Analysis
-
max time kernel
150s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-10-2024 06:51
General
-
Target
utorrent_installer.exe
-
Size
1.8MB
-
MD5
32710bfba1858421cbf383e6f5c1ad8d
-
SHA1
313d79259c5936b8705d0fda24ff3cb59758c36b
-
SHA256
cb0abb633f628eeac47bec9379d698e08b4f281965277703d77fcb548b022496
-
SHA512
66d9316854f39cafd650d16e6ad02d3eb30e9f9aede455c91d369e94e8db6251e9997f4261dfc7f8f04b0778f6c37e3924b8bdb22e326f42c28808eda71326ef
-
SSDEEP
24576:uawwKusHwEwSDMnsQMJU/628S04FSq2FKfUbpW7/tumQ1wBRR:OwREDDMkU/6tS0QpYWVumQ1wvR
Malware Config
Signatures
-
Checks for any installed AV software in registry 1 TTPs 9 IoCs
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Script User-Agent 4 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\utorrent_installer.exe"C:\Users\Admin\AppData\Local\Temp\utorrent_installer.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-675PR.tmp\utorrent_installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-675PR.tmp\utorrent_installer.tmp" /SL5="$60062,854542,829952,C:\Users\Admin\AppData\Local\Temp\utorrent_installer.exe"2⤵
- Checks for any installed AV software in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD5f1ae90a9f6324a07d39d877fcdf99710
SHA160a6ff33c3a1e980c529072890a1326b8a56b809
SHA2562de8e11d8d9532ec1c51b30eac3906b38d06109238ba8ae272ec841fa9b42ad1
SHA5121ac279c5d8f2cb403dc10eebb2c753c86ce10757fa3a1a5d59173864e82bfe4f0ed42e4c105ca40d7462f73ea6cea408889ea5bde8543b93d9a0febe0cd05f78
-
Filesize
47KB
MD54cfff8dc30d353cd3d215fd3a5dbac24
SHA10f4f73f0dddc75f3506e026ef53c45c6fafbc87e
SHA2560c430e56d69435d8ab31cbb5916a73a47d11ef65b37d289ee7d11130adf25856
SHA5129d616f19c2496be6e89b855c41befc0235e3ce949d2b2ae7719c823f10be7fe0809bddfd93e28735b36271083dd802ae349b3ab7b60179b269d4a18c6cef4139
-
Filesize
74KB
MD5cd09f361286d1ad2622ba8a57b7613bd
SHA14cd3e5d4063b3517a950b9d030841f51f3c5f1b1
SHA256b92a31d4853d1b2c4e5b9d9624f40b439856d0c6a517e100978cbde8d3c47dc8
SHA512f73d60c92644e0478107e0402d1c7b4dfa1674f69b41856f74f937a7b57ceaa2b3be9242f2b59f1fcf71063aac6cbe16c594618d1a8cdd181510de3240f31dff
-
Filesize
29KB
MD50b4fa89d69051df475b75ca654752ef6
SHA181bf857a2af9e3c3e4632cbb88cd71e40a831a73
SHA25660a9085cea2e072d4b65748cc71f616d3137c1f0b7eed4f77e1b6c9e3aa78b7e
SHA5128106a4974f3453a1e894fec8939038a9692fd87096f716e5aa5895aa14ee1c187a9a9760c0d4aec7c1e0cc7614b4a2dbf9b6c297cc0f7a38ba47837bede3b296
-
Filesize
672KB
-
Filesize
868KB
-
Filesize
868KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
3.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
3.2MB
-
Filesize
1.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
