Summary

File 2eb1361091951a041aac3fff75182b2346722a79398989a37c4b18b51ff2106e

Summary

Download Resubmit sample

Size	78.4KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	da25700f283fbaf216fa4b4ea5ffb529
SHA1	7b6c269ce7d0f636445c1ccf9f89f49906207903
SHA256	2eb1361091951a041aac3fff75182b2346722a79398989a37c4b18b51ff2106e
SHA512	Show SHA512 04d39b94b1a28e9903bc673212e3223d624c560a2bfa8391421f3cd33e9931a6398e7afe7be9ec7318963ca81fcd8a15bbd881e5429fa6b66413bef7373e0007
CRC32	8AA44DF7
ssdeep	None
Yara	CryptoLocker_set1 - Detection of Cryptolocker Samples CryptoLocker_rule2 - Detection of CryptoLocker Variants win_files_operation - Affect private profile

Score

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

---

Autosubmit

6732312

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Signatures

Yara rules detected for file (3 events)

description	Detection of Cryptolocker Samples				rule	CryptoLocker_set1
description	Detection of CryptoLocker Variants				rule	CryptoLocker_rule2
description	Affect private profile				rule	win_files_operation

Allocates read-write-execute memory (usually to unpack itself) (4 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory July 9, 2025, 8:33 a.m.	process_identifier: 868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a0000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory July 9, 2025, 8:33 a.m.	process_identifier: 868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005d3000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory July 9, 2025, 8:33 a.m.	process_identifier: 544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004f0000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory July 9, 2025, 8:33 a.m.	process_identifier: 544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005b3000 process_handle: 0xffffffff	1	0	0

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 9, 2025, 8:33 a.m.			0	0
IsDebuggerPresent July 9, 2025, 8:33 a.m.			0	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	gu_idata
section	gu_rsrcs

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Creates executable files on the filesystem (1 event)

file	C:\Users\Administrator\AppData\Local\Temp\asih.exe

Drops a binary and executes it (1 event)

file	C:\Users\Administrator\AppData\Local\Temp\asih.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\Administrator\AppData\Local\Temp\asih.exe

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW July 9, 2025, 8:33 a.m.	show_type: 0 filepath_r: C:\Users\ADMINI~1\AppData\Local\Temp\asih.exe parameters: filepath: C:\Users\Administrator\AppData\Local\Temp\asih.exe	1	1	0

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory July 9, 2025, 8:33 a.m.	process_identifier: 868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x005d1000 process_handle: 0xffffffff	1	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses July 9, 2025, 8:33 a.m.	flags: 46 family: 0	1	0	0

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (10 events)

Time & API	Arguments	Status	Return	Repeated
RegSetValueExW July 9, 2025, 8:33 a.m.	key_handle: 0x00000588 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) value: 1 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{092F0E6C-7874-4263-8D41-969F2B667EA2}\WpadDecisionReason	1	0	0
RegSetValueExW July 9, 2025, 8:33 a.m.	key_handle: 0x00000588 regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) value: ÎK¡ðÛ regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{092F0E6C-7874-4263-8D41-969F2B667EA2}\WpadDecisionTime	1	0	0
RegSetValueExW July 9, 2025, 8:33 a.m.	key_handle: 0x00000588 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) value: 0 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{092F0E6C-7874-4263-8D41-969F2B667EA2}\WpadDecision	1	0	0
RegSetValueExW July 9, 2025, 8:33 a.m.	key_handle: 0x00000588 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) value: Network regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{092F0E6C-7874-4263-8D41-969F2B667EA2}\WpadNetworkName	1	0	0
RegSetValueExW July 9, 2025, 8:33 a.m.	key_handle: 0x00000590 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) value: 1 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	1	0	0
RegSetValueExW July 9, 2025, 8:33 a.m.	key_handle: 0x00000590 regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) value: ÎK¡ðÛ regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	1	0	0
RegSetValueExW July 9, 2025, 8:33 a.m.	key_handle: 0x00000590 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) value: 0 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	1	0	0
RegSetValueExW July 9, 2025, 8:33 a.m.	key_handle: 0x00000590 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) value: 1 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	1	0	0
RegSetValueExW July 9, 2025, 8:33 a.m.	key_handle: 0x00000590 regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) value: ÎK¡ðÛ regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	1	0	0
RegSetValueExW July 9, 2025, 8:33 a.m.	key_handle: 0x00000590 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) value: 0 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	1	0	0

Creates known Upatre files, registry keys and/or mutexes (1 event)

file	C:\Users\jbayuelo\AppData\Local\Temp\Rar$EX00.060\Invoice_OCT-02-2013.exe

File has been identified by 14 AntiVirus engine on IRMA as malicious (14 events)

G Data Antivirus (Windows)	Virus: Trojan.Agent.BALW (Engine A), Win32.Trojan-Downloader.Upatre.BJ (Engine B)
Avast Core Security (Linux)	Win32:Agent-ASIV [Trj]
C4S ClamAV (Linux)	Win.Trojan.Upatre-3337
Trend Micro SProtect (Linux)	TROJ_UPATRE.SMAG
Trellix (Linux)	PWSZbot-FIE
WithSecure (Linux)	Trojan.TR/Dropper.Gen
eScan Antivirus (Linux)	Trojan.Agent.BALW(DB)
ESET Security (Windows)	Win32/TrojanDownloader.Small.AAB trojan
Sophos Anti-Virus (Linux)	Troj/Mdrop-FLP
DrWeb Antivirus (Linux)	Trojan.DownLoad3.28161
ClamAV (Linux)	Win.Trojan.Upatre-3337
Bitdefender Antivirus (Linux)	Trojan.Agent.BALW
Kaspersky Standard (Windows)	HEUR:Trojan.Win32.Generic
Emsisoft Commandline Scanner (Windows)	Trojan.Agent.BALW (B)

File has been identified by 65 AntiVirus engines on VirusTotal as malicious (50 out of 65 events)

Bkav	W32.AIDetectMalware
tehtris	Generic.Malware
Cynet	Malicious (score: 100)
Skyhigh	BehavesLike.Win32.PWSZbot.lz
ALYac	Trojan.Agent.BALW
Cylance	Unsafe
VIPRE	Trojan.Agent.BALW
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
BitDefender	Trojan.Agent.BALW
K7GW	Trojan-Downloader ( 0055c6c71 )
K7AntiVirus	Trojan-Downloader ( 0055c6c71 )
Arcabit	Trojan.Agent.BALW
Baidu	Win32.Trojan-Downloader.Small.c
VirIT	Trojan.Win32.AgentT.DYVF
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	Win32/TrojanDownloader.Small.AAB
APEX	Malicious
Avast	Win32:Gepys-E [Trj]
ClamAV	Win.Trojan.Upatre-3337
Kaspersky	HEUR:Trojan.Win32.Generic
NANO-Antivirus	Trojan.Win32.DownLoad3.cjxpzu
SUPERAntiSpyware	Trojan.Agent/Gen-Injector
MicroWorld-eScan	Trojan.Agent.BALW
Rising	Downloader.Waski!1.A489 (CLASSIC)
Emsisoft	Trojan.Agent.BALW (B)
F-Secure	Trojan.TR/Dropper.Gen
DrWeb	Trojan.DownLoad3.28161
Zillya	Downloader.Small.Win32.228156
TrendMicro	TROJ_UPATRE.SMAG
McAfeeD	Real Protect-LS!DA25700F283F
Trapmine	malicious.high.ml.score
CTX	exe.trojan.balw
Sophos	Troj/Mdrop-FLP
SentinelOne	Static AI - Malicious PE
Jiangmin	TrojanSpy.Zbot.eafz
Webroot	W32.Trojan.Gen
Google	Detected
Avira	TR/Dropper.Gen
Antiy-AVL	Trojan/Win32.Waski.a
Kingsoft	malware.kb.a.999
Gridinsoft	Ransom.Win32.Zbot.oa!s1
Xcitium	TrojWare.Win32.TrojanDownloader.Upatre.MAUA@5rueuc
Microsoft	TrojanDownloader:Win32/Upatre
ViRobot	Trojan.Win32.U.Agent.27648
ZoneAlarm	Troj/Mdrop-FLP
GData	Win32.Trojan-Downloader.Upatre.BJ
Varist	W32/Upatre.RF.gen!Eldorado
AhnLab-V3	Trojan/Win.Kryptk.R635829

Screenshots