3c855659332b10f81efb7574d83624a30db08c15fe3927cee1dbdb2c523d3554

General

Target

BitTorrent.exe
Size

5.0MB
MD5

b8c24a19ae1706e4baf0253b8f33abe3
SHA1

a6eb472bb97ddec488203467d10bc26e86dc8e53
SHA256

3c855659332b10f81efb7574d83624a30db08c15fe3927cee1dbdb2c523d3554
SHA512

2c18eea5f88c2cf0fcceacfa8df78d50d59cdcf9d21369c4cffea43a4e020f31a0ad27394ff22572585c2db7708d8c10c5b7e74000d83c1f543a3608190e5b68
SSDEEP

98304:EG5QgXqF9Eqwxx968O4TZ6PGeM2z2bw3cih8wbCGU3Zg0M9am4LzTWifkBG5Qn8:EG5nfqqtO4TTomiawbC7pgWzTWig78

Score

6^/10

discovery

Malware Config

Signatures

Checks for any installed AV software in registry 1 TTPs 8 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir	GenericSetup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVG\AV	GenericSetup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir	GenericSetup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV	GenericSetup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast\Version	GenericSetup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast	GenericSetup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast\Version	GenericSetup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	GenericSetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 1 IoCs

pid	Process
2420	GenericSetup.exe

Loads dropped DLL 2 IoCs

pid	Process
1756	BitTorrent.exe
2420	GenericSetup.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitTorrent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GenericSetup.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	GenericSetup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	GenericSetup.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2420	GenericSetup.exe
2420	GenericSetup.exe
2420	GenericSetup.exe
2420	GenericSetup.exe
2420	GenericSetup.exe
2420	GenericSetup.exe
2420	GenericSetup.exe
2420	GenericSetup.exe
2420	GenericSetup.exe
2420	GenericSetup.exe
2420	GenericSetup.exe
2420	GenericSetup.exe
2420	GenericSetup.exe
2420	GenericSetup.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2420	GenericSetup.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2420	GenericSetup.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 2420	1756	BitTorrent.exe	29
PID 1756 wrote to memory of 2420	1756	BitTorrent.exe	29
PID 1756 wrote to memory of 2420	1756	BitTorrent.exe	29
PID 1756 wrote to memory of 2420	1756	BitTorrent.exe	29
PID 1756 wrote to memory of 2420	1756	BitTorrent.exe	29
PID 1756 wrote to memory of 2420	1756	BitTorrent.exe	29
PID 1756 wrote to memory of 2420	1756	BitTorrent.exe	29

C:\Users\Admin\AppData\Local\Temp\BitTorrent.exe
"C:\Users\Admin\AppData\Local\Temp\BitTorrent.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Users\Admin\AppData\Local\Temp\7zSCD6E00F7\GenericSetup.exe
  .\GenericSetup.exe
  2⤵
  - Checks for any installed AV software in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Query Registry

1

T1012

Software Discovery

1

T1518

Security Software Discovery

1

T1518.001

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSCD6E00F7\GenericSetup.exe.config

Filesize
814B

MD5
fd63ee3928edd99afc5bdf17e4f1e7b6

SHA1
1b40433b064215ea6c001332c2ffa093b1177875

SHA256
2a2ddbdc4600e829ad756fd5e84a79c0401fa846ad4f2f2fb235b410e82434a9

SHA512
1925cde90ee84db1e5c15fa774ee5f10fa368948df7643259b03599ad58cfce9d409fd2cd752ff4cbca60b4bbe92b184ff92a0c6e8b78849c4497d38266bd3b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF308.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\GenericSetup.exe_1725651564\Resources\OfferPage.html

Filesize
1KB

MD5
40f9e3b058900163dc9af1cca732a234

SHA1
a178a2d14119791d82221c20f93bd4bb2d7e2c96

SHA256
4c96def99dd3e50022ffc8ff4e8a01a12ca046ca8c9580673618537cb3d55e16

SHA512
9c5e3d3358df6acfc8b1b7fe29049d9d4e9789878178b2d3fcbd24e7e27b295a4d7e741f98f2045e650b3f1d4140bb1e334722397729145b40204fad9f3b24d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF32A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Users\Admin\AppData\Local\Temp\7zSCD6E00F7\GenericSetup.exe

Filesize
10.0MB

MD5
305b424f87d4b6f08eacdf47f8eefcd1

SHA1
9622b76a56443fddead8f4996d5f1b4e05fa0b93

SHA256
48a61875fe1ef52b1f375b1e95f38193da7bccfa0a54cd283687b4ccce59fced

SHA512
b5d53d066693b02ae39d3c2e0095a53aa311e2cf0a239a43ebd2d8bc7e481cdb26d0819c577f60433f0a23b7141b8a9ed94d1fd8dce6e9e3fffa441eef4bd7a3

Download Submit
\Users\Admin\AppData\Local\Temp\GenericSetup.exe_1725651564\sciter32.dll

Filesize
5.6MB

MD5
b431083586e39d018e19880ad1a5ce8f

SHA1
3bbf957ab534d845d485a8698accc0a40b63cedd

SHA256
b525fdcc32c5a359a7f5738a30eff0c6390734d8a2c987c62e14c619f99d406b

SHA512
7805a3464fcc3ac4ea1258e2412180c52f2af40a79b540348486c830a20c2bbed337bbf5f4a8926b3ef98c63c87747014f5b43c35f7ec4e7a3693b9dbd0ae67b

Download Submit
memory/2420-30-0x0000000002A00000-0x0000000002A2C000-memory.dmp

Filesize
176KB

Download
memory/2420-29-0x0000000002960000-0x0000000002988000-memory.dmp

Filesize
160KB

Download
memory/2420-28-0x0000000000A70000-0x0000000000A78000-memory.dmp

Filesize
32KB

Download
memory/2420-31-0x0000000005050000-0x0000000005062000-memory.dmp

Filesize
72KB

Download
memory/2420-27-0x00000000055D0000-0x0000000005CAC000-memory.dmp

Filesize
6.9MB

Download
memory/2420-26-0x0000000074C40000-0x000000007532E000-memory.dmp

Filesize
6.9MB

Download
memory/2420-119-0x00000000064D0000-0x000000000654C000-memory.dmp

Filesize
496KB

Download
memory/2420-25-0x0000000000B50000-0x0000000001558000-memory.dmp

Filesize
10.0MB

Download
memory/2420-146-0x0000000007760000-0x000000000778E000-memory.dmp

Filesize
184KB

Download
memory/2420-23-0x0000000074C4E000-0x0000000074C4F000-memory.dmp

Filesize
4KB

Download
memory/2420-168-0x0000000074C4E000-0x0000000074C4F000-memory.dmp

Filesize
4KB

Download
memory/2420-169-0x0000000074C40000-0x000000007532E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing