b6f
- SHA512 9e3d3da1575d99a572060428890111f14e2805bf6205002c58beccd13f99294feb4a270546c42d75fa34065e34f65495b3b49d4c6eda7dfc688e49c1296ecf86
- SSDEEP 3072:CT8ThDUxx0Rghaj57THH/53w/7qclnYe/JYNfobTOLXA:RThDxWhaj5mjie/JYFobV
- TLSH T191D312239CFE41FB14BCC50840697F0086F989B3D640FFA39ADC6A4FA1D7EA09366556
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\685a016a-4989-4ed9-a652-370a2148ded1.tmp
- Size 132KB
- SHA256 5953ac70bd183f718786a1e5cd723fd2b9c72159d043e0f8f637ab27fc70b76b
- MD5 f207802fa717ba758ce59ee7f53a2f30
- SHA1 fe4882df2873dfc8c2292c2bee50e57f2869084b
- SHA512 d5d690c22f1d50341a26ee2e3f29c9d0c3e571d6818cfa337c53506b368f71c47183f2b8d5e0c15caa30f48fbd48b3532840a7718c3cbfa2661920ef643ef590
- SSDEEP 3072:DT8ThDUxx0Rghaj57THH/53w/7qclnYe/JYNfobTOLXA:0ThDxWhaj5mjie/JYFobV
- TLSH T1AFD312239CFD01FB14BCC90880697F0086F989B3D640FFA79AD86A4F91C7EA4A357556
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6032910f-e2f1-4159-ae82-2e5c06fa228d.tmp
- Size 12KB
- SHA256 861d6013a18dd7c5c8ab33666dba2c4f8bc397e82aac443e360b01cd8ce6995e
- MD5 9c93dd1dd090444d1ffece16e1d24226
- SHA1 ee533b05ad870f1bb3be86f167f6609630ea4b99
- SHA512 b28842f61ab8430930707fb3141014ee16b779cf4640cfe0dab8f2f31bd5d4106e7f7a5f0be8f9dcdaee434f7f6afaa93ceeb980a2ef11873e68e67342dc78eb
- SSDEEP 192:vRT01P3Ekv9v7ZYepAPRp2SE9zHsb+WNnIfpSjeGk/EeWD8SVyIsnAUge:vRT0P9dhUXsZwsCeP/Ine
- TLSH T19342C729ED54753B9CDBD62AF9623B57E7F5102660902E84EAFC8D2C14E75CC322341B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\74277ebc-0760-42ee-960d-58af1a989f39.tmp
- Size 12KB
- SHA256 a09b0db9128583cd3da6eee80c1a5ecda5c82b20788499dd51e2582f7a31a8d6
- MD5 2fa59877cc07993e8258c7ba0f3f79a4
- SHA1 02d83e7e1bca793f154b500f3893de21f5a3bd23
- SHA512 9c9066b632371b94b8cac784366896a49cab2cd4588e26b66cae2f14fbbb9133cdc55fc30d2e9af152f828f793f1db8db700ab71821a67a3f5a2d9f66b986ec6
- SSDEEP 192:vRT01P3Ekv9v7ZYepAPRp2SE9zHsb+WNnIfpxO2Tk/EeWD8SVyIsnAUge:vRT0P9dhUXsZwsq2Q/Ine
- TLSH T1F242C629ED54753B9CDBD62AF9623B57E7F5102660902D84EAFC8D2C14E75CC222381B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\98eac718-3dc3-4224-b891-1cb8a560b921.tmp
- Size 17KB
- SHA256 4bfbe324691a23a534db53a22993451495e8f99857a002d285586cc0fc8ed7a5
- MD5 d057b7c85bf32212a239f24a704aff82
- SHA1 a42e5b02a5f2368064007d69b1a51f5d692b8da4
- SHA512 6b8dffc50b71f5d7d42a1590b183c8bb0c01f98f894f6bbaef1ee3fc69d01aadef3e79c5706326ebda020c1bec9e5d800afb5f994457546546cfc2f47ed220be
- SSDEEP 384:71j3W7KxkXqKf/pUZNCgVLH2HfgslsF7pLuLceSRcXOD3y+ErU339HG+X2tt7I:7l3W7KxkXqKf/pUZNCgVLH2HfgsGF7pN
- TLSH T17072F9677C48993B0FD4CACCDC267E4F9CB5014B65E9886493FA5C2903D5BCE114A2EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\67c4ae9e-b8ef-44a0-b855-2c35c45d5fd3.tmp
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
- Size 120B
- SHA256 799550d1683f94e38dd670f3d2a145bdb83d983b6102aa0c875d421945ecd2e5
- MD5 14160a99a0fde74f61678ceb9610c06e
- SHA1 4197f8d48bd7835110684b9c6583db5fecf0d306
- SHA512 7b8fe1f78ad8b121b068f33f2611a61296f5871d10d794ec9310ccdccd2e8957af50b88a6f83869410019deb1435c76d14b9975f5cfd7685250fc7cc08268d2f
- TLSH T19BB0125581412701C80603B01150A8547260CF39D11213C985F00E02CC395504017318
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 96B
- SHA256 ec6e8251b5366816cbd9ed54447f545ed4a83febf26d065d91fdf5fa978e8a27
- MD5 4f51b6935679c35c3808c1621094681b
- SHA1 a14317524339babf7e9af0fa772e81a7c994356b
- SHA512 b5ab00192d9cb8577f6eb590b64d5eadce1ea07331e87e9727e7a3106e172466ee65e8776e17e2fbfdf9ea0a8e53e539a72a97fc3766170dda10bb41e19abee2
- TLSH T1FDB00266C203F223C04A03F06A9697D97560DF26C6035A1AA3F55A6AEC26E605529760
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f5ae351e-43ec-4646-a133-9e9c47aedb2a.tmp
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f62a2ae1-8558-4636-b890-2a5a18675125.tmp
- Size 414B
- SHA256 025853a47b445ace1f85341af73afdd92e8bfcb60f4af7e92291e081950f04ab
- MD5 2b891ef15dce84c5b41acd3c0532c907
- SHA1 b1f37b322021ec8997ffe8d65f4cc60bf9f4afe1
- SHA512 901ae916968ce8b65cba5542e30076e7b6f1424c5d3bddf71cf1b4fefab83be5881a514b146810657f8882c2ae54cd45d48afaca03aa04aa5fc00f0f8304e2f3
- TLSH T15AE022AAE871BD7718FD072860904B86F740030B26A08A0F3A3CA20CCFF463F429681C
- MD5 SHA1 SHA512 TLSH