Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
23/07/2024, 15:13
General
-
Target
$DESKTOP/utorrent/utorrent.exe
-
Size
625KB
-
MD5
11e8a3d1f90a9827f4e6ad484e311eee
-
SHA1
d77877ed880c6be0d327c165c86eadf51041ed3f
-
SHA256
a8020620f5a5007cde8b026f563785b0f00dade36f928d563a65597ff801f831
-
SHA512
fb1108ed1ea35e4d013d18d2a240c9f997fec2db00f631ef7c4915b7bc318a81ce50268e7ee6e67ac47bbf64fb085bcb3e792bd53b548312765ee8dc6ff2242c
-
SSDEEP
12288:Dq9yJqAUd4U40ovJg/Z9oeTelGD/leGkr7oSPU:G9yJqavJ6Z9Ul6/leP5U
Malware Config
Signatures
-
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
UPX packed file 15 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\$DESKTOP\utorrent\utorrent.exe"C:\Users\Admin\AppData\Local\Temp\$DESKTOP\utorrent\utorrent.exe"1⤵
- Identifies Wine through registry keys
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB