Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Feb. 18, 2025, 5:23 p.m.	Feb. 18, 2025, 5:25 p.m.

Size	3.7MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5	`66e88723258eb66e6831fa451494efe3`
SHA256	`f1f7c3f9ff5b1861c0b0056795e5b39f660f87ad32e750129cfdae423ed32501`
CRC32	`9A23DBC1`
ssdeep	`98304:UfyPR3cFFaec4eie3FIt0HVf9tg/Cyo2ErtfGh:USR3l15It0HVICxrt2`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature NSIS_Installer - Null Soft Installer IsPE32 - (no description) UPX_Zero - UPX packed file

utorrent_installer.exe "C:\Users\test22\AppData\Local\Temp\utorrent_installer.exe"
776
- utorrent.exe "C:\Users\test22\AppData\Local\Temp\nsnC0AC.tmp\utorrent.exe"
  2116

Name	Response	Post-Analysis Lookup
router.bittorrent.com	A 67.215.246.10	67.215.246.10
utorrent.com	A 34.201.157.226	34.201.157.226
i-6000.b-47194.ut.bench.utorrent.com	A 3.211.110.147 A 34.232.215.82 A 52.206.117.199 A 44.198.7.177 CNAME bench.utp.st A 52.86.119.244 CNAME com-utorrent-prod-bench-bt-vpc-868333863.us-east-1.elb.amazonaws.com A 18.214.172.131 A 44.217.60.159 A 54.165.124.111	3.211.110.147
legacy.utorrent.com	A 67.215.246.34	67.215.246.34
router.utorrent.com	A 82.221.103.244	82.221.103.244
update.utorrent.com	A 82.221.103.246 A 82.221.103.245	82.221.103.246
i-21.b-47194.ut.bench.utorrent.com	A 3.211.110.147 A 34.232.215.82 A 52.206.117.199 A 44.198.7.177 CNAME bench.utp.st A 52.86.119.244 CNAME com-utorrent-prod-bench-bt-vpc-868333863.us-east-1.elb.amazonaws.com A 18.214.172.131 A 44.217.60.159 A 54.165.124.111	34.232.215.82

IP Address	Status	Action
164.124.101.2	Active	Moloch
34.201.157.226	Active	Moloch
34.232.215.82	Active	Moloch
44.217.60.159	Active	Moloch
67.215.246.34	Active	Moloch
82.221.103.246	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49170 -> 34.201.157.226:80	2012247	ET P2P BTWebClient UA uTorrent in use	Potential Corporate Privacy Violation
TCP 192.168.56.103:49168 -> 67.215.246.34:80	2012247	ET P2P BTWebClient UA uTorrent in use	Potential Corporate Privacy Violation
TCP 192.168.56.103:49167 -> 34.201.157.226:80	2012247	ET P2P BTWebClient UA uTorrent in use	Potential Corporate Privacy Violation
TCP 192.168.56.103:49163 -> 44.217.60.159:80	2011227	ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))	Potentially Bad Traffic
TCP 192.168.56.103:49171 -> 67.215.246.34:80	2012247	ET P2P BTWebClient UA uTorrent in use	Potential Corporate Privacy Violation
TCP 192.168.56.103:49181 -> 82.221.103.246:80	2011706	ET P2P Bittorrent P2P Client User-Agent (uTorrent)	Potential Corporate Privacy Violation
TCP 192.168.56.103:49174 -> 82.221.103.246:80	2011706	ET P2P Bittorrent P2P Client User-Agent (uTorrent)	Potential Corporate Privacy Violation
TCP 192.168.56.103:49179 -> 82.221.103.246:80	2011706	ET P2P Bittorrent P2P Client User-Agent (uTorrent)	Potential Corporate Privacy Violation

Suricata TLS

No Suricata TLS

Uses Windows APIs to generate a cryptographic key (22 events)

Time & API	Arguments	Status	Return
CryptGenKey Feb. 12, 2025, 8:12 p.m.	crypto_handle: 0x00e347a0 algorithm_identifier: 0x00000001 () flags: 16385 key: provider_handle: 0x00e51fd8	1	1
CryptExportKey Feb. 12, 2025, 8:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00e34d60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 12, 2025, 8:12 p.m.	buffer: ¤RSA1ñ.üOP¸îµ4Qü g«?km±Ü+ÍÂPn\<Þø¤¼ÖMéäµø"ëv x¨Ð,UÙèËJq\|.µíD©_:ºÀM$Ü 0Dã4Û¢&wðª?ê½é¢¼<ÞÄI;D«UtZB£¸ crypto_handle: 0x00e34d60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 12, 2025, 8:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00e34d60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 12, 2025, 8:12 p.m.	buffer: ¤RSA1ñ.üOP¸îµ4Qü g«?km±Ü+ÍÂPn\<Þø¤¼ÖMéäµø"ëv x¨Ð,UÙèËJq\|.µíD©_:ºÀM$Ü 0Dã4Û¢&wðª?ê½é¢¼<ÞÄI;D«UtZB£¸ crypto_handle: 0x00e34d60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 12, 2025, 8:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00e34d20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 7	1	1
CryptExportKey Feb. 12, 2025, 8:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00e34d20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 7	1	1
CryptExportKey Feb. 12, 2025, 8:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00e34f20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 7	1	1
CryptExportKey Feb. 12, 2025, 8:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00e34f20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 7	1	1
CryptExportKey Feb. 12, 2025, 8:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00e34f20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 7	1	1
CryptExportKey Feb. 12, 2025, 8:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00e34f20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 7	1	1
CryptExportKey Feb. 12, 2025, 8:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00e34f20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 7	1	1
CryptExportKey Feb. 12, 2025, 8:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00e34f20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 7	1	1
CryptExportKey Feb. 12, 2025, 8:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00e34f20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 7	1	1
CryptExportKey Feb. 12, 2025, 8:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00e34f20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 7	1	1
CryptExportKey Feb. 12, 2025, 8:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00e34f20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 7	1	1
CryptExportKey Feb. 12, 2025, 8:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00e34f20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 7	1	1
CryptExportKey Feb. 12, 2025, 8:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00e34f20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 7	1	1
CryptExportKey Feb. 12, 2025, 8:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00e34f20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 7	1	1
CryptExportKey Feb. 12, 2025, 8:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00e34f20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 7	1	1
CryptExportKey Feb. 12, 2025, 8:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00e34f20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 7	1	1
CryptExportKey Feb. 12, 2025, 8:12 p.m.	buffer: ¤RSA2ñ.üOP¸îµ4Qü g«?km±Ü+ÍÂPn\<Þø¤¼ÖMéäµø"ëv x¨Ð,UÙèËJq\|.µíD©_:ºÀM$Ü 0Dã4Û¢&wðª?ê½é¢¼<ÞÄI;D«UtZB£¸uìÆh(v×AÏ>TëÆ~Õ7À"®^Kè¡:lGYõH5ëïØ`V©G±û~I ¿Òî;ÀÝfsëÇUaë<DSr(ª{£ºHÒWeÇ9g½_ïÁÚ~+i#ªokýÐé^þÍW'ðÖèW¸q`ÀÈ<ÀÌ)îK»² ia_ß¦äõI÷ó!ÐÃ°l¬pJá»Or7uµIX-q\|¦ë]}¨Æ4uîy@ æXtÛn§BMAKàJ·Íû «&9W¸Óá\|0~Ï×DeJ$_Ñ ¥ÑÔ?îÞ^æE×NF\|Gív=i®9 8Æ$D ålx-Vºá÷$7Ú'/¯¨Í?HÛ^øi®+û»08^éït\|e <Oý8(¶Ö!KB)è¿1[ùçNãÔEraf×j¸øc«÷ Ý~@È<ùþ^RW±ªî?éÂ¶ ;·äÕOåKä ¹cV±JÊÅëS~ZT1* crypto_handle: 0x00e34f20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 7	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Feb. 12, 2025, 8:12 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	POST method with no referer header				suspicious_request	POST http://i-6000.b-47194.ut.bench.utorrent.com/e?i=6000
suspicious_features	POST method with no referer header				suspicious_request	POST http://i-21.b-47194.ut.bench.utorrent.com/e?i=21

Performs some HTTP requests (7 events)

request	POST http://i-6000.b-47194.ut.bench.utorrent.com/e?i=6000
request	GET http://utorrent.com/download/langpacks/dl.php?build=47194&ref=client&client=utorrent&sys_l=ko&sel_l=28523&tk=release
request	GET http://legacy.utorrent.com/scripts/dl.php?build=47194&ref=client&client=utorrent&sys_l=ko&sel_l=28523&tk=release
request	GET http://update.utorrent.com/installoffer.php?h=4pR3xYqNmDodIgSS&v=113293402&w=1DB10106&l=ko&c=KR&w64=1&db=ie&cl=uTorrent&tsub=1&svp=4
request	POST http://i-21.b-47194.ut.bench.utorrent.com/e?i=21
request	GET http://update.utorrent.com/installstats.php?cl=uTorrent&v=113293402&h=4pR3xYqNmDodIgSS&w=1DB10106&bu=0&pr=0&cmp=0&ocmp=0&showtbexists&pid=2116&cau=0&lunv=0&tbe=0&view=win32
request	GET http://update.utorrent.com/installstats.php?cl=uTorrent&v=113293402&h=4pR3xYqNmDodIgSS&w=1DB10106&bu=0&pr=0&cmp=0&ocmp=0&showwarning&pid=2116&cau=0&lunv=0&view=win32

Sends data using the HTTP POST Method (2 events)

request	POST http://i-6000.b-47194.ut.bench.utorrent.com/e?i=6000
request	POST http://i-21.b-47194.ut.bench.utorrent.com/e?i=21

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Feb. 12, 2025, 8:12 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74275000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Feb. 12, 2025, 8:12 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74265000 process_handle: 0xffffffff	1	0	0

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (50 out of 117 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceExW Feb. 12, 2025, 8:12 p.m.	total_number_of_free_bytes: 9925980160 free_bytes_available: 9925980160 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:12 p.m.	total_number_of_free_bytes: 9925976064 free_bytes_available: 9925976064 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:12 p.m.	total_number_of_free_bytes: 9925976064 free_bytes_available: 9925976064 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:12 p.m.	total_number_of_free_bytes: 9925976064 free_bytes_available: 9925976064 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:12 p.m.	total_number_of_free_bytes: 9925976064 free_bytes_available: 9925976064 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:12 p.m.	total_number_of_free_bytes: 9925976064 free_bytes_available: 9925976064 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:12 p.m.	total_number_of_free_bytes: 9925939200 free_bytes_available: 9925939200 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:12 p.m.	total_number_of_free_bytes: 9925935104 free_bytes_available: 9925935104 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:12 p.m.	total_number_of_free_bytes: 9925935104 free_bytes_available: 9925935104 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:12 p.m.	total_number_of_free_bytes: 9925935104 free_bytes_available: 9925935104 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:12 p.m.	total_number_of_free_bytes: 9925935104 free_bytes_available: 9925935104 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:12 p.m.	total_number_of_free_bytes: 9925935104 free_bytes_available: 9925935104 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:12 p.m.	total_number_of_free_bytes: 9925935104 free_bytes_available: 9925935104 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:12 p.m.	total_number_of_free_bytes: 9925935104 free_bytes_available: 9925935104 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:12 p.m.	total_number_of_free_bytes: 9925935104 free_bytes_available: 9925935104 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:13 p.m.	total_number_of_free_bytes: 9925935104 free_bytes_available: 9925935104 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:13 p.m.	total_number_of_free_bytes: 9925935104 free_bytes_available: 9925935104 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:13 p.m.	total_number_of_free_bytes: 9925935104 free_bytes_available: 9925935104 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:13 p.m.	total_number_of_free_bytes: 9926008832 free_bytes_available: 9926008832 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:13 p.m.	total_number_of_free_bytes: 9926008832 free_bytes_available: 9926008832 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:13 p.m.	total_number_of_free_bytes: 9926008832 free_bytes_available: 9926008832 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:13 p.m.	total_number_of_free_bytes: 9926008832 free_bytes_available: 9926008832 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:13 p.m.	total_number_of_free_bytes: 9926008832 free_bytes_available: 9926008832 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:13 p.m.	total_number_of_free_bytes: 9926008832 free_bytes_available: 9926008832 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:13 p.m.	total_number_of_free_bytes: 9926008832 free_bytes_available: 9926008832 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:13 p.m.	total_number_of_free_bytes: 9924677632 free_bytes_available: 9924677632 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:13 p.m.	total_number_of_free_bytes: 9924677632 free_bytes_available: 9924677632 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:13 p.m.	total_number_of_free_bytes: 9920946176 free_bytes_available: 9920946176 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:13 p.m.	total_number_of_free_bytes: 9920946176 free_bytes_available: 9920946176 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:13 p.m.	total_number_of_free_bytes: 9920942080 free_bytes_available: 9920942080 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:13 p.m.	total_number_of_free_bytes: 9920942080 free_bytes_available: 9920942080 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:13 p.m.	total_number_of_free_bytes: 9920942080 free_bytes_available: 9920942080 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:13 p.m.	total_number_of_free_bytes: 9920942080 free_bytes_available: 9920942080 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:13 p.m.	total_number_of_free_bytes: 9920942080 free_bytes_available: 9920942080 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:13 p.m.	total_number_of_free_bytes: 9920942080 free_bytes_available: 9920942080 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:13 p.m.	total_number_of_free_bytes: 9920942080 free_bytes_available: 9920942080 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:13 p.m.	total_number_of_free_bytes: 9920942080 free_bytes_available: 9920942080 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:13 p.m.	total_number_of_free_bytes: 9920942080 free_bytes_available: 9920942080 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:13 p.m.	total_number_of_free_bytes: 9920942080 free_bytes_available: 9920942080 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:13 p.m.	total_number_of_free_bytes: 9920942080 free_bytes_available: 9920942080 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:13 p.m.	total_number_of_free_bytes: 9920942080 free_bytes_available: 9920942080 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:13 p.m.	total_number_of_free_bytes: 9920942080 free_bytes_available: 9920942080 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:13 p.m.	total_number_of_free_bytes: 9920942080 free_bytes_available: 9920942080 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:13 p.m.	total_number_of_free_bytes: 9920942080 free_bytes_available: 9920942080 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:13 p.m.	total_number_of_free_bytes: 9920942080 free_bytes_available: 9920942080 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:13 p.m.	total_number_of_free_bytes: 9920942080 free_bytes_available: 9920942080 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:13 p.m.	total_number_of_free_bytes: 9920942080 free_bytes_available: 9920942080 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:13 p.m.	total_number_of_free_bytes: 9920942080 free_bytes_available: 9920942080 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:13 p.m.	total_number_of_free_bytes: 9920942080 free_bytes_available: 9920942080 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Feb. 12, 2025, 8:13 p.m.	total_number_of_free_bytes: 9920942080 free_bytes_available: 9920942080 root_path: C:\Users\test22\AppData\Roaming\uTorrent\share total_number_of_bytes: 34252779520	1	1

Creates executable files on the filesystem (4 events)

file	C:\Users\test22\AppData\Local\Temp\nsnC0AC.tmp\utorrent.exe
file	C:\Users\test22\AppData\Local\Temp\nsnC0AC.tmp\System.dll
file	C:\Users\test22\AppData\Local\Temp\nsnC0AC.tmp\INetC.dll
file	C:\Users\test22\AppData\Local\Temp\nsnC0AC.tmp\nsisFirewall.dll

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\nsnC0AC.tmp\utorrent.exe

Drops an executable to the user AppData folder (4 events)

file	C:\Users\test22\AppData\Local\Temp\nsnC0AC.tmp\nsisFirewall.dll
file	C:\Users\test22\AppData\Local\Temp\nsnC0AC.tmp\utorrent.exe
file	C:\Users\test22\AppData\Local\Temp\nsnC0AC.tmp\System.dll
file	C:\Users\test22\AppData\Local\Temp\nsnC0AC.tmp\INetC.dll

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (39 events)

Time & API	Arguments	Status	Return
Process32FirstW Feb. 12, 2025, 8:13 p.m.	snapshot_handle: 0x00000460 process_name: [System Process] process_identifier: 0	1	1
Process32NextW Feb. 12, 2025, 8:13 p.m.	snapshot_handle: 0x00000460 process_name: System process_identifier: 4	1	1
Process32NextW Feb. 12, 2025, 8:13 p.m.	snapshot_handle: 0x00000460 process_name: smss.exe process_identifier: 232	1	1
Process32NextW Feb. 12, 2025, 8:13 p.m.	snapshot_handle: 0x00000460 process_name: csrss.exe process_identifier: 308	1	1
Process32NextW Feb. 12, 2025, 8:13 p.m.	snapshot_handle: 0x00000460 process_name: wininit.exe process_identifier: 344	1	1
Process32NextW Feb. 12, 2025, 8:13 p.m.	snapshot_handle: 0x00000460 process_name: csrss.exe process_identifier: 356	1	1
Process32NextW Feb. 12, 2025, 8:13 p.m.	snapshot_handle: 0x00000460 process_name: winlogon.exe process_identifier: 392	1	1
Process32NextW Feb. 12, 2025, 8:13 p.m.	snapshot_handle: 0x00000460 process_name: services.exe process_identifier: 436	1	1
Process32NextW Feb. 12, 2025, 8:13 p.m.	snapshot_handle: 0x00000460 process_name: lsass.exe process_identifier: 452	1	1
Process32NextW Feb. 12, 2025, 8:13 p.m.	snapshot_handle: 0x00000460 process_name: lsm.exe process_identifier: 460	1	1
Process32NextW Feb. 12, 2025, 8:13 p.m.	snapshot_handle: 0x00000460 process_name: svchost.exe process_identifier: 560	1	1
Process32NextW Feb. 12, 2025, 8:13 p.m.	snapshot_handle: 0x00000460 process_name: svchost.exe process_identifier: 636	1	1
Process32NextW Feb. 12, 2025, 8:13 p.m.	snapshot_handle: 0x00000460 process_name: svchost.exe process_identifier: 716	1	1
Process32NextW Feb. 12, 2025, 8:13 p.m.	snapshot_handle: 0x00000460 process_name: svchost.exe process_identifier: 780	1	1
Process32NextW Feb. 12, 2025, 8:13 p.m.	snapshot_handle: 0x00000460 process_name: svchost.exe process_identifier: 824	1	1
Process32NextW Feb. 12, 2025, 8:13 p.m.	snapshot_handle: 0x00000460 process_name: audiodg.exe process_identifier: 896	1	1
Process32NextW Feb. 12, 2025, 8:13 p.m.	snapshot_handle: 0x00000460 process_name: svchost.exe process_identifier: 984	1	1
Process32NextW Feb. 12, 2025, 8:13 p.m.	snapshot_handle: 0x00000460 process_name: svchost.exe process_identifier: 340	1	1
Process32NextW Feb. 12, 2025, 8:13 p.m.	snapshot_handle: 0x00000460 process_name: spoolsv.exe process_identifier: 1060	1	1
Process32NextW Feb. 12, 2025, 8:13 p.m.	snapshot_handle: 0x00000460 process_name: taskhost.exe process_identifier: 1112	1	1
Process32NextW Feb. 12, 2025, 8:13 p.m.	snapshot_handle: 0x00000460 process_name: svchost.exe process_identifier: 1120	1	1
Process32NextW Feb. 12, 2025, 8:13 p.m.	snapshot_handle: 0x00000460 process_name: dwm.exe process_identifier: 1192	1	1
Process32NextW Feb. 12, 2025, 8:13 p.m.	snapshot_handle: 0x00000460 process_name: explorer.exe process_identifier: 1236	1	1
Process32NextW Feb. 12, 2025, 8:13 p.m.	snapshot_handle: 0x00000460 process_name: svchost.exe process_identifier: 1744	1	1
Process32NextW Feb. 12, 2025, 8:13 p.m.	snapshot_handle: 0x00000460 process_name: pw.exe process_identifier: 1888	1	1
Process32NextW Feb. 12, 2025, 8:13 p.m.	snapshot_handle: 0x00000460 process_name: SearchIndexer.exe process_identifier: 1652	1	1
Process32NextW Feb. 12, 2025, 8:13 p.m.	snapshot_handle: 0x00000460 process_name: pw.exe process_identifier: 288	1	1
Process32NextW Feb. 12, 2025, 8:13 p.m.	snapshot_handle: 0x00000460 process_name: taskhost.exe process_identifier: 804	1	1
Process32NextW Feb. 12, 2025, 8:13 p.m.	snapshot_handle: 0x00000460 process_name: SearchProtocolHost.exe process_identifier: 1344	1	1
Process32NextW Feb. 12, 2025, 8:13 p.m.	snapshot_handle: 0x00000460 process_name: utorrent_installer.exe process_identifier: 776	1	1
Process32NextW Feb. 12, 2025, 8:13 p.m.	snapshot_handle: 0x00000460 process_name: SearchFilterHost.exe process_identifier: 2032	1	1
Process32NextW Feb. 12, 2025, 8:13 p.m.	snapshot_handle: 0x00000460 process_name: utorrent.exe process_identifier: 2116	1	1
Process32NextW Feb. 12, 2025, 8:13 p.m.	snapshot_handle: 0x00000460 process_name: svchost.exe process_identifier: 2332	1	1
Process32NextW Feb. 12, 2025, 8:13 p.m.	snapshot_handle: 0x00000460 process_name: mscorsvw.exe process_identifier: 2360	1	1
Process32NextW Feb. 12, 2025, 8:13 p.m.	snapshot_handle: 0x00000460 process_name: mscorsvw.exe process_identifier: 2400	1	1
Process32NextW Feb. 12, 2025, 8:13 p.m.	snapshot_handle: 0x00000460 process_name: sppsvc.exe process_identifier: 2452	1	1
Process32NextW Feb. 12, 2025, 8:13 p.m.	snapshot_handle: 0x00000460 process_name: cmd.exe process_identifier: 2548	1	1
Process32NextW Feb. 12, 2025, 8:13 p.m.	snapshot_handle: 0x00000460 process_name: conhost.exe process_identifier: 2556	1	1
Process32NextW Feb. 12, 2025, 8:13 p.m.	snapshot_handle: 0x00000460 process_name: pw.exe process_identifier: 2580	1	1

File has been identified by 7 AntiVirus engines on VirusTotal as malicious (7 events)

ESET-NOD32	a variant of Win32/uTorrent.E potentially unwanted
Antiy-AVL	GrayWare/Win32.uTorrent.e
DeepInstinct	MALICIOUS
VBA32	suspected of Trojan.Downloader.gen
Malwarebytes	PUP.Optional.BundleInstaller
Ikarus	PUA.uTorrent
Fortinet	Riskware/uTorrent.E6A1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Feb. 12, 2025, 8:12 p.m.	flags: 46 family: 2		111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0001c600', u'virtual_address': u'0x00050000', u'entropy': 7.209826701068137, u'name': u'.rsrc', u'virtual_size': u'0x0001c600'}

entropy

7.20982670107

description

A section with a high entropy has been found

entropy

0.780068728522

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Feb. 12, 2025, 8:12 p.m.	system_name: privilege_name: SeManageVolumePrivilege	1	1	0

Queries for potentially installed applications (3 events)

Time & API	Arguments	Return
RegOpenKeyExW Feb. 12, 2025, 8:12 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent	2
RegOpenKeyExW Feb. 12, 2025, 8:13 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent	2
RegOpenKeyExW Feb. 12, 2025, 8:13 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent	2

Deletes executed files from disk (1 event)

file	C:\Users\test22\AppData\Local\Temp\nsnC0AC.tmp

Disables proxy possibly for traffic interception (1 event)

Time & API	Arguments	Status	Return	Repeated
RegSetValueExA Feb. 12, 2025, 8:13 p.m.	key_handle: 0x000004e8 regkey_r: ProxyEnable reg_type: 4 (REG_DWORD) value: 0 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable	1	0	0

Network activity contains more than one unique useragent (2 events)

process	utorrent_installer.exe				useragent	NSIS_Inetc (Mozilla)
process	utorrent.exe				useragent	uTorrent(47194105433.6

Detects the presence of Wine emulator (1 event)

registry

HKEY_CURRENT_USER\Software\Wine

utorrent_installer.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All