Summary

b6f39bc1db8f30bd_asih.exe

File b6f39bc1db8f30bd_asih.exe

Summary
Download Resubmit sample

Size 78.6KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 bc05ed3b41a3006f6a9f36ae8eac3a2c
SHA1 91bde380b1c56fbdd8a8683d62ec9dd3ba0ce92a
SHA256 b6f39bc1db8f30bd4c9a34930a26a1a27963691477733ad87817031214b3ce6a
SHA512
b888b8ed366d6fbbee2ac17d5f246ea3143f3f1a32602479311fe061e1e6bca24775ae36a08fb8c139210c5c8154e031cb498896725c8cedb712534a12d40571
CRC32 738DBEAB
ssdeep None
Yara
  • CryptoLocker_set1 - Detection of Cryptolocker Samples
  • CryptoLocker_rule2 - Detection of CryptoLocker Variants
  • win_files_operation - Affect private profile

Score

This file is very suspicious, with a score of 10 out of 10!

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

Autosubmit

Parent_Task_ID:6704982

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Analysis
Category Started Completed Duration Routing Logs
FILE July 18, 2025, 3:10 p.m. July 18, 2025, 3:18 p.m. 481 seconds internet Show Analyzer Log
Show Cuckoo Log

Analyzer Log

2025-07-14 12:44:04,015 [analyzer] DEBUG: Starting analyzer from: C:\tmpdrdvpd
2025-07-14 12:44:04,015 [analyzer] DEBUG: Pipe server name: \??\PIPE\DScoIbqKsPWikHVpSq
2025-07-14 12:44:04,015 [analyzer] DEBUG: Log pipe server name: \??\PIPE\ZZlgtVaYAbfEMemzdyDGATSSx
2025-07-14 12:44:04,015 [analyzer] DEBUG: No analysis package specified, trying to detect it automagically.
2025-07-14 12:44:04,015 [analyzer] INFO: Automatically selected analysis package "exe"
2025-07-14 12:44:04,265 [analyzer] DEBUG: Started auxiliary module Curtain
2025-07-14 12:44:04,265 [analyzer] DEBUG: Started auxiliary module DbgView
2025-07-14 12:44:04,812 [analyzer] DEBUG: Started auxiliary module Disguise
2025-07-14 12:44:05,000 [analyzer] DEBUG: Loaded monitor into process with pid 508
2025-07-14 12:44:05,000 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2025-07-14 12:44:05,000 [analyzer] DEBUG: Started auxiliary module Human
2025-07-14 12:44:05,000 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2025-07-14 12:44:05,000 [analyzer] DEBUG: Started auxiliary module Reboot
2025-07-14 12:44:05,092 [analyzer] DEBUG: Started auxiliary module RecentFiles
2025-07-14 12:44:05,092 [analyzer] DEBUG: Started auxiliary module Screenshots
2025-07-14 12:44:05,092 [analyzer] DEBUG: Started auxiliary module Sysmon
2025-07-14 12:44:05,092 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2025-07-14 12:44:05,233 [lib.api.process] INFO: Successfully executed process from path u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\b6f39bc1db8f30bd_asih.exe' with arguments '' and pid 1268
2025-07-14 12:44:05,421 [analyzer] DEBUG: Loaded monitor into process with pid 1268
2025-07-14 12:44:05,467 [analyzer] INFO: Added new file to list with pid 1268 and path C:\Users\Administrator\AppData\Local\Temp\asih.exe
2025-07-14 12:44:05,578 [analyzer] INFO: Injected into process with pid 2712 and name u'asih.exe'
2025-07-14 12:44:05,733 [analyzer] DEBUG: Loaded monitor into process with pid 2712
2025-07-14 12:44:06,233 [analyzer] INFO: Process with pid 1268 has terminated
2025-07-14 12:44:22,265 [analyzer] INFO: Added new file to list with pid 2712 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D
2025-07-14 12:44:22,280 [analyzer] INFO: Added new file to list with pid 2712 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D
2025-07-14 12:44:22,390 [analyzer] INFO: Added new file to list with pid 2712 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
2025-07-14 12:44:22,390 [analyzer] INFO: Added new file to list with pid 2712 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
2025-07-14 12:47:24,250 [analyzer] INFO: Analysis timeout hit, terminating analysis.
2025-07-14 12:47:25,467 [analyzer] INFO: Terminating remaining processes before shutdown.
2025-07-14 12:47:25,467 [lib.api.process] INFO: Successfully terminated process with pid 2712.
2025-07-14 12:47:25,483 [analyzer] INFO: Analysis completed.

Cuckoo Log

2025-07-18 15:10:45,811 [cuckoo.core.scheduler] INFO: Task #6732312: acquired machine win7x6412 (label=win7x6412)
2025-07-18 15:10:45,812 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.212 for task #6732312
2025-07-18 15:10:46,178 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 2744370 (interface=vboxnet0, host=192.168.168.212)
2025-07-18 15:10:46,297 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x6412
2025-07-18 15:10:47,728 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x6412 to vmcloak
2025-07-18 15:13:07,376 [cuckoo.core.guest] INFO: Starting analysis #6732312 on guest (id=win7x6412, ip=192.168.168.212)
2025-07-18 15:13:08,383 [cuckoo.core.guest] DEBUG: win7x6412: not ready yet
2025-07-18 15:13:13,407 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x6412, ip=192.168.168.212)
2025-07-18 15:13:13,491 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x6412, ip=192.168.168.212, monitor=latest, size=6660546)
2025-07-18 15:13:14,742 [cuckoo.core.resultserver] DEBUG: Task #6732312: live log analysis.log initialized.
2025-07-18 15:13:15,680 [cuckoo.core.resultserver] DEBUG: Task #6732312 is sending a BSON stream
2025-07-18 15:13:16,086 [cuckoo.core.resultserver] DEBUG: Task #6732312 is sending a BSON stream
2025-07-18 15:13:16,399 [cuckoo.core.resultserver] DEBUG: Task #6732312 is sending a BSON stream
2025-07-18 15:13:16,943 [cuckoo.core.resultserver] DEBUG: Task #6732312: File upload for 'shots/0001.jpg'
2025-07-18 15:13:16,978 [cuckoo.core.resultserver] DEBUG: Task #6732312 uploaded file length: 133485
2025-07-18 15:13:29,575 [cuckoo.core.guest] DEBUG: win7x6412: analysis #6732312 still processing
2025-07-18 15:13:44,913 [cuckoo.core.guest] DEBUG: win7x6412: analysis #6732312 still processing
2025-07-18 15:14:00,038 [cuckoo.core.guest] DEBUG: win7x6412: analysis #6732312 still processing
2025-07-18 15:14:15,157 [cuckoo.core.guest] DEBUG: win7x6412: analysis #6732312 still processing
2025-07-18 15:14:30,245 [cuckoo.core.guest] DEBUG: win7x6412: analysis #6732312 still processing
2025-07-18 15:14:45,342 [cuckoo.core.guest] DEBUG: win7x6412: analysis #6732312 still processing
2025-07-18 15:15:00,423 [cuckoo.core.guest] DEBUG: win7x6412: analysis #6732312 still processing
2025-07-18 15:15:15,528 [cuckoo.core.guest] DEBUG: win7x6412: analysis #6732312 still processing
2025-07-18 15:15:30,635 [cuckoo.core.guest] DEBUG: win7x6412: analysis #6732312 still processing
2025-07-18 15:15:45,724 [cuckoo.core.guest] DEBUG: win7x6412: analysis #6732312 still processing
2025-07-18 15:16:00,816 [cuckoo.core.guest] DEBUG: win7x6412: analysis #6732312 still processing
2025-07-18 15:16:15,898 [cuckoo.core.guest] DEBUG: win7x6412: analysis #6732312 still processing
2025-07-18 15:16:31,092 [cuckoo.core.guest] DEBUG: win7x6412: analysis #6732312 still processing
2025-07-18 15:16:35,185 [cuckoo.core.resultserver] DEBUG: Task #6732312: File upload for 'curtain/1752490044.44.curtain.log'
2025-07-18 15:16:35,188 [cuckoo.core.resultserver] DEBUG: Task #6732312 uploaded file length: 36
2025-07-18 15:16:36,111 [cuckoo.core.resultserver] DEBUG: Task #6732312: File upload for 'sysmon/1752490045.36.sysmon.xml'
2025-07-18 15:16:36,210 [cuckoo.core.resultserver] DEBUG: Task #6732312 uploaded file length: 13702544
2025-07-18 15:16:36,234 [cuckoo.core.resultserver] DEBUG: Task #6732312: File upload for 'files/2fc4d2b169cfa01c_2d85f72862b55c4eadd9e66e06947f3d'
2025-07-18 15:16:36,236 [cuckoo.core.resultserver] DEBUG: Task #6732312 uploaded file length: 192
2025-07-18 15:16:36,238 [cuckoo.core.resultserver] DEBUG: Task #6732312: File upload for 'files/5d7b486ff87e1383_94308059b57b3142e455b38a6eb92015'
2025-07-18 15:16:36,239 [cuckoo.core.resultserver] DEBUG: Task #6732312 uploaded file length: 344
2025-07-18 15:16:36,240 [cuckoo.core.resultserver] DEBUG: Task #6732312: File upload for 'files/4c847e0c28733ed3_94308059b57b3142e455b38a6eb92015'
2025-07-18 15:16:36,243 [cuckoo.core.resultserver] DEBUG: Task #6732312: File upload for 'files/2f3294172576e080_asih.exe'
2025-07-18 15:16:36,245 [cuckoo.core.resultserver] DEBUG: Task #6732312 uploaded file length: 80602
2025-07-18 15:16:36,246 [cuckoo.core.resultserver] DEBUG: Task #6732312 uploaded file length: 73513
2025-07-18 15:16:36,252 [cuckoo.core.resultserver] DEBUG: Task #6732312: File upload for 'files/96bcec06264976f3_2d85f72862b55c4eadd9e66e06947f3d'
2025-07-18 15:16:36,254 [cuckoo.core.resultserver] DEBUG: Task #6732312 uploaded file length: 1391
2025-07-18 15:16:36,260 [cuckoo.core.resultserver] DEBUG: Task #6732312 had connection reset for <Context for LOG>
2025-07-18 15:16:37,117 [cuckoo.core.guest] INFO: win7x6412: analysis completed successfully
2025-07-18 15:16:37,132 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2025-07-18 15:16:37,156 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2025-07-18 15:16:38,212 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x6412 to path /srv/cuckoo/cwd/storage/analyses/6732312/memory.dmp
2025-07-18 15:16:38,213 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x6412
2025-07-18 15:18:46,767 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.212 for task #6732312
2025-07-18 15:18:47,320 [cuckoo.core.scheduler] DEBUG: Released database task #6732312
2025-07-18 15:18:47,479 [cuckoo.core.scheduler] INFO: Task #6732312: analysis procedure completed

Signatures

Yara rules detected for file (3 events)
description Detection of Cryptolocker Samples rule CryptoLocker_set1
description Detection of CryptoLocker Variants rule CryptoLocker_rule2
description Affect private profile rule win_files_operation
Allocates read-write-execute memory (usually to unpack itself) (4 events)
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1268
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 24576
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005b0000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1268
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005e3000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2712
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 24576
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01dd0000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2712
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01e03000
process_handle: 0xffffffff
1 0 0
Checks if process is being debugged by a debugger (2 events)
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)
section gu_idata
section gu_rsrcs
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Creates executable files on the filesystem (1 event)
file C:\Users\Administrator\AppData\Local\Temp\asih.exe
Drops a binary and executes it (1 event)
file C:\Users\Administrator\AppData\Local\Temp\asih.exe
Drops an executable to the user AppData folder (1 event)
file C:\Users\Administrator\AppData\Local\Temp\asih.exe
A process created a hidden window (1 event)
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\ADMINI~1\AppData\Local\Temp\asih.exe
parameters:
filepath: C:\Users\Administrator\AppData\Local\Temp\asih.exe
1 1 0
Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1268
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x005e1000
process_handle: 0xffffffff
1 0 0
Checks adapter addresses which can be used to detect virtual network interfaces (1 event)
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 46
family: 0
1 0 0
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (10 events)
Time & API Arguments Status Return Repeated

RegSetValueExW

 key_handle: 0x00000584
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
value: 1
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{092F0E6C-7874-4263-8D41-969F2B667EA2}\WpadDecisionReason
1 0 0

RegSetValueExW

 key_handle: 0x00000584
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
value: è±ÁÛôÛ
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{092F0E6C-7874-4263-8D41-969F2B667EA2}\WpadDecisionTime
1 0 0

RegSetValueExW

 key_handle: 0x00000584
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
value: 0
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{092F0E6C-7874-4263-8D41-969F2B667EA2}\WpadDecision
1 0 0

RegSetValueExW

 key_handle: 0x00000584
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
value: Network
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{092F0E6C-7874-4263-8D41-969F2B667EA2}\WpadNetworkName
1 0 0

RegSetValueExW

 key_handle: 0x0000058c
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
value: 1
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
1 0 0

RegSetValueExW

 key_handle: 0x0000058c
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
value: è±ÁÛôÛ
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
1 0 0

RegSetValueExW

 key_handle: 0x0000058c
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
value: 0
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
1 0 0

RegSetValueExW

 key_handle: 0x0000058c
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
value: 1
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
1 0 0

RegSetValueExW

 key_handle: 0x0000058c
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
value: è±ÁÛôÛ
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
1 0 0

RegSetValueExW

 key_handle: 0x0000058c
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
value: 0
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
1 0 0
Creates known Upatre files, registry keys and/or mutexes (1 event)
file C:\Users\jbayuelo\AppData\Local\Temp\Rar$EX00.060\Invoice_OCT-02-2013.exe
File has been identified by 13 AntiVirus engine on IRMA as malicious (13 events)
G Data Antivirus (Windows) Virus: Trojan.Agent.BALW (Engine A), Win32.Trojan-Downloader.Upatre.BJ (Engine B)
Avast Core Security (Linux) Win32:Agent-ASIV [Trj]
C4S ClamAV (Linux) Win.Trojan.Upatre-3337
Trend Micro SProtect (Linux) TROJ_UPATRE.SMAG
Trellix (Linux) PWSZbot-FIE
WithSecure (Linux) Trojan.TR/Dropper.Gen
eScan Antivirus (Linux) Trojan.Agent.BALW(DB)
ESET Security (Windows) Win32/TrojanDownloader.Small.AAB trojan
Sophos Anti-Virus (Linux) Troj/Mdrop-FLP
DrWeb Antivirus (Linux) Trojan.DownLoad3.28161
Bitdefender Antivirus (Linux) Trojan.Agent.BALW
Kaspersky Standard (Windows) HEUR:Trojan.Win32.Generic
Emsisoft Commandline Scanner (Windows) Trojan.Agent.BALW (B)
Screenshots
Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action VT Location
No hosts contacted.
Cuckoo

We're processing your submission... This could take a few seconds.