Time4Popcorn Abandoned Updater RCE: Lessons in Hunting and Purging Unmanaged BitTorrent Clients from Your Fleet

---
title: Popcorn Time Variant Execution Detected
description: Detects execution of Popcorn Time, Time4Popcorn, and related fork binaries. These are abandoned, unmaintained BitTorrent streaming clients whose auto-update mechanisms present a remote code execution and supply-chain risk. User-installed piracy streaming software has no legitimate business use on corporate endpoints.
references:
  - https://www.bleepingcomputer.com/news/security/abandoned-popcorn-time-app-exposed-millions-of-device-to-rce-attacks/
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/04/06
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|contains:
      - '\Popcorn Time\'
      - '\Popcorn-Time\'
      - '\Time4Popcorn\'
      - '\popcorn-time\'
  selection_name:
    Image|endswith:
      - '\PopcornTime.exe'
      - '\Popcorn-Time.exe'
      - '\Time4Popcorn.exe'
      - '\Update.exe'
    OriginalFileName|contains:
      - 'Popcorn Time'
      - 'Time4Popcorn'
  selection_path:
    Image|startswith:
      - 'C:\Users\'
    Image|contains:
      - '\AppData\Local\Popcorn'
      - '\AppData\Roaming\Popcorn'
  condition: selection_img or selection_name or selection_path
falsepositives:
  - Rare; Popcorn Time variants are not legitimate enterprise software
level: high
---
title: Media or Torrent Application Spawning Script or Installer Child Process
description: Detects abandoned or consumer media/torrent applications spawning script interpreters, installers, or download cradles. This matches the behavior pattern of a hijacked auto-updater delivering and executing a malicious payload with the parent application's privileges, as was possible with the abandoned Time4Popcorn updater.
references:
  - https://www.bleepingcomputer.com/news/security/abandoned-popcorn-time-app-exposed-millions-of-device-to-rce-attacks/
  - https://attack.mitre.org/techniques/T1195/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\Popcorn'
      - '\Time4Popcorn\'
      - '\uTorrent\'
      - '\qBittorrent\'
      - '\BitTorrent\'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\msiexec.exe'
      - '\curl.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate self-update activity of installed torrent clients; tune ParentImage list to match your authorized software inventory before production deployment
level: high

// Hunt 1: Fleet-wide inventory of Popcorn Time variant execution (last 30 days)
// Purpose: establish the population of exposed endpoints requiring remediation
let PopcornIndicators = dynamic(["Popcorn", "Time4Popcorn", "popcorn-time"]);
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FileName has_any (PopcornIndicators)
    or FolderPath has_any (PopcornIndicators)
    or ProcessCommandLine has_any (PopcornIndicators)
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
            ExecutionCount = count(),
            Users = make_set(AccountName), Paths = make_set(FolderPath)
    by DeviceName, FileName, SHA256
| order by LastSeen desc;

// Hunt 2: Media/torrent applications spawning script interpreters or installers
// Purpose: detect hijacked-updater style payload delivery and execution
let MediaTorrentParents = dynamic(["PopcornTime.exe", "Popcorn-Time.exe", "Time4Popcorn.exe", "utorrent.exe", "qbittorrent.exe", "bittorrent.exe", "Update.exe"]);
let ExecutionChildren = dynamic(["powershell.exe", "pwsh.exe", "cmd.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "msiexec.exe", "certutil.exe", "bitsadmin.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ (MediaTorrentParents)
    or InitiatingProcessFolderPath has_any ("Popcorn", "Time4Popcorn")
| where FileName in~ (ExecutionChildren)
| project TimeGenerated, DeviceName, AccountName,
          InitiatingProcessFileName, InitiatingProcessFolderPath,
          FileName, ProcessCommandLine, SHA256, ReportId
| order by TimeGenerated desc;

// Hunt 3: Outbound connections from Popcorn Time variants to non-Microsoft infrastructure
// Purpose: identify live updater/beaconing channels still contacting abandoned infrastructure
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFolderPath has_any ("Popcorn", "Time4Popcorn", "popcorn-time")
| where RemoteUrl !endswith "microsoft.com" and RemoteUrl !endswith "windows.net"
| summarize ConnectionCount = count(), RemoteHosts = make_set(RemoteUrl), IPs = make_set(RemoteIP)
    by DeviceName, InitiatingProcessFileName
| order by ConnectionCount desc;

-- Hunt: Popcorn Time / Time4Popcorn process presence and live network connections
-- Use: identify exposed endpoints, capture child-process execution (updater-style payload delivery),
-- and map active connections to abandoned update infrastructure for blocking and scoping.
LET processes = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)popcorn|time4popcorn'
   OR Name =~ '(?i)popcorn|time4popcorn'
   OR CommandLine =~ '(?i)popcorn|time4popcorn'

SELECT Pid, Ppid, Name, Username, CommandLine, Exe, CreateTime,
       netstat() as NetworkConnections
FROM processes

-- Hunt: Suspicious child processes spawned by media/torrent applications (updater-hijack pattern)
LET parent_hits = SELECT Pid, Name, Exe
FROM pslist()
WHERE Exe =~ '(?i)popcorn|time4popcorn|utorrent|qbittorrent|bittorrent'

SELECT p.Pid AS ParentPid, p.Name AS ParentName, p.Exe AS ParentPath,
       c.Pid AS ChildPid, c.Name AS ChildName, c.CommandLine AS ChildCmdLine,
       c.Username AS ChildUser, c.CreateTime AS ChildStartTime
FROM parent_hits p
JOIN (SELECT Pid, Ppid, Name, CommandLine, Username, CreateTime FROM pslist()) c
ON p.Pid = c.Ppid
WHERE c.Name =~ '(?i)powershell|pwsh|cmd\.exe|wscript|cscript|mshta|rundll32|msiexec|certutil|bitsadmin|curl'

#Requires -RunAsAdministrator
# Security Arsenal - Popcorn Time / Time4Popcorn detection and removal
# Audit mode by default; add -Remove to uninstall and delete application artifacts.
param(
    [switch]$Remove
)

$report = @()
$popcornPaths = @()

# 1. Enumerate per-user AppData install locations (typical for Popcorn Time variants)
$userProfiles = Get-ChildItem 'C:\Users' -Directory -ErrorAction SilentlyContinue
foreach ($profile in $userProfiles) {
    $candidates = @(
        Join-Path $profile.FullName 'AppData\Local\Popcorn Time',
        Join-Path $profile.FullName 'AppData\Local\Popcorn-Time',
        Join-Path $profile.FullName 'AppData\Local\Time4Popcorn',
        Join-Path $profile.FullName 'AppData\Roaming\Popcorn Time',
        Join-Path $profile.FullName 'AppData\Roaming\Time4Popcorn',
        Join-Path $profile.FullName 'AppData\Local\Programs\Popcorn Time'
    )
    foreach ($c in $candidates) {
        if (Test-Path $c) { $popcornPaths += $c }
    }
}

# 2. Check installed-programs registry hives for Popcorn Time entries
$uninstallRoots = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
)
$installed = foreach ($root in $uninstallRoots) {
    Get-ItemProperty $root -ErrorAction SilentlyContinue |
        Where-Object { $_.DisplayName -match 'Popcorn|Time4Popcorn' }
}

foreach ($app in $installed) {
    $report += [pscustomobject]@{
        Type        = 'InstalledProgram'
        Name        = $app.DisplayName
        Version     = $app.DisplayVersion
        Location    = $app.InstallLocation
        Uninstall   = $app.UninstallString
    }
}
foreach ($p in $popcornPaths) {
    $report += [pscustomobject]@{
        Type        = 'FileSystemArtifact'
        Name        = Split-Path $p -Leaf
        Version     = $null
        Location    = $p
        Uninstall   = $null
    }
}

# 3. Kill running processes belonging to these variants
$procs = Get-Process -ErrorAction SilentlyContinue |
    Where-Object { $_.Path -match 'Popcorn|Time4Popcorn' -or $_.Name -match 'Popcorn|Time4Popcorn' }
foreach ($proc in $procs) {
    $report += [pscustomobject]@{
        Type = 'RunningProcess'; Name = $proc.Name; Version = $null
        Location = $proc.Path; Uninstall = $null
    }
    if ($Remove) { Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue }
}

if (-not $Remove) {
    Write-Host '=== AUDIT MODE: Popcorn Time variant findings ==='
    $report | Format-Table -AutoSize
    exit ($report.Count -gt 0 ? 1 : 0)
}

# 4. Removal: run vendor uninstallers, then delete residual directories
foreach ($app in $installed) {
    if ($app.UninstallString) {
        $un = $app.UninstallString
        if ($un -match 'msiexec') {
            $guid = [regex]::Match($un, '\{[0-9A-Fa-f\-]+\}').Value
            Start-Process msiexec.exe -ArgumentList "/x $guid /qn /norestart" -Wait
        } else {
            $exe = [regex]::Match($un, '^"([^"]+)"').Groups[1].Value
            if (-not $exe) { $exe = $un.Split(' ')[0] }
            Start-Process $exe -ArgumentList '/S /quiet /norestart' -Wait -ErrorAction SilentlyContinue
        }
    }
}
foreach ($p in $popcornPaths) {
    Remove-Item $p -Recurse -Force -ErrorAction SilentlyContinue
}

Write-Host "Removal pass complete. Artifacts found: $($report.Count)"