File name:

upO Builder 0.9.7.exe

Full analysis: https://app.any.run/tasks/908577ce-4a76-4b78-9801-a33fc951e3fe
Verdict: Malicious activity
Analysis date: February 28, 2025, 10:11:10
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
github
delphi
upx
antivm
winlocker
mpress
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

A6B3B0EF9A6EE3C74315A2B8C573E5C8

SHA1:

80B75A960A383A824E48DD196416517E7E0525EC

SHA256:

49E993C3C40C13C28E32C53E90DDE544665CF47FF43D418B7CBA94FDF37DB82D

SSDEEP:

98304:+dzqzuHHrPnxMc4SdrIRTjM6h36MUwYLushXnhlCJydCp5foTW8UhJAhdeGOvRwj:rZfI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • WINLOCKER has been detected (YARA)

      • upO Builder.exe (PID: 6816)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • upO Builder 0.9.7.exe (PID: 3096)

    • Reads the date of Windows installation

      • upO Builder 0.9.7.exe (PID: 3096)

    • There is functionality for VM detection VMWare (YARA)

      • upO Builder.exe (PID: 6816)

    • There is functionality for VM detection VirtualBox (YARA)

      • upO Builder.exe (PID: 6816)

    • There is functionality for taking screenshot (YARA)

      • upO Builder.exe (PID: 6816)

  • INFO

    • Checks supported languages

      • upO Builder 0.9.7.exe (PID: 3096)
      • upO Builder.exe (PID: 6816)

    • Disables trace logs

      • upO Builder 0.9.7.exe (PID: 3096)

    • Reads the computer name

      • upO Builder 0.9.7.exe (PID: 3096)
      • upO Builder.exe (PID: 6816)

    • Checks proxy server information

      • upO Builder 0.9.7.exe (PID: 3096)

    • Creates files or folders in the user directory

      • upO Builder 0.9.7.exe (PID: 3096)

    • Reads the machine GUID from the registry

      • upO Builder 0.9.7.exe (PID: 3096)

    • Reads the software policy settings

      • upO Builder 0.9.7.exe (PID: 3096)

    • Process checks computer location settings

      • upO Builder 0.9.7.exe (PID: 3096)

    • UPX packer has been detected

      • upO Builder.exe (PID: 6816)

    • Mpress packer has been detected

      • upO Builder.exe (PID: 6816)

    • Compiled with Borland Delphi (YARA)

      • upO Builder.exe (PID: 6816)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:12:09 18:58:13+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 4096
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x2e5e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 0.9.7.0
ProductVersionNumber: 0.9.7.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: Updater
CompanyName: sumhex
FileDescription: Updater for upO Builder
FileVersion: 0.9.7.0
InternalName: LockerBuilderUpdate.exe
LegalCopyright: sumhex
LegalTrademarks: -
OriginalFileName: LockerBuilderUpdate.exe
ProductName: Updater
ProductVersion: 0.9.7.0
AssemblyVersion: 0.9.7.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start upo builder 0.9.7.exe sppextcomobj.exe no specs slui.exe no specs #WINLOCKER upo builder.exe no specs upo builder 0.9.7.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1088"C:\Users\admin\AppData\Local\Temp\upO Builder 0.9.7.exe" C:\Users\admin\AppData\Local\Temp\upO Builder 0.9.7.exe—explorer.exe
User:
admin
Company:
sumhex
Integrity Level:
MEDIUM
Description:
Updater for upO Builder
Exit code:
3221226540
Version:
0.9.7.0
Modules
Images
c:\users\admin\appdata\local\temp\upo builder 0.9.7.exe
c:\windows\system32\ntdll.dll
3096"C:\Users\admin\AppData\Local\Temp\upO Builder 0.9.7.exe" C:\Users\admin\AppData\Local\Temp\upO Builder 0.9.7.exe
explorer.exe
User:
admin
Company:
sumhex
Integrity Level:
HIGH
Description:
Updater for upO Builder
Exit code:
0
Version:
0.9.7.0
Modules
Images
c:\users\admin\appdata\local\temp\upo builder 0.9.7.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3784C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
6268"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6816"C:\Users\admin\AppData\upO Builder.exe" C:\Users\admin\AppData\upO Builder.exe
upO Builder 0.9.7.exe
User:
admin
Company:
sumhex
Integrity Level:
HIGH
Description:
WinLocker Builder with upO design (Made on Delphi)
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\upo builder.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
1 552
Read events
1 537
Write events
15
Delete events
0

Modification events

(PID) Process:(3096) upO Builder 0.9.7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upO Builder 0_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3096) upO Builder 0.9.7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upO Builder 0_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(3096) upO Builder 0.9.7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upO Builder 0_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3096) upO Builder 0.9.7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upO Builder 0_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(3096) upO Builder 0.9.7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upO Builder 0_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(3096) upO Builder 0.9.7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upO Builder 0_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3096) upO Builder 0.9.7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upO Builder 0_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(3096) upO Builder 0.9.7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upO Builder 0_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3096) upO Builder 0.9.7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upO Builder 0_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(3096) upO Builder 0.9.7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upO Builder 0_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
1
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3096upO Builder 0.9.7.exeC:\Users\admin\AppData\upO Builder.exeexecutable
MD5:042B657C73AE1A47383D2BE31FA66B5E
SHA256:F6A4C7BFA61AEA65250174F3AB0C3D087F5082DC902B137DE686E42DA0952F2D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
23
DNS requests
13
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5640
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5640
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3096
upO Builder 0.9.7.exe
185.199.108.133:443
raw.githubusercontent.com
FASTLY
US
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
40.126.31.67:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3008
backgroundTaskHost.exe
92.123.104.67:443
www.bing.com
Akamai International B.V.
DE
whitelisted
2040
backgroundTaskHost.exe
20.199.58.43:443
fd.api.iris.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.184.206
whitelisted
raw.githubusercontent.com
  • 185.199.108.133
  • 185.199.111.133
  • 185.199.110.133
  • 185.199.109.133
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
login.live.com
  • 40.126.31.67
  • 20.190.159.130
  • 40.126.31.69
  • 40.126.31.129
  • 20.190.159.68
  • 20.190.159.4
  • 40.126.31.130
  • 40.126.31.131
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
www.bing.com
  • 92.123.104.67
  • 92.123.104.64
  • 92.123.104.62
  • 92.123.104.7
  • 92.123.104.59
  • 92.123.104.4
  • 92.123.104.58
  • 92.123.104.65
  • 92.123.104.61
whitelisted
fd.api.iris.microsoft.com
  • 20.199.58.43
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
upO Builder 0.9.7.exe