File name:

upO Builder 0.9.7.exe

Full analysis: https://app.any.run/tasks/d033e0bb-4e74-4921-b5f6-cbbe69d63c1f
Verdict: Malicious activity
Analysis date: February 21, 2025, 09:55:58
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
github
upx
antivm
winlocker
delphi
mpress
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

A6B3B0EF9A6EE3C74315A2B8C573E5C8

SHA1:

80B75A960A383A824E48DD196416517E7E0525EC

SHA256:

49E993C3C40C13C28E32C53E90DDE544665CF47FF43D418B7CBA94FDF37DB82D

SSDEEP:

98304:+dzqzuHHrPnxMc4SdrIRTjM6h36MUwYLushXnhlCJydCp5foTW8UhJAhdeGOvRwj:rZfI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • WINLOCKER has been detected (YARA)

      • upO Builder.exe (PID: 204)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • upO Builder 0.9.7.exe (PID: 3224)

    • Executable content was dropped or overwritten

      • upO Builder 0.9.7.exe (PID: 3224)

    • Reads the date of Windows installation

      • upO Builder 0.9.7.exe (PID: 3224)

    • There is functionality for taking screenshot (YARA)

      • upO Builder.exe (PID: 204)

    • There is functionality for VM detection VMWare (YARA)

      • upO Builder.exe (PID: 204)

    • There is functionality for VM detection VirtualBox (YARA)

      • upO Builder.exe (PID: 204)

  • INFO

    • Checks supported languages

      • upO Builder 0.9.7.exe (PID: 3224)
      • upO Builder.exe (PID: 204)

    • Disables trace logs

      • upO Builder 0.9.7.exe (PID: 3224)

    • Reads Environment values

      • upO Builder 0.9.7.exe (PID: 3224)

    • Reads the computer name

      • upO Builder 0.9.7.exe (PID: 3224)
      • upO Builder.exe (PID: 204)

    • Creates files or folders in the user directory

      • upO Builder 0.9.7.exe (PID: 3224)

    • Reads the machine GUID from the registry

      • upO Builder 0.9.7.exe (PID: 3224)

    • Checks proxy server information

      • upO Builder 0.9.7.exe (PID: 3224)

    • Process checks computer location settings

      • upO Builder 0.9.7.exe (PID: 3224)

    • Reads the software policy settings

      • upO Builder 0.9.7.exe (PID: 3224)

    • UPX packer has been detected

      • upO Builder.exe (PID: 204)

    • Mpress packer has been detected

      • upO Builder.exe (PID: 204)

    • Compiled with Borland Delphi (YARA)

      • upO Builder.exe (PID: 204)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:12:09 18:58:13+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 4096
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x2e5e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 0.9.7.0
ProductVersionNumber: 0.9.7.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: Updater
CompanyName: sumhex
FileDescription: Updater for upO Builder
FileVersion: 0.9.7.0
InternalName: LockerBuilderUpdate.exe
LegalCopyright: sumhex
LegalTrademarks: -
OriginalFileName: LockerBuilderUpdate.exe
ProductName: Updater
ProductVersion: 0.9.7.0
AssemblyVersion: 0.9.7.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
123
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start upo builder 0.9.7.exe #WINLOCKER upo builder.exe no specs upo builder 0.9.7.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
204"C:\Users\admin\AppData\upO Builder.exe" C:\Users\admin\AppData\upO Builder.exe
upO Builder 0.9.7.exe
User:
admin
Company:
sumhex
Integrity Level:
HIGH
Description:
WinLocker Builder with upO design (Made on Delphi)
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\upo builder.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
748"C:\Users\admin\AppData\Local\Temp\upO Builder 0.9.7.exe" C:\Users\admin\AppData\Local\Temp\upO Builder 0.9.7.exe—explorer.exe
User:
admin
Company:
sumhex
Integrity Level:
MEDIUM
Description:
Updater for upO Builder
Exit code:
3221226540
Version:
0.9.7.0
Modules
Images
c:\users\admin\appdata\local\temp\upo builder 0.9.7.exe
c:\windows\system32\ntdll.dll
3224"C:\Users\admin\AppData\Local\Temp\upO Builder 0.9.7.exe" C:\Users\admin\AppData\Local\Temp\upO Builder 0.9.7.exe
explorer.exe
User:
admin
Company:
sumhex
Integrity Level:
HIGH
Description:
Updater for upO Builder
Exit code:
0
Version:
0.9.7.0
Modules
Images
c:\users\admin\appdata\local\temp\upo builder 0.9.7.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
1 432
Read events
1 418
Write events
14
Delete events
0

Modification events

(PID) Process:(3224) upO Builder 0.9.7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upO Builder 0_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3224) upO Builder 0.9.7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upO Builder 0_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(3224) upO Builder 0.9.7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upO Builder 0_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3224) upO Builder 0.9.7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upO Builder 0_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(3224) upO Builder 0.9.7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upO Builder 0_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(3224) upO Builder 0.9.7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upO Builder 0_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3224) upO Builder 0.9.7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upO Builder 0_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(3224) upO Builder 0.9.7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upO Builder 0_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3224) upO Builder 0.9.7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upO Builder 0_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(3224) upO Builder 0.9.7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upO Builder 0_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
1
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3224upO Builder 0.9.7.exeC:\Users\admin\AppData\upO Builder.exeexecutable
MD5:042B657C73AE1A47383D2BE31FA66B5E
SHA256:F6A4C7BFA61AEA65250174F3AB0C3D087F5082DC902B137DE686E42DA0952F2D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
32
DNS requests
17
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5392
svchost.exe
GET
200
2.16.164.106:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.16.164.106:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2212
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2212
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
876
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5732
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5392
svchost.exe
2.16.164.106:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
2.16.164.106:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5392
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3224
upO Builder 0.9.7.exe
185.199.109.133:443
raw.githubusercontent.com
FASTLY
US
whitelisted
5064
SearchApp.exe
2.19.122.46:443
www.bing.com
Akamai International B.V.
DE
whitelisted
1176
svchost.exe
40.126.32.138:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 2.16.164.106
  • 2.16.164.72
  • 2.16.164.120
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 23.35.229.160
whitelisted
google.com
  • 142.250.185.78
whitelisted
raw.githubusercontent.com
  • 185.199.109.133
  • 185.199.110.133
  • 185.199.108.133
  • 185.199.111.133
whitelisted
www.bing.com
  • 2.19.122.46
  • 2.19.122.43
  • 2.19.122.39
  • 2.19.122.33
  • 2.19.122.38
  • 2.19.122.42
  • 2.19.122.41
  • 2.19.122.32
  • 2.19.122.44
whitelisted
login.live.com
  • 40.126.32.138
  • 40.126.32.74
  • 40.126.32.134
  • 40.126.32.72
  • 40.126.32.136
  • 20.190.160.14
  • 20.190.160.3
  • 20.190.160.131
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 2.17.190.73
whitelisted
go.microsoft.com
  • 2.19.106.8
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted

Threats

PID
Process
Class
Message
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
upO Builder 0.9.7.exe