Analysis
-
max time kernel
569s -
max time network
567s -
platform
windows11-21h2_x64 -
resource
win11-20250314-en -
resource tags
-
submitted
28/03/2025, 23:06
General
-
Target
uTorrent 3.5.5 Build 46514 (Ad-free).7z
-
Size
12.0MB
-
MD5
b20438abc6a0246e971b9423dcd321e0
-
SHA1
e7c1fa97427cf5c8e8c0aca9c5c015736ec97c68
-
SHA256
a525b63ed45e81cc66845ac9a677d5e3e46515b69e3d7634b95f4aaeeee385df
-
SHA512
52974adc3e255aa984dde644e4c882ff6de5bf8e5cab2bbdfd84957415ead1fe6a91d31e0c5734b0b6ed6404e79a970797234b469fc5f53792373f26e70168b0
-
SSDEEP
196608:QQRCOt/SUOJSzqtHSwBbUGpWF0Jhs9uISyi6CiZvvbQN/jRw+MjBqmnTNz0m0brp:dcOt/FaHbZpRh/IqJiVDe/jRA8uTN105
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 3 IoCs
Detects file using ACProtect software.
-
Executes dropped EXE 1 IoCs
-
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL 1 IoCs
-
UPX packed file 38 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies Internet Explorer settings 1 TTPs 6 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 5 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\uTorrent 3.5.5 Build 46514 (Ad-free).7z"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\Portable\uTorrent\uTorrent.exe"C:\Users\Admin\Desktop\Portable\uTorrent\uTorrent.exe"1⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD5a8a22aa628ab07cb2748d0a03484857d
SHA1ebb071715ad99a78b67c8fefabb5825cbe6e66e9
SHA256108bc78e014005f95d959acdd3a7352f3151f1fb3ec50e2a7ea772f01016be81
SHA512bde08569f4c42cc7da483fab288aad4304d2d65e40f47386546ab589822cfc0e441d5c9004e6d79d6103012b28242ee9d82f03eb2fdbd15248daec9416a2bb6b
-
Filesize
2B
MD5d9180594744f870aeefb086982e980bb
SHA1593b743b207e10ff55ec63e71a46c07909d0880a
SHA25661098a4bf2a5e216533e5f2994d8f290308b310f2efa046548a96302afe412ea
SHA512052d52f93faf4fa4037fc1e1cedec179253e47e3f2a11f7ef070fcfc393a7429dec341c46463b000d0a46f6d0e6de1325e1e43f7f01fe4605954df9035e0b080
-
Filesize
1KB
MD5c74385b8e564a62407e97f42b583d191
SHA1c7bcb437a1e8392c833d3c88c2440a2825a38022
SHA256f7c50dd9391a5c8f1080cb1d9bb2e92c0a78be7ea3f2fd1dc4a926500719a6c4
SHA5128b4dc31d49854ed811478093ed7d007fac801ddf2a45fa30f751251f4414dfd67c6201344340a7c66961d15ec1771d10be4ddf4e15d32e04f4e0d4405b619686
-
Filesize
6KB
MD5bd0f81acc4504ea2fba0b90b571dd7a0
SHA1dc0e5b2cba6dbfb3c04e3de7686c9e77fd0bad3d
SHA256a7a3c664c22f2d45f7f102f92e71c60ebd17d527cd7ace49891761e16363e998
SHA512b014ab46fdcb0f4e9238889dea058bf84d23c2b3d7e3589551f1acd40a442d4d965963bfdbdc957bb6c86b2bc5fa8268023dabca1b4044402e288a2497fe1825
-
Filesize
894B
MD5ab55f59a775976829d8352a7a0584d3e
SHA1e4b29ec4ac46d97ea15c582d61d02c523dd0485b
SHA256e68d4b7f22b5027fef4672cc5ba884fb52ac248fd1ca4648c9ac89d95b0e58f4
SHA5121dae2e3cdf25e072174d2289ce96c423095e4fa8095a7ac33b319f389d1add9ba2f7f7280f4c8cc70351342a324a6bbeaa526381dd4125a3d3594557535b09ab
-
Filesize
9KB
MD5b80acc761c7b6e79f07c025428ae1bba
SHA105644594a68db487be3f568737a34f72f6043ac9
SHA25616084d4d50747faa7fd27d255fc10d6694e451cb57643fed369251930e09f618
SHA51292c689f2121e59a19873ffb6be5bd96a6d33a0e36af8ee654d5524ea6bc750858c764df70e9c05b3c49f9dfaa5bd3064a24dd6c8adf387e74d2b3917b200d501
-
Filesize
612KB
MD511377718da15d25d3f81b5440272918d
SHA1f4d0819c8eff9fc4ece53eecbbe2f7f18cfbb0fc
SHA2565f6f41b4bc3c6f23919221be0617edfb2c805cd66c103c5dc2c1df944d407989
SHA512581c94091e5ade45ae5d2a886a79c05b905518fe65093b723403e94ef0c9957d7463d1f14a102ac7e0467414722678bb2a65672eab1cc75d2ff1568ede115891
-
Filesize
615KB
MD5fe404a91eb10a1deeee6181e00efb3b9
SHA1b27cccae4c110b78171547aa1fad78f24c0d2714
SHA256f9800f0d23011df1c9d25c2ada4b94b2165ea0daa0c5d48314449db7eb611d8e
SHA5121b94df529433a9689f9972b55e9bab60b81e60c3e47b94aa4448a7712b34c2853867d7a734ec6869ac91edfb02942592af79e6f5e63c8430591388296f949488
-
Filesize
99B
MD5b2cab184f7238023a722ac7c0edcbbc3
SHA1a4ef7fcea3e0fe15455185e928cb3433c104bffa
SHA2560e513f59ed8d5f2c7c73ac6963a6ca435ab2260ad77f3b4379635eb6e4679cbd
SHA51292ed231c92a813bdd1c191cf09ec4e0a96c08780e1cd05b9aa8a0d36bf03970425f1af023cb0a35dc354fcb1d00f2afeedff20e97de87fdd413809f079015657
-
Filesize
23KB
MD553ec5a1bf0986424027aac44616833d6
SHA10f93d98e25c62631884188d1fda6c24d2bdec8fc
SHA2568dc222bfe8ad0f39d8db0a111777579cc8dbff0ffbd2141d71abe4ddf3d46c14
SHA512aa5d35aabd479345d85489e7fedc1419f2fba161564eb1888abea76016435bfae9c5c380c8d37589d8536db4b6719734b5d1bc0334e7dcd1ef16f292a8dff6ea
-
Filesize
23KB
MD56982faa69baafe9b25eaea883359370f
SHA140af9f117bdef8ff3889f772ea9e52dff39763dc
SHA2568c7b7db21bbae99749008ba3d7fc213bee287727a7e35121ec15800ed93aa65d
SHA5120a9c77ef9b21c12da619a0b1c6a76bcd778855f340881d55148869fbbb6e40a25390ac0f1924eb0fa6f61deaeb0fbb08f079a52f2503a01d8271d72d4cfe8604
-
Filesize
275KB
MD598d6c3b77704baf0347d83f43de45816
SHA1f3113a51cf7619f9596c7c813de7eb930baf02c2
SHA25661647902d5b4e40b486603ac86c718de31b307359218793fd441dab6ee7f7f05
SHA512d6ae422a6dbb5d44be69f49ed36b8716e6e8571925bdbb74734a8e8b9b4fbd1ddcbac3e62208f60bf724ebad6c9dae495f363321434f43c5bb0f7a80c4c238f6
-
Filesize
17KB
MD52a5a7a423c8325c99fa03d7904d2df77
SHA16854f6eaca29731d23dc8d8e80971f7204a6cd2c
SHA25680e362f978a9706090c76aa990daff63e284f9982151f2a5386d831c1c8746ab
SHA512a64e7b316d040d48812bd381234ae0b4fb15e4d56101f238bd285f5f156a39b36674e7228e7d15eeada48fcccdd6335024d84eb45b36910c9f0deb15445da6c0
-
Filesize
11KB
MD5e720c0a7c0b5358def3e875e1c6502ac
SHA1046c054dd9ca3be4d57ad8814e798f4a59d50ef5
SHA2560283e5db49ad86ffe344bf64ab53c2ed54872c3f9504dfc87450e3259ec9824c
SHA512ed25e36422266e209c4bb36b02f27f0e76f0127d5ed884ec5d2354b92f9d49ff118ff1031c14fc706b12f09507e5af1c0865e719c9f27ec300d5b343248987c2
-
Filesize
338KB
MD5731bf4d10537df1c65d00ee86863270d
SHA1c0bef8f2697aed69ba2211baf92e9a74c748d5a8
SHA25612e9af94a222726c3bbb242073e8573cf2680d76b6f59cdd9d090a641cc719ed
SHA5129a4ec7278aec1db3d4319f6b79f6ba80e2326cc329536a02df054c0332ca52959049be98ced6619faa92dce912b65f158133872fb817f923fe54afcf0272c2cc
-
Filesize
125KB
MD51776da229a5860d9cc89c8adf1909b32
SHA13a13335d470996e4687d7f8ebd55af1f7bb0fa6d
SHA256b7e87f766388fc68f0afb529f9c99635dc95557f42c8126f7bfc082a105095a2
SHA5123f514f8eef34be2251345f5fe0a5339ef46ea3c9436c5d9fa1f4ba3545eb6fd29b0aae34a4b8ce47e4cfbd7e9fbd0b6d6b2df08728018b064cca8f6b59f2aae8
-
Filesize
81KB
MD5a03d927dffed671447c9cdcd01835588
SHA1bd9d0bb7e41a439cc25ada86f211fbcbd84ceaf6
SHA256e23372d16e8f133db0fa0fc1f32db2718de1f4d7b15520d3f70a951b62cdd66b
SHA512c4e8537878622a0b790dcd6f1fdd906990c6f4ec52cb5ca2e82d4920555199aa358ffd2c5ec9a5ac66b81b1460bf4a141ef42a10031a3481635ab9d0ad6f1b90
-
Filesize
22KB
MD55059a1a3aa6c972dd15bafcebbe13f12
SHA1f03573ce39889f0d3832c0243f11c5d7d10e6260
SHA256d63602c0e258faf64c6aa72cd9ccd37faca32020b09498b595e2a9194ede63da
SHA512316e5414756535692c907d66264cdc544954c83db4475f1d4cc7abfda90fcd1798ed43bb831a99acc7c435e874adfa9ffca54bc416d3796cf2633df9e2493840
-
Filesize
323KB
MD53b797410fe03451d933bac1007cb0625
SHA1b767dbd2068852fe4f870386a4fab4d068c01f29
SHA25629515d1272fc2828f9ecaeb9d83b7542a8df859e8931507b5cd834ce23d7bad0
SHA512b2cb25852829f143f0365afbdc899495de8ae017d02fe98d6302f6ed009e4e931412f2e5f2e0784c1e7837e70071f0f018b9a1bb3bd0cdf9c8c52ef2e8d31120
-
Filesize
178KB
MD5809c87eb5d919d7703993f86a1c1b07b
SHA1f50533458dc61d7f67e1dc9853a3d25e1ac75ace
SHA2567d7be6d9f15682763cf01b231c099495dadac836c802fca01ec7f7fc6b532fbe
SHA512dbbd3f88fe2582f47326b0d0550983590cc556ca69f0643728aefafcf298676ee5f18cbec05c4a1db481b0a2761fc96236d088d6e682258857706e12caccf995
-
Filesize
274KB
MD5a59f29599c8839ff8322903a5ae844bd
SHA17463eb1eb9a08cab46a28fcbe26e13211baf3069
SHA256d370387ec799cc4c69db391a37eb745c80d5f26c5d98e4de4c2188d338f11987
SHA5124eb82f792e6e91d55438a31b0589f79e39b0d3258dd196f799af8da6e983c91f3e46d765dfe21ccc6747c5a11a96062f6b61b2a1dff41abbd72d2c3f19df087f
-
Filesize
13KB
MD5fcbe85fc4973ff43b2dab3d255325379
SHA1429b53d6c4903420f16e8afea1e28d062c9b4dc4
SHA256fda66bb0ee43ef0dec41d13335cfa44139da9ea80f9b4a81f4fdbeea822fb53c
SHA5127243c4dbc15f46bc7db26af96d838c62cfa95dd49b82ddce3b22c4957991e36f7b7e651df7b1805d41a436c2999a4bf7fc9c2bba1894a22793054f536f305d13
-
Filesize
93KB
MD50d7e2035f6f85ca720d015130ea9b63b
SHA152b539550f8df76fedeffefa07978a1f4c41537b
SHA2563f9e8cdf3ce2e84321f15e23a8512c1924a4e7f7a83b8cebe891efb5366388f2
SHA5122d592851456b70cad841e4631ed6d923a86f4bb85f79bb71ce53583a91f0b3851fdf7382db2b4177b7cb1dcfb999772507197e8e6d003b4239234a981e9fec5b
-
Filesize
205KB
MD529c4e3b897ecb765f4b9ff3c744c21ac
SHA156a0684002b7d8a9da925437d320c77e1bfa90fa
SHA256e9058ca4b011c4db8c1f13d774b6396d907c40fabb0d9de84d7e796b1b383eda
SHA512e3dba786c415008c779c6fbfdbe2e9c70753a6fe9d8544443cde0ec032c192d47bdb7b60f4174655da63e5fae585ae954c26ed127fa8684748b63304c89dd08e
-
Filesize
172KB
MD59679233fc38bcf2e3cd63d1eb09b1ea4
SHA110b357269c60b2aa7939d1bd2e6f2c643c599234
SHA256f3c523f6596d9c7c3f9fc7900be07b0e1d9e2e69e2930f6aa2e12bdd6d92754b
SHA512e5c6d8226f9ef34790f21089602fc1a05b56bed1e11bb162b9b080c40d5083d67e52f193171f0ec8aad631fe89982978d493298d223ef5c7234c12a8f2f8f765
-
Filesize
47KB
MD5afb87a066f9907d0ea7661408f374732
SHA1d437beee4a652f049bd04fe3cce68b72388adef2
SHA2566dd1e91090c119630f2a2020a8be64d3a5624204391c6d37882a8be98d3f1b7e
SHA51231517460ef7b5668010a949ede3cf400716dafe34a734c3da562d0023313984e7f561fa0e82da8f68ea54975a5e1f57ae68d38bdae57b16b998b28e08335970e
-
Filesize
165KB
MD5bd371e2e2638221df837ec146ba286d0
SHA19ae4128d6cb7f1f5433bc66aad4e4b8e98617c25
SHA256efc67526903502c7c3b8290aebc1805b6f70f1479a5eef0044af0b7c651a6b2e
SHA512fe2e1fb966fbae9dbe03fd63d8521f455d5b76385e1aeea1e81e133882618979f4cfb0f1f3e03f32cb3b43a8e286ff3b52e013703831dd68aa4d43f7d2a4cfb8
-
Filesize
493KB
MD5c8f959927cda5075843c9dbfa445dd54
SHA1624eb58211e618af822f0181f76c4aa0c474c6cd
SHA25604b8c985eea56724b7839f85506990e8da14a9f94c180449c106d71492135a4b
SHA51226fb3c660c973a540d95ed88ebecc563b7653ab6825849c48dfadb2f2751d65e68f4fead72d00dff0f41c12a80ceff59ca02a0475e5572bcf0ceff2d8830ce56
-
Filesize
223KB
MD5c751248eae2059d5ece5d97537533ff3
SHA1667265413d981a5d3c308262ee2a93a7cc7fa98c
SHA2560e7bf460f605638f226722acca9a512e6aaad7d8bb44547ee9cc8f3797fd4839
SHA5122b2da2da545e74d72c4782cf413cc9fc95ede540c8fe5588b599b07506c71285f4052c3b345c9cd2e60ef1283669dc71ecb9d815910cc4d8a4e80f4a10a1afd2
-
Filesize
1.9MB
MD58fd50e2185330eb7030694ec031411c0
SHA11a3fc8f828c9ad6f498ea8c53f4af8dad59d16b0
SHA256b41bc0321a0536b5f85a3db3b1a9322982daee9401af2471fe0d1bedcd9c1e64
SHA512cdd7392b60358c90ea10ae9ebfbd006c2cdfd29898622170707582a8079a0d456623be5ce9cb45dd40683ec26444210351bb82a9b081f5f73ec63ca1627972ea
-
Filesize
194B
MD5e89f8507221110112e092ab4beef6ad1
SHA10e7cfaf78346b0749735bc0f953fc2f8627c33de
SHA2567b10456441910267e1ffc94580b150cf63d4816574525b2f1cc1a8687c032d15
SHA512b814d87e251487ac3927a63d45c726d2a20f8f4daef6c851d1f0cfb910d49372efc968e1783e804d7d2c901a22185a228380761bb04455bcc103220004de33a1
-
Filesize
1.3MB
MD54ab989cd7ef3114ab761739948bab201
SHA14cae671dcc915dacfc136dc257cf2697d723bbf1
SHA25620627b1c938b845a24b01c9e8f97e9d938e3dfddfcf21955437579ca65828617
SHA51290a6d7e0a76826e001428a46521c5f7bc2c195770b4215553333940c3055e70349628418c291866b4a2f8d632ba10cae0d7ee64e922eee532b4fc58c1250a60b
-
Filesize
3KB
MD50be1560441bb7d12e4a0266ac2b46460
SHA10bc8a856c93bf642f9e382af50d08f7e8f5f5e04
SHA256787bb704448468b5c5ae32be30cde541078b64d3c004f22dc9dc59466fc185e1
SHA512091cafb339fe6248f9969de10851c232acd365572f8b3412f1577e2fec430456adeff0afd6e4fa1256da626186a5d62623bf87d589384d67c80a9e8dffbc4315
-
Filesize
36KB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
36KB