Malware analysis utweb_installer.exe Malicious activity

analyze malware

Huge database of samples and IOCs
Custom VM setup
Unlimited submissions
Interactive approach

Add for printing

File name:	utweb_installer.exe
Full analysis:	https://app.any.run/tasks/8241426f-9b9f-47db-a6b9-1cdf16a8e2f4
Verdict:	Malicious activity
Threats:	A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. Malware Trends Tracker >>>
Analysis date:	August 02, 2024 at 04:03:22
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	installer stealer loader
Indicators:
MIME:	application/x-dosexec
File info:	PE32 executable (GUI) Intel 80386, for MS Windows
MD5:	79906E2CFAD2738D0DAC73211C1C400D
SHA1:	242187447B286F2777842A37204AC09F5A17580E
SHA256:	D7D59CC033BDF12A0139B614F9CF9AC5EAA43BF27F5EA230444827FDE0A08DF3
SSDEEP:	49152:h7HecD4dnbibBlyUIsg88xnh+Dp/U5NHNIwKr8K2+S95dzyKCbslnTiVOAli2jW1:J+cD4dnX9Yum/U5NtIroK2ndW5b3vcl/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Drops the executable file immediately after the start
  - utweb_installer.exe (PID: 6392)
  - utweb_installer.exe (PID: 6492)
  - utweb_installer.tmp (PID: 6516)
  - utweb_installer.exe (PID: 5504)
  - component0.exe (PID: 5996)
  - ke5zzkgs.exe (PID: 6368)
  - UnifiedStub-installer.exe (PID: 1044)
  - utweb.exe (PID: 3104)
- Changes the autorun value in the registry
  - utweb.exe (PID: 3104)
- Actions looks like stealing of personal data
  - UnifiedStub-installer.exe (PID: 1044)
SUSPICIOUS
- Executable content was dropped or overwritten
  - utweb_installer.exe (PID: 6392)
  - utweb_installer.exe (PID: 6492)
  - utweb_installer.tmp (PID: 6516)
  - utweb_installer.exe (PID: 5504)
  - component0.exe (PID: 5996)
  - ke5zzkgs.exe (PID: 6368)
  - UnifiedStub-installer.exe (PID: 1044)
  - utweb.exe (PID: 3104)
- Reads security settings of Internet Explorer
  - utweb_installer.tmp (PID: 6412)
  - utweb_installer.exe (PID: 5504)
  - utweb_installer.tmp (PID: 6516)
  - component0.exe (PID: 5996)
  - utweb.exe (PID: 3104)
- Reads the date of Windows installation
  - utweb_installer.tmp (PID: 6412)
  - utweb_installer.tmp (PID: 6516)
  - component0.exe (PID: 5996)
- Reads the Windows owner or organization settings
  - utweb_installer.tmp (PID: 6516)
- Mutex name with non-standard characters
  - utweb_installer.tmp (PID: 6516)
- The process creates files with name similar to system file names
  - utweb_installer.exe (PID: 5504)
- Malware-specific behavior (creating "System.dll" in Temp)
  - utweb_installer.exe (PID: 5504)
- Process drops legitimate windows executable
  - utweb_installer.exe (PID: 5504)
  - ke5zzkgs.exe (PID: 6368)
- Potential Corporate Privacy Violation
  - utweb.exe (PID: 3104)
- Searches for installed software
  - UnifiedStub-installer.exe (PID: 1044)
- Creates a software uninstall entry
  - UnifiedStub-installer.exe (PID: 1044)
- Executes as Windows Service
  - rsSyncSvc.exe (PID: 1636)
- Executes application which crashes
  - utweb_installer.tmp (PID: 6516)
- Checks Windows Trust Settings
  - utweb.exe (PID: 3104)
INFO
- Create files in a temporary directory
  - utweb_installer.exe (PID: 6392)
  - utweb_installer.exe (PID: 6492)
  - utweb_installer.tmp (PID: 6516)
  - utweb_installer.exe (PID: 5504)
  - component0.exe (PID: 5996)
  - ke5zzkgs.exe (PID: 6368)
- Checks supported languages
  - utweb_installer.exe (PID: 6392)
  - utweb_installer.tmp (PID: 6412)
  - utweb_installer.exe (PID: 6492)
  - utweb_installer.tmp (PID: 6516)
  - utweb_installer.exe (PID: 5504)
  - component0.exe (PID: 5996)
  - ke5zzkgs.exe (PID: 6368)
  - UnifiedStub-installer.exe (PID: 1044)
  - utweb.exe (PID: 3104)
  - rsSyncSvc.exe (PID: 3352)
  - rsSyncSvc.exe (PID: 1636)
  - identity_helper.exe (PID: 7504)
  - helper.exe (PID: 8888)
- Reads the computer name
  - utweb_installer.tmp (PID: 6412)
  - utweb_installer.tmp (PID: 6516)
  - utweb_installer.exe (PID: 5504)
  - component0.exe (PID: 5996)
  - UnifiedStub-installer.exe (PID: 1044)
  - utweb.exe (PID: 3104)
  - rsSyncSvc.exe (PID: 3352)
  - rsSyncSvc.exe (PID: 1636)
  - identity_helper.exe (PID: 7504)
  - helper.exe (PID: 8888)
- Process checks computer location settings
  - utweb_installer.tmp (PID: 6412)
  - utweb_installer.tmp (PID: 6516)
  - component0.exe (PID: 5996)
- Reads the machine GUID from the registry
  - utweb_installer.tmp (PID: 6516)
  - component0.exe (PID: 5996)
  - UnifiedStub-installer.exe (PID: 1044)
  - utweb.exe (PID: 3104)
- Reads the software policy settings
  - utweb_installer.tmp (PID: 6516)
  - component0.exe (PID: 5996)
  - UnifiedStub-installer.exe (PID: 1044)
  - WerFault.exe (PID: 7880)
  - WerFault.exe (PID: 8392)
  - utweb.exe (PID: 3104)
- Checks proxy server information
  - utweb_installer.tmp (PID: 6516)
  - utweb_installer.exe (PID: 5504)
  - component0.exe (PID: 5996)
  - UnifiedStub-installer.exe (PID: 1044)
  - WerFault.exe (PID: 7880)
  - WerFault.exe (PID: 8392)
  - utweb.exe (PID: 3104)
- Creates files or folders in the user directory
  - utweb_installer.exe (PID: 5504)
  - utweb.exe (PID: 3104)
  - WerFault.exe (PID: 7880)
  - WerFault.exe (PID: 8392)
  - helper.exe (PID: 8888)
- Creates a software uninstall entry
  - utweb_installer.exe (PID: 5504)
- Reads Environment values
  - component0.exe (PID: 5996)
  - UnifiedStub-installer.exe (PID: 1044)
  - identity_helper.exe (PID: 7504)
- Disables trace logs
  - component0.exe (PID: 5996)
  - UnifiedStub-installer.exe (PID: 1044)
- Reads Microsoft Office registry keys
  - utweb.exe (PID: 3104)
  - msedge.exe (PID: 6876)
- Creates files in the program directory
  - UnifiedStub-installer.exe (PID: 1044)
- Application launched itself
  - msedge.exe (PID: 6876)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	Inno Setup installer (65.1)
.exe	\|	Win32 EXE PECompact compressed (generic) (24.6)
.dll	\|	Win32 Dynamic Link Library (generic) (3.9)
.exe	\|	Win32 Executable (generic) (2.6)
.exe	\|	Win16/32 Executable Delphi generic (1.2)

EXIF

EXE

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2023:02:15 14:54:16+00:00
ImageFileCharacteristics:	No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType:	PE32
LinkerVersion:	2.25
CodeSize:	741888
InitializedDataSize:	77824
UninitializedDataSize:	-
EntryPoint:	0xb5eec
OSVersion:	6.1
ImageVersion:	6
SubsystemVersion:	6.1
Subsystem:	Windows GUI
FileVersionNumber:	1.4.0.0
ProductVersionNumber:	1.4.0.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Win32
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Unicode
Comments:	This installation was built with Inno Setup.
CompanyName:
FileDescription:	uTоrrеnt Web®
FileVersion:	1.4
LegalCopyright:	©2022 RainBerry Inc. All Rights Reserved
OriginalFileName:
ProductName:	uTоrrеnt Web®
ProductVersion:	1.4

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

181

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

936

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2216 --field-trial-handle=2372,i,11421797736899047137,16692938127377599127,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

—

msedge.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

LOW

Description:

Microsoft Edge

Version:

122.0.2365.59

Modules

Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll

1044

.\UnifiedStub-installer.exe /silent

C:\Users\admin\AppData\Local\Temp\7zS0E895ABE\UnifiedStub-installer.exe

ke5zzkgs.exe

User:

admin

Company:

Reason Software Company Inc.

Integrity Level:

HIGH

Description:

UnifiedStub

Version:

6.0.6

Modules

Images
c:\users\admin\appdata\local\temp\7zs0e895abe\unifiedstub-installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll

1636

"C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -bn:ReasonLabs -dt:10

C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe

—

services.exe

User:

SYSTEM

Company:

Reason Software Company Inc.

Integrity Level:

SYSTEM

Description:

Reason Security Synchronize Service

Version:

1.8.5.0

Modules

Images
c:\program files\reasonlabs\common\rssyncsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\version.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll

3104

"C:\Users\admin\AppData\Roaming\uTorrent Web\utweb.exe" /RUNONSTARTUP

C:\Users\admin\AppData\Roaming\uTorrent Web\utweb.exe

utweb_installer.tmp

User:

admin

Company:

BitTorrent Limited

Integrity Level:

MEDIUM

Description:

µTorrent Web

Version:

1.4.0.5828

Modules

Images
c:\users\admin\appdata\roaming\utorrent web\utweb.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\rpcrt4.dll

3352

"C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -i -bn:ReasonLabs -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -dt:10

C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe

—

UnifiedStub-installer.exe

User:

admin

Company:

Reason Software Company Inc.

Integrity Level:

HIGH

Description:

Reason Security Synchronize Service

Exit code:

Version:

1.8.5.0

Modules

Images
c:\program files\reasonlabs\common\rssyncsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll

3540

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2308 --field-trial-handle=2372,i,11421797736899047137,16692938127377599127,262144 --variations-seed-version /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

msedge.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Microsoft Edge

Version:

122.0.2365.59

Modules

Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll

4200

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2364 --field-trial-handle=2372,i,11421797736899047137,16692938127377599127,262144 --variations-seed-version /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

—

msedge.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

LOW

Description:

Microsoft Edge

Version:

122.0.2365.59

Modules

Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll

5504

"C:\Users\admin\AppData\Local\Temp\is-FRJ2D.tmp\utweb_installer.exe" /S

C:\Users\admin\AppData\Local\Temp\is-FRJ2D.tmp\utweb_installer.exe

utweb_installer.tmp

User:

admin

Company:

BitTorrent Limited

Integrity Level:

HIGH

Description:

uTorrent Web

Exit code:

Version:

1.4.0.5828

Modules

Images
c:\users\admin\appdata\local\temp\is-frj2d.tmp\utweb_installer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll

5904

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.59 --initial-client-data=0x31c,0x320,0x324,0x308,0x32c,0x7fffccc45fd8,0x7fffccc45fe4,0x7fffccc45ff0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

—

msedge.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Microsoft Edge

Version:

122.0.2365.59

Modules

Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll

5980

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

rsSyncSvc.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

Add for printing

Total events

37 393

Read events

37 170

Write events

193

Delete events

Modification events


(PID) Process:	(6516) utweb_installer.tmp	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:	write	Name:	Owner
Value: 74190000D9582AEF90E4DA01
(PID) Process:	(6516) utweb_installer.tmp	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:	write	Name:	SessionHash
Value: D5AD05E9D7DF33C36DCAF702E0ABC28B2BD34F9F3F9A9600450FCD5158C8AA5B
(PID) Process:	(6516) utweb_installer.tmp	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:	write	Name:	Sequence
Value: 1
(PID) Process:	(5504) utweb_installer.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\utweb
Operation:	write	Name:	UninstallString
Value: "C:\Users\admin\AppData\Roaming\uTorrent Web\Uninstall.exe"
(PID) Process:	(5504) utweb_installer.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\utweb
Operation:	write	Name:	QuietUninstallString
Value: "C:\Users\admin\AppData\Roaming\uTorrent Web\Uninstall.exe" /S
(PID) Process:	(5504) utweb_installer.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\utweb
Operation:	write	Name:	DisplayIcon
Value: C:\Users\admin\AppData\Roaming\uTorrent Web\uninstall.ico
(PID) Process:	(5504) utweb_installer.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\utweb
Operation:	write	Name:	DisplayName
Value: uTorrent Web
(PID) Process:	(5504) utweb_installer.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\utweb
Operation:	write	Name:	Publisher
Value: BitTorrent Limited
(PID) Process:	(5504) utweb_installer.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\utweb
Operation:	write	Name:	DisplayVersion
Value: 1.4.0
(PID) Process:	(5504) utweb_installer.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\utweb
Operation:	write	Name:	NoModify
Value: 1

Add for printing

Executable files

101

Suspicious files

294

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
6492	utweb_installer.exe	C:\Users\admin\AppData\Local\Temp\is-P7OPP.tmp\utweb_installer.tmp		executable
		MD5:70BF76D041D0DF60841AA3DBF425681E	SHA256:CD63AF7DEEDAAA5DEA0B762B397594BCCD525E8F9B2AF27C6D1DDBEE4709076E
6392	utweb_installer.exe	C:\Users\admin\AppData\Local\Temp\is-J1PPV.tmp\utweb_installer.tmp		executable
		MD5:70BF76D041D0DF60841AA3DBF425681E	SHA256:CD63AF7DEEDAAA5DEA0B762B397594BCCD525E8F9B2AF27C6D1DDBEE4709076E
6516	utweb_installer.tmp	C:\Users\admin\AppData\Local\Temp\is-FRJ2D.tmp\is-VJ1DE.tmp		executable
		MD5:A87F9B5D44EDD211272B5C426F1D57F6	SHA256:CD1305DE487481FA02E9DB300F9DD041D7A65CC98CA87576ABEDFA9EE305C2B9
6516	utweb_installer.tmp	C:\Users\admin\AppData\Local\Temp\is-FRJ2D.tmp\RAV_Cross.png		image
		MD5:CD09F361286D1AD2622BA8A57B7613BD	SHA256:B92A31D4853D1B2C4E5B9D9624F40B439856D0C6A517E100978CBDE8D3C47DC8
6516	utweb_installer.tmp	C:\Users\admin\AppData\Local\Temp\is-FRJ2D.tmp\is-QGU8S.tmp		executable
		MD5:CE05DDAD27D49322587F824435F844B5	SHA256:94577F576122C236AD8DB6473670DACBA8831AB1B462D2E9A2E24B0D69EC9924
6516	utweb_installer.tmp	C:\Users\admin\AppData\Local\Temp\is-FRJ2D.tmp\utweb_installer.exe		executable
		MD5:A87F9B5D44EDD211272B5C426F1D57F6	SHA256:CD1305DE487481FA02E9DB300F9DD041D7A65CC98CA87576ABEDFA9EE305C2B9
6516	utweb_installer.tmp	C:\Users\admin\AppData\Local\Temp\is-FRJ2D.tmp\component0		executable
		MD5:CE05DDAD27D49322587F824435F844B5	SHA256:94577F576122C236AD8DB6473670DACBA8831AB1B462D2E9A2E24B0D69EC9924
5504	utweb_installer.exe	C:\Users\admin\AppData\Local\Temp\nsmC03F.tmp\UAC.dll		executable
		MD5:ADB29E6B186DAA765DC750128649B63D	SHA256:2F7F8FC05DC4FD0D5CDA501B47E4433357E887BBFED7292C028D99C73B52DC08
5504	utweb_installer.exe	C:\Users\admin\AppData\Roaming\uTorrent Web\webui\version.txt		text
		MD5:0B4FFA385C79DF8697CDE111125BF24F	SHA256:4A507FEAFE418BDB52148E974E2A20DB33AC0BA678A3BC24DE88153C8F7368E2
5504	utweb_installer.exe	C:\Users\admin\AppData\Local\Temp\nsmC03F.tmp\System.dll		executable
		MD5:CFF85C549D536F651D4FB8387F1976F2	SHA256:8DC562CDA7217A3A52DB898243DE3E2ED68B80E62DDCB8619545ED0B4E7F65A8

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

315

DNS requests

175

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5336	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D	unknown	—	—	whitelisted
2804	svchost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
2804	svchost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
6824	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
6880	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
5504	utweb_installer.exe	POST	200	52.204.119.181:80	http://i-4101.b-5828.utweb.bench.utorrent.com/e?i=4101	unknown	—	—	—
5504	utweb_installer.exe	POST	200	52.204.119.181:80	http://i-4101.b-5828.utweb.bench.utorrent.com/e?i=4101	unknown	—	—	—
3104	utweb.exe	GET	200	41.63.96.130:80	http://btinstall-artifacts.bittorrent.com/helper_ui/helper_web_ui.btinstall	unknown	—	—	whitelisted
3104	utweb.exe	POST	200	44.219.170.98:80	http://i-4101.b-10724.utweb.bench.utorrent.com/e?i=4101&e=eyJldmVudE5hbWUiOiJ1dHdlYiIsImFjdGlvbiI6ImdhQmxvY2suYWJzZW50LnBhZ2Vsb2FkIiwiQlVJTERfTlVNQkVSIjoiMTA3MjQiLCJhcHBOYW1lIjoidXR3ZWIiLCJhcHBWZXJzaW9uIjoiMS40LjAuNTgyOC4xMDcyNCIsImlzVXR3ZWIiOnRydWUsInR1dG9yaWFsVmlkZW9IYXNoTGlzdCI6WyI4MGIzOWEyZTM3YWEzNTJjZDJmY2JmYmVmN2M0YTZlOWU4Y2ZlNDM4IiwiOWEyM2JlNmM1NWQ1ZjhkMWUyODI2MGU0MDNiYWU1NDEyNDQzNTc5ZSIsIjM4ZTk3MjM0ZmQ2MGM0ZjMwMzQ0ZDlmYWU4MDg5OWE3NWZjZmJmZmUiLCI2MWIzYjg4NTZjNDgzOWVkZjUxZjVjMjM0NjU5OWI2YmVjNTI0MTQ1IiwiNTYyZTI5Yzc4MzZkYWRiY2Y1NWIzZGViZjgzMDYzMjcxNzY5Yzk0ZiJdLCJ1dWlkIjoiODIyNWU0NDE4NDUwZWYxMWI0ZTMxOGY3Nzg2Zjk2ZWUiLCJnYUJsb2NrZXJEZXRlY3RlZCI6bnVsbCwiYmVuY2hHZW8iOiIifQ==	unknown	—	—	whitelisted
3104	utweb.exe	POST	200	44.219.170.98:80	http://i-4101.b-10724.utweb.bench.utorrent.com/e?i=4101&e=eyJldmVudE5hbWUiOiJ1dHdlYiIsImFjdGlvbiI6ImFkQmxvY2suYWJzZW50LnBhZ2Vsb2FkIiwiQlVJTERfTlVNQkVSIjoiMTA3MjQiLCJhcHBOYW1lIjoidXR3ZWIiLCJhcHBWZXJzaW9uIjoiMS40LjAuNTgyOC4xMDcyNCIsImlzVXR3ZWIiOnRydWUsInR1dG9yaWFsVmlkZW9IYXNoTGlzdCI6WyI4MGIzOWEyZTM3YWEzNTJjZDJmY2JmYmVmN2M0YTZlOWU4Y2ZlNDM4IiwiOWEyM2JlNmM1NWQ1ZjhkMWUyODI2MGU0MDNiYWU1NDEyNDQzNTc5ZSIsIjM4ZTk3MjM0ZmQ2MGM0ZjMwMzQ0ZDlmYWU4MDg5OWE3NWZjZmJmZmUiLCI2MWIzYjg4NTZjNDgzOWVkZjUxZjVjMjM0NjU5OWI2YmVjNTI0MTQ1IiwiNTYyZTI5Yzc4MzZkYWRiY2Y1NWIzZGViZjgzMDYzMjcxNzY5Yzk0ZiJdLCJ1dWlkIjoiODIyNWU0NDE4NDUwZWYxMWI0ZTMxOGY3Nzg2Zjk2ZWUiLCJnYUJsb2NrZXJEZXRlY3RlZCI6ZmFsc2UsImJlbmNoR2VvIjoiIiwidXR3ZWJTYW1wbGVSYXRlIjoxfQ==	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
2532	svchost.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
1984	RUXIMICS.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
2120	MoUsoCoreWorker.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
3888	svchost.exe	239.255.255.250:1900	—	—	—	whitelisted
6516	utweb_installer.tmp	18.245.62.182:443	d2ordzmbswux6c.cloudfront.net	—	US	unknown
4	System	192.168.100.255:137	—	—	—	whitelisted
2532	svchost.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
5336	SearchApp.exe	104.126.37.128:443	www.bing.com	Akamai International B.V.	DE	unknown
5336	SearchApp.exe	192.229.221.95:80	ocsp.digicert.com	EDGECAST	US	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	51.124.78.146 4.231.128.59	whitelisted
google.com	142.250.184.238	whitelisted
d2ordzmbswux6c.cloudfront.net	18.245.62.182 18.245.62.131 18.245.62.12 18.245.62.7	whitelisted
www.bing.com	104.126.37.128 104.126.37.136 104.126.37.139 104.126.37.145 104.126.37.146 104.126.37.138 104.126.37.129 104.126.37.168 104.126.37.147 2.23.209.140 2.23.209.193 2.23.209.187 2.23.209.158 2.23.209.150 2.23.209.179 2.23.209.176 2.23.209.185 2.23.209.149 2.23.209.189 2.23.209.182 2.23.209.133	whitelisted
ocsp.digicert.com	192.229.221.95	whitelisted
login.live.com	20.190.160.22 20.190.160.17 40.126.32.76 40.126.32.140 20.190.160.14 40.126.32.134 40.126.32.74 40.126.32.72	whitelisted
client.wns.windows.com	40.115.3.253	whitelisted
th.bing.com	104.126.37.138 104.126.37.168 104.126.37.171 104.126.37.128 104.126.37.163 104.126.37.177 104.126.37.186 104.126.37.176 104.126.37.139 2.23.209.149 2.23.209.185 2.23.209.140 2.23.209.179 2.23.209.189 2.23.209.176 2.23.209.182 2.23.209.187 2.23.209.133	whitelisted
fd.api.iris.microsoft.com	20.103.156.88	whitelisted
download-lb.utorrent.com	67.215.238.66	whitelisted

Threats

PID	Process	Class	Message
—	—	Potentially Bad Traffic	ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
—	—	Potentially Bad Traffic	ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
—	—	Potential Corporate Privacy Violation	ET P2P BitTorrent DHT ping request
—	—	Potentially Bad Traffic	ET POLICY Executable served from Amazon S3
—	—	Potential Corporate Privacy Violation	ET POLICY PE EXE or DLL Windows file download HTTP
—	—	Potentially Bad Traffic	ET INFO Suspicious Domain (polyfill .io) in DNS Lookup
—	—	Not Suspicious Traffic	INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
—	—	Not Suspicious Traffic	INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
—	—	Not Suspicious Traffic	INFO [ANY.RUN] Global content delivery network (unpkg .com)
—	—	Potentially Bad Traffic	ET DNS Query for .cc TLD

Add for printing

No debug info

General Info

utweb_installer.exe

79906E2CFAD2738D0DAC73211C1C400D

242187447B286F2777842A37204AC09F5A17580E

D7D59CC033BDF12A0139B614F9CF9AC5EAA43BF27F5EA230444827FDE0A08DF3

49152:h7HecD4dnbibBlyUIsg88xnh+Dp/U5NHNIwKr8K2+S95dzyKCbslnTiVOAli2jW1:J+cD4dnX9Yum/U5NtIroK2ndW5b3vcl/

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Drops the executable file immediately after the start

Changes the autorun value in the registry

Actions looks like stealing of personal data

SUSPICIOUS

Executable content was dropped or overwritten

Reads security settings of Internet Explorer

Reads the date of Windows installation

Reads the Windows owner or organization settings

Mutex name with non-standard characters

The process creates files with name similar to system file names

Malware-specific behavior (creating "System.dll" in Temp)

Process drops legitimate windows executable

Potential Corporate Privacy Violation

Searches for installed software

Creates a software uninstall entry

Executes as Windows Service

Executes application which crashes

Checks Windows Trust Settings

INFO

Create files in a temporary directory

Checks supported languages

Reads the computer name

Process checks computer location settings

Reads the machine GUID from the registry

Reads the software policy settings

Checks proxy server information

Creates files or folders in the user directory

Creates a software uninstall entry

Reads Environment values

Disables trace logs

Reads Microsoft Office registry keys

Creates files in the program directory

Application launched itself

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity