Overview

overview

7

Static

static

7

uTorrent3....le.exe

windows7-x64

7

uTorrent3....le.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/05/2024, 00:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    uTorrent3.4.3(40760)Stable.exe

  • Size

    1.9MB

  • MD5

    be19f180abe2d1d6c04f639e57c59ba4

  • SHA1

    8f5261aea3f1bb62438ad8c7acf8c3640cb545c9

  • SHA256

    efc67f2a55f5078ff07185fa3b3191ae842e125fcf2c5327352de3b4d0e8d83e

  • SHA512

    12846f46bebd5e929b59585af1f6d13663a2c2b985c2751722fc3eec3f61d480f08f850e789049b39a4925930e650dc27db4f69ebffc8a03e1ebd78ccad5b8c7

  • SSDEEP

    49152:yxbiKUSncokSbzTP17jwhMyfVEz7L7SAv6:yxJnco9bvP1ER0e1

Score
7/10
evasionupx

Malware Config

Signatures

  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\uTorrent3.4.3(40760)Stable.exe
    "C:\Users\Admin\AppData\Local\Temp\uTorrent3.4.3(40760)Stable.exe"
    1⤵
    • Identifies Wine through registry keys
    • Checks SCSI registry key(s)
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:1336

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\dht_feed.dat.new
    Filesize

    2B

    MD5

    d9180594744f870aeefb086982e980bb

    SHA1

    593b743b207e10ff55ec63e71a46c07909d0880a

    SHA256

    61098a4bf2a5e216533e5f2994d8f290308b310f2efa046548a96302afe412ea

    SHA512

    052d52f93faf4fa4037fc1e1cedec179253e47e3f2a11f7ef070fcfc393a7429dec341c46463b000d0a46f6d0e6de1325e1e43f7f01fe4605954df9035e0b080

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\settings.dat.old
    Filesize

    82KB

    MD5

    15f1afd3ee2aa35a1a5e81ad98d8ef14

    SHA1

    8a83f1a8e1f4d56953f9d1566a5598abc690e49e

    SHA256

    aa2aadefc8de6db464ad64d4b707866b1773c1d34a2de3fc5bf1f2e1aafa9f3b

    SHA512

    0ab0ba22c629ba2f23a6801b897bff23a0a442a94d58962a165965688c0682e2bf735e1e17832520da7a3a81e0261c96ace332e8b8b1df4af42d071cbc822d34

    Download Submit

  • memory/1336-0-0x0000000000400000-0x0000000000869000-memory.dmp

    Filesize

    4.4MB

    Download

  • memory/1336-36-0x0000000000400000-0x0000000000869000-memory.dmp

    Filesize

    4.4MB

    Download