analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

utweb_installer.exe

Full analysis: https://app.any.run/tasks/cc5b8ac4-e593-4e02-946f-00a0d5b95c56
Verdict: Malicious activity
Analysis date: February 15, 2024, 03:20:17
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

D2EDD3DFE864A7C9F404EEAF31876B54

SHA1:

78BD37C62D63696BC709BB8CF5606EFA6E99ACFA

SHA256:

7F55C694A91D6FE4FB57E0BECBE0A2494D2A7B16CB7B72E01DC5B8E3205FB3AF

SSDEEP:

24576:37FUDowAyrTVE3U5FxMuvlzqEBd4U1u5QS2q5RqSb3G56T9A+7pqRb5n:3BuZrEUlLtzbpAzRO56OsYRp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • utweb_installer.exe (PID: 2472)
      • utweb_installer.exe (PID: 2848)
      • utweb_installer.tmp (PID: 2840)
      • utweb_installer.exe (PID: 3212)
      • saBSI.exe (PID: 2208)
      • saBSI.exe (PID: 696)
      • installer.exe (PID: 2644)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • utweb_installer.exe (PID: 2472)
      • utweb_installer.exe (PID: 2848)
      • utweb_installer.tmp (PID: 2840)
      • utweb_installer.exe (PID: 3212)
      • saBSI.exe (PID: 2208)
      • saBSI.exe (PID: 696)
      • installer.exe (PID: 2644)

    • Reads the Windows owner or organization settings

      • utweb_installer.tmp (PID: 2840)

    • Reads settings of System Certificates

      • utweb_installer.tmp (PID: 2840)
      • saBSI.exe (PID: 2208)
      • saBSI.exe (PID: 696)

    • Reads the Internet Settings

      • utweb_installer.tmp (PID: 2840)
      • utweb_installer.exe (PID: 3212)
      • saBSI.exe (PID: 2208)
      • saBSI.exe (PID: 696)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • utweb_installer.exe (PID: 3212)

    • The process creates files with name similar to system file names

      • utweb_installer.exe (PID: 3212)

    • Process drops legitimate windows executable

      • utweb_installer.exe (PID: 3212)

    • Reads security settings of Internet Explorer

      • utweb_installer.tmp (PID: 2840)
      • utweb_installer.exe (PID: 3212)
      • saBSI.exe (PID: 2208)
      • saBSI.exe (PID: 696)

    • Checks Windows Trust Settings

      • saBSI.exe (PID: 2208)
      • saBSI.exe (PID: 696)

    • Adds/modifies Windows certificates

      • saBSI.exe (PID: 2208)

    • The process verifies whether the antivirus software is installed

      • saBSI.exe (PID: 696)
      • installer.exe (PID: 2596)
      • installer.exe (PID: 2644)

  • INFO

    • Create files in a temporary directory

      • utweb_installer.exe (PID: 2472)
      • utweb_installer.exe (PID: 2848)
      • utweb_installer.tmp (PID: 2840)
      • utweb_installer.exe (PID: 3212)
      • saBSI.exe (PID: 2208)

    • Checks supported languages

      • utweb_installer.tmp (PID: 3864)
      • utweb_installer.exe (PID: 2472)
      • utweb_installer.exe (PID: 2848)
      • utweb_installer.tmp (PID: 2840)
      • utweb_installer.exe (PID: 3212)
      • saBSI.exe (PID: 2208)
      • saBSI.exe (PID: 696)
      • installer.exe (PID: 2644)

    • Reads the computer name

      • utweb_installer.tmp (PID: 3864)
      • utweb_installer.tmp (PID: 2840)
      • utweb_installer.exe (PID: 3212)
      • saBSI.exe (PID: 2208)
      • saBSI.exe (PID: 696)

    • Reads the machine GUID from the registry

      • utweb_installer.tmp (PID: 2840)
      • utweb_installer.exe (PID: 3212)
      • saBSI.exe (PID: 2208)
      • saBSI.exe (PID: 696)

    • Reads the software policy settings

      • utweb_installer.tmp (PID: 2840)
      • saBSI.exe (PID: 2208)
      • saBSI.exe (PID: 696)

    • Creates files or folders in the user directory

      • utweb_installer.exe (PID: 3212)
      • saBSI.exe (PID: 2208)

    • Creates a software uninstall entry

      • utweb_installer.exe (PID: 3212)

    • Checks proxy server information

      • utweb_installer.exe (PID: 3212)

    • Creates files in the program directory

      • saBSI.exe (PID: 2208)
      • installer.exe (PID: 2644)
      • saBSI.exe (PID: 696)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (65.1)
.exe | Win32 EXE PECompact compressed (generic) (24.6)
.dll | Win32 Dynamic Link Library (generic) (3.9)
.exe | Win32 Executable (generic) (2.6)
.exe | Win16/32 Executable Delphi generic (1.2)

EXIF

EXE

ProductVersion: 1.3
ProductName: uTorrent Web®
OriginalFileName:
LegalCopyright: ©2022 RainBerry Inc. All Rights Reserved
FileVersion: 1.3
FileDescription: uTorrent Web®
CompanyName:
Comments: This installation was built with Inno Setup.
CharacterSet: Unicode
LanguageCode: Neutral
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 1.3.0.0
FileVersionNumber: 1.3.0.0
Subsystem: Windows GUI
SubsystemVersion: 6.1
ImageVersion: 6
OSVersion: 6.1
EntryPoint: 0xb5eec
UninitializedDataSize: -
InitializedDataSize: 76288
CodeSize: 741888
LinkerVersion: 2.25
PEType: PE32
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
TimeStamp: 2022:04:14 16:10:23+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
9
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
start utweb_installer.exe utweb_installer.tmp no specs utweb_installer.exe utweb_installer.tmp utweb_installer.exe sabsi.exe sabsi.exe installer.exe installer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2472"C:\Users\admin\AppData\Local\Temp\utweb_installer.exe" C:\Users\admin\AppData\Local\Temp\utweb_installer.exe
explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
uTorrent Web®
Version:
1.3
Modules
Images
c:\users\admin\appdata\local\temp\utweb_installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3864"C:\Users\admin\AppData\Local\Temp\is-FNJV7.tmp\utweb_installer.tmp" /SL5="$E0170,898126,819200,C:\Users\admin\AppData\Local\Temp\utweb_installer.exe" C:\Users\admin\AppData\Local\Temp\is-FNJV7.tmp\utweb_installer.tmp—utweb_installer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-fnjv7.tmp\utweb_installer.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2848"C:\Users\admin\AppData\Local\Temp\utweb_installer.exe" /SPAWNWND=$18013E /NOTIFYWND=$E0170 C:\Users\admin\AppData\Local\Temp\utweb_installer.exe
utweb_installer.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
uTorrent Web®
Version:
1.3
Modules
Images
c:\users\admin\appdata\local\temp\utweb_installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2840"C:\Users\admin\AppData\Local\Temp\is-7PV5J.tmp\utweb_installer.tmp" /SL5="$100130,898126,819200,C:\Users\admin\AppData\Local\Temp\utweb_installer.exe" /SPAWNWND=$18013E /NOTIFYWND=$E0170 C:\Users\admin\AppData\Local\Temp\is-7PV5J.tmp\utweb_installer.tmp
utweb_installer.exe
User:
admin
Company:
Integrity Level:
HIGH
Description:
Setup/Uninstall
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-7pv5j.tmp\utweb_installer.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3212"C:\Users\admin\AppData\Local\Temp\is-D0RP5.tmp\utweb_installer.exe" /SC:\Users\admin\AppData\Local\Temp\is-D0RP5.tmp\utweb_installer.exe
utweb_installer.tmp
User:
admin
Company:
BitTorrent Limited
Integrity Level:
HIGH
Description:
uTorrent Web
Exit code:
0
Version:
1.4.0.5759
Modules
Images
c:\users\admin\appdata\local\temp\is-d0rp5.tmp\utweb_installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
2208"C:\Users\admin\AppData\Local\Temp\is-D0RP5.tmp\component0_extract\saBSI.exe" /affid 91082 PaidDistribution=true CountryCode=DEC:\Users\admin\AppData\Local\Temp\is-D0RP5.tmp\component0_extract\saBSI.exe
utweb_installer.tmp
User:
admin
Company:
McAfee, LLC
Integrity Level:
HIGH
Description:
McAfee WebAdvisor(bootstrap installer)
Version:
4,1,1,818
Modules
Images
c:\users\admin\appdata\local\temp\is-d0rp5.tmp\component0_extract\sabsi.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
696"C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe" /install /affid 91082 PaidDistribution=true saBsiVersion=4.1.1.818 CountryCode=DE /no_self_updateC:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe
saBSI.exe
User:
admin
Company:
McAfee, LLC
Integrity Level:
HIGH
Description:
McAfee WebAdvisor(bootstrap installer)
Version:
4,1,1,865
Modules
Images
c:\programdata\mcafee\webadvisor\sabsi\sabsi.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
2644"C:\ProgramData\McAfee\WebAdvisor\saBSI\\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe
saBSI.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\programdata\mcafee\webadvisor\sabsi\installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
2596"C:\Program Files\McAfee\Temp2420609367\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade C:\Program Files\McAfee\Temp2420609367\installer.exe—installer.exe
User:
admin
Company:
McAfee, LLC
Integrity Level:
HIGH
Description:
McAfee WebAdvisor(installer)
Version:
4,1,1,866
Modules
Images
c:\program files\mcafee\temp2420609367\installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\bcrypt.dll
Total events
25 016
Read events
24 891
Write events
108
Delete events
17

Modification events

(PID) Process:(2840) utweb_installer.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
180B0000E04CCFEBBD5FDA01
(PID) Process:(2840) utweb_installer.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
769E7FEEEDB6258F9FF6CA4D126959763DBCF10DC03B1D849DAFEDB16DCC8218
(PID) Process:(2840) utweb_installer.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(2840) utweb_installer.tmpKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2840) utweb_installer.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates
Operation:delete valueName:9F6134C5FA75E4FDDE631B232BE961D6D4B97DB6
Value:
(PID) Process:(2840) utweb_installer.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\9F6134C5FA75E4FDDE631B232BE961D6D4B97DB6
Operation:writeName:Blob
Value:
0F00000001000000200000009065F32AFC2CFEA7F452D2D6BE94D20C877EFC1C05433D9935696193FDCC05D80300000001000000140000009F6134C5FA75E4FDDE631B232BE961D6D4B97DB6200000000100000047030000308203433082022BA00302010202147327B7C17D5AE708EF73F1F45A79D78B4E99A29F300D06092A864886F70D01010B05003031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C084469676943657274301E170D3233303932393130353030335A170D3339303530383130353030335A3031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C08446967694365727430820122300D06092A864886F70D01010105000382010F003082010A0282010100D91B7A55548F44F3E97C493153B75B055695736B184640D7335A2E6218083B5A1BEE2695209350E57A3EB76FBC604CB3B250DF3D9D0C560D1FBDFE30108D233A3C555100BE1A3F8E543C0B253E06E91B6D5F9CB3A093009BC8B4D3A0EB19DB59E56DA7E3D637847970D6C2AEB4A1FCF3896A7C080FE68759BAA62E6AAA8B7C7CBDA176DDC72F8D259A16D3469E31F19D2959904611D730D7D26FCFED789A0C49698FDFABF3F6727D08C61A073BB11E85C96486D49B0E0D38364C008A5EB964F8813C5DF004F9E76D2F8DB90702D800032674959BF0DF823785419101CEA928A10ACBAE7E48FE19202F3CB7BCF416476D17CB64C5570FCED443BD75D9F2C632FF0203010001A3533051301D0603551D0E041604145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7301F0603551D230418301680145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7300F0603551D130101FF040530030101FF300D06092A864886F70D01010B05000382010100AF2218E4CA18144728FCC76EA14958061522FD4A018BED1A4BFCC5CCE70BC6AE9DF7D3795C9A010D53628E2B6E7C10D6B07E53546235A5EE480E5A434E312154BF1E39AAC27D2C18D4F41CBBECFE4538CEF93EF62C17D187A7F720F4A9478410D09620C9F8B293B5786A5440BC0743B7B7753CF66FBA498B7E083BC267597238DC031B9BB131F997D9B8164AAED0D6E328420E53E1969DA6CD035078179677A7177BB2BF9C87CF592910CD380E8501B92040A39469C782BA383BEAE498C060FCC7C429BC10B7B6B7A0659C9BE03DC13DB46C638CF5E3B22A303726906DC8DD91C64501EBFC282A3A497EC430CACC066EE4BF9C5C8F2F2A05D0C1921A9E3E85E3
(PID) Process:(2840) utweb_installer.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\9F6134C5FA75E4FDDE631B232BE961D6D4B97DB6
Operation:writeName:Blob
Value:
1400000001000000140000005D6CA352CEFC713CBBC5E21F663C3639FD19D4D70300000001000000140000009F6134C5FA75E4FDDE631B232BE961D6D4B97DB60F00000001000000200000009065F32AFC2CFEA7F452D2D6BE94D20C877EFC1C05433D9935696193FDCC05D8200000000100000047030000308203433082022BA00302010202147327B7C17D5AE708EF73F1F45A79D78B4E99A29F300D06092A864886F70D01010B05003031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C084469676943657274301E170D3233303932393130353030335A170D3339303530383130353030335A3031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C08446967694365727430820122300D06092A864886F70D01010105000382010F003082010A0282010100D91B7A55548F44F3E97C493153B75B055695736B184640D7335A2E6218083B5A1BEE2695209350E57A3EB76FBC604CB3B250DF3D9D0C560D1FBDFE30108D233A3C555100BE1A3F8E543C0B253E06E91B6D5F9CB3A093009BC8B4D3A0EB19DB59E56DA7E3D637847970D6C2AEB4A1FCF3896A7C080FE68759BAA62E6AAA8B7C7CBDA176DDC72F8D259A16D3469E31F19D2959904611D730D7D26FCFED789A0C49698FDFABF3F6727D08C61A073BB11E85C96486D49B0E0D38364C008A5EB964F8813C5DF004F9E76D2F8DB90702D800032674959BF0DF823785419101CEA928A10ACBAE7E48FE19202F3CB7BCF416476D17CB64C5570FCED443BD75D9F2C632FF0203010001A3533051301D0603551D0E041604145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7301F0603551D230418301680145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7300F0603551D130101FF040530030101FF300D06092A864886F70D01010B05000382010100AF2218E4CA18144728FCC76EA14958061522FD4A018BED1A4BFCC5CCE70BC6AE9DF7D3795C9A010D53628E2B6E7C10D6B07E53546235A5EE480E5A434E312154BF1E39AAC27D2C18D4F41CBBECFE4538CEF93EF62C17D187A7F720F4A9478410D09620C9F8B293B5786A5440BC0743B7B7753CF66FBA498B7E083BC267597238DC031B9BB131F997D9B8164AAED0D6E328420E53E1969DA6CD035078179677A7177BB2BF9C87CF592910CD380E8501B92040A39469C782BA383BEAE498C060FCC7C429BC10B7B6B7A0659C9BE03DC13DB46C638CF5E3B22A303726906DC8DD91C64501EBFC282A3A497EC430CACC066EE4BF9C5C8F2F2A05D0C1921A9E3E85E3
(PID) Process:(2840) utweb_installer.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\9F6134C5FA75E4FDDE631B232BE961D6D4B97DB6
Operation:writeName:Blob
Value:
190000000100000010000000BCC80DAA2F98A4692805BFF4CBB372EB0F00000001000000200000009065F32AFC2CFEA7F452D2D6BE94D20C877EFC1C05433D9935696193FDCC05D80300000001000000140000009F6134C5FA75E4FDDE631B232BE961D6D4B97DB61400000001000000140000005D6CA352CEFC713CBBC5E21F663C3639FD19D4D7200000000100000047030000308203433082022BA00302010202147327B7C17D5AE708EF73F1F45A79D78B4E99A29F300D06092A864886F70D01010B05003031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C084469676943657274301E170D3233303932393130353030335A170D3339303530383130353030335A3031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C08446967694365727430820122300D06092A864886F70D01010105000382010F003082010A0282010100D91B7A55548F44F3E97C493153B75B055695736B184640D7335A2E6218083B5A1BEE2695209350E57A3EB76FBC604CB3B250DF3D9D0C560D1FBDFE30108D233A3C555100BE1A3F8E543C0B253E06E91B6D5F9CB3A093009BC8B4D3A0EB19DB59E56DA7E3D637847970D6C2AEB4A1FCF3896A7C080FE68759BAA62E6AAA8B7C7CBDA176DDC72F8D259A16D3469E31F19D2959904611D730D7D26FCFED789A0C49698FDFABF3F6727D08C61A073BB11E85C96486D49B0E0D38364C008A5EB964F8813C5DF004F9E76D2F8DB90702D800032674959BF0DF823785419101CEA928A10ACBAE7E48FE19202F3CB7BCF416476D17CB64C5570FCED443BD75D9F2C632FF0203010001A3533051301D0603551D0E041604145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7301F0603551D230418301680145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7300F0603551D130101FF040530030101FF300D06092A864886F70D01010B05000382010100AF2218E4CA18144728FCC76EA14958061522FD4A018BED1A4BFCC5CCE70BC6AE9DF7D3795C9A010D53628E2B6E7C10D6B07E53546235A5EE480E5A434E312154BF1E39AAC27D2C18D4F41CBBECFE4538CEF93EF62C17D187A7F720F4A9478410D09620C9F8B293B5786A5440BC0743B7B7753CF66FBA498B7E083BC267597238DC031B9BB131F997D9B8164AAED0D6E328420E53E1969DA6CD035078179677A7177BB2BF9C87CF592910CD380E8501B92040A39469C782BA383BEAE498C060FCC7C429BC10B7B6B7A0659C9BE03DC13DB46C638CF5E3B22A303726906DC8DD91C64501EBFC282A3A497EC430CACC066EE4BF9C5C8F2F2A05D0C1921A9E3E85E3
(PID) Process:(3212) utweb_installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\utweb
Operation:writeName:UninstallString
Value:
"C:\Users\admin\AppData\Roaming\uTorrent Web\Uninstall.exe"
(PID) Process:(3212) utweb_installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\utweb
Operation:writeName:QuietUninstallString
Value:
"C:\Users\admin\AppData\Roaming\uTorrent Web\Uninstall.exe" /S
Executable files
26
Suspicious files
35
Text files
126
Unknown types
3

Dropped files

PID
Process
Filename
Type
2840utweb_installer.tmpC:\Users\admin\AppData\Local\Temp\is-D0RP5.tmp\license.rtftext
MD5:CA9C80605FF244AE36C584FFFFA09435
SHA256:81C21179CB42FA44D8B7AA07925081B899F0EF5F18AC00FFB75B303309078634
2848utweb_installer.exeC:\Users\admin\AppData\Local\Temp\is-7PV5J.tmp\utweb_installer.tmpexecutable
MD5:D3A53D6416010B37092E1D3BD40D06F3
SHA256:01811C8136CCDBA334700672C1007BFAC48027251E5600266C3749A59D6B3C90
3212utweb_installer.exeC:\Users\admin\AppData\Local\Temp\nsrC34C.tmp\UAC.dllexecutable
MD5:ADB29E6B186DAA765DC750128649B63D
SHA256:2F7F8FC05DC4FD0D5CDA501B47E4433357E887BBFED7292C028D99C73B52DC08
2840utweb_installer.tmpC:\Users\admin\AppData\Local\Temp\is-D0RP5.tmp\component0compressed
MD5:CD9C77BC5840AF008799985F397FE1C3
SHA256:26D7704B540DF18E2BCCD224DF677061FFB9F03CAB5B3C191055A84BF43A9085
2840utweb_installer.tmpC:\Users\admin\AppData\Local\Temp\is-D0RP5.tmp\Logo.pngimage
MD5:A00CFE887E254C462AD0C6A6D3FB25B6
SHA256:BCA0271F56F7384942FF3AFFB79FA78CCDCEABF7DDA89AD3C138226DA324CDB1
2840utweb_installer.tmpC:\Users\admin\AppData\Local\Temp\is-D0RP5.tmp\is-N4COU.tmpimage
MD5:4CFFF8DC30D353CD3D215FD3A5DBAC24
SHA256:0C430E56D69435D8AB31CBB5916A73A47D11EF65B37D289EE7D11130ADF25856
3212utweb_installer.exeC:\Users\admin\AppData\Roaming\uTorrent Web\localization\es-la.langtext
MD5:3205881F5139242227F5513E80091461
SHA256:80A398E4A040FC95F40167FF18E8866625F74FF2230C5C181E8DA985641D0C95
3212utweb_installer.exeC:\Users\admin\AppData\Roaming\uTorrent Web\localization\it.langtext
MD5:8174C1F56BF731097B872A9FDF499EDF
SHA256:EC1E9FA1CD24181AEB7695BFFEF8AB782CE89962782A8E48169E1BA364D0F82F
2472utweb_installer.exeC:\Users\admin\AppData\Local\Temp\is-FNJV7.tmp\utweb_installer.tmpexecutable
MD5:D3A53D6416010B37092E1D3BD40D06F3
SHA256:01811C8136CCDBA334700672C1007BFAC48027251E5600266C3749A59D6B3C90
2840utweb_installer.tmpC:\Users\admin\AppData\Local\Temp\is-D0RP5.tmp\is-4VOBR.tmpexecutable
MD5:BF80F081A1BCA709768CD5CC821AFA69
SHA256:7DE806589101FC194605D1050550E1F0D68EC009BB08C34D933D365E60653BD8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
16
DNS requests
9
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3212
utweb_installer.exe
POST
200
52.201.74.176:80
http://i-4101.b-5759.utweb.bench.utorrent.com/e?i=4101
unknown
binary
21 b
unknown
3212
utweb_installer.exe
POST
200
52.201.74.176:80
http://i-4101.b-5759.utweb.bench.utorrent.com/e?i=4101
unknown
binary
21 b
unknown
2208
saBSI.exe
GET
200
184.51.252.181:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?20325c7cc5b17748
unknown
compressed
65.2 Kb
unknown
2208
saBSI.exe
GET
200
104.18.21.226:80
http://secure.globalsign.com/cacert/codesigningrootr45.crt
unknown
binary
1.37 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2840
utweb_installer.tmp
52.222.250.13:443
d1l01jcxbbibur.cloudfront.net
AMAZON-02
US
unknown
2840
utweb_installer.tmp
18.244.20.91:443
d2mtgzpe3oxui1.cloudfront.net
—
US
unknown
2840
utweb_installer.tmp
18.244.20.56:443
d3f0qojj8iibhd.cloudfront.net
—
US
unknown
2840
utweb_installer.tmp
67.215.238.66:443
download-lb.utorrent.com
ASN-QUADRANET-GLOBAL
US
unknown
3212
utweb_installer.exe
52.201.74.176:80
i-4101.b-5759.utweb.bench.utorrent.com
AMAZON-AES
US
unknown
2208
saBSI.exe
54.186.98.176:443
analytics.apis.mcafee.com
AMAZON-02
US
unknown
2208
saBSI.exe
79.140.80.11:443
sadownload.mcafee.com
TELECOM ITALIA SPARKLE S.p.A.
IT
unknown

DNS requests

Domain
IP
Reputation
d1l01jcxbbibur.cloudfront.net
  • 52.222.250.13
  • 52.222.250.187
  • 52.222.250.121
  • 52.222.250.14
unknown
d2mtgzpe3oxui1.cloudfront.net
  • 18.244.20.91
  • 18.244.20.170
  • 18.244.20.39
  • 18.244.20.157
unknown
d3f0qojj8iibhd.cloudfront.net
  • 18.244.20.56
  • 18.244.20.20
  • 18.244.20.167
  • 18.244.20.159
unknown
download-lb.utorrent.com
  • 67.215.238.66
whitelisted
i-4101.b-5759.utweb.bench.utorrent.com
  • 52.201.74.176
  • 52.71.154.75
  • 52.3.64.205
  • 50.19.187.179
  • 52.54.56.233
  • 52.0.239.234
  • 52.44.142.17
  • 52.21.130.224
unknown
analytics.apis.mcafee.com
  • 54.186.98.176
  • 34.210.155.11
  • 52.37.177.163
  • 52.42.138.59
  • 52.35.43.151
  • 44.229.111.163
  • 35.166.231.213
  • 34.215.214.205
unknown
sadownload.mcafee.com
  • 79.140.80.11
  • 79.140.80.32
whitelisted
secure.globalsign.com
  • 104.18.21.226
  • 104.18.20.226
whitelisted
ctldl.windowsupdate.com
  • 184.51.252.181
  • 184.51.252.196
whitelisted

Threats

PID
Process
Class
Message
3212
utweb_installer.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
3212
utweb_installer.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
Process
Message
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in current directory
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in EXE directory
saBSI.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\is-D0RP5.tmp\component0_extract\saBSI.exe loading C:\Users\admin\AppData\Local\Temp\is-D0RP5.tmp\component0_extract\mfeaaca.dll, WinVerifyTrust failed with 80092003
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in current directory
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in EXE directory
saBSI.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\is-D0RP5.tmp\component0_extract\saBSI.exe loading C:\Users\admin\AppData\Local\Temp\is-D0RP5.tmp\component0_extract\mfeaaca.dll, WinVerifyTrust failed with 80092003
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in current directory
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in EXE directory
saBSI.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\is-D0RP5.tmp\component0_extract\saBSI.exe loading C:\Users\admin\AppData\Local\Temp\is-D0RP5.tmp\component0_extract\mfeaaca.dll, WinVerifyTrust failed with 80092003
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in current directory
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
utweb_installer.exe