File name:

Build.zip

Full analysis: https://app.any.run/tasks/b613e7cb-ca7f-499a-8b31-c75d29a287fa
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: May 30, 2025, 19:54:26
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
arch-doc
ransomware
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=store
MD5:

601871543A86CEA3998E44FE807A4C01

SHA1:

2873BAE0A2CA357961FFED69BC2CC28E76474D7F

SHA256:

1F494EDC569BC110896E491D6C8B3EAE1029DA01698A83FEFBA38B20852BEC79

SSDEEP:

24576:nFOBmNg4hbUwAYOffstf5/2AuzBdrms0NY:nFOkO4hbHApffstf5/2Auzzrms0NY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 6476)

    • Known privilege escalation attack

      • dllhost.exe (PID: 7296)

    • Renames files like ransomware

      • LB3.exe (PID: 7988)

    • RANSOMWARE has been detected

      • LB3.exe (PID: 7988)

  • SUSPICIOUS

    • Start notepad (likely ransomware note)

      • WinRAR.exe (PID: 6476)

    • Executes application which crashes

      • LB3_pass.exe (PID: 1680)

    • The process creates files with name similar to system file names

      • WinRAR.exe (PID: 6476)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 6476)
      • ShellExperienceHost.exe (PID: 8168)

    • Write to the desktop.ini file (may be used to cloak folders)

      • LB3.exe (PID: 7988)

    • The process executes via Task Scheduler

      • PLUGScheduler.exe (PID: 4084)

  • INFO

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 1600)
      • OpenWith.exe (PID: 8040)
      • notepad.exe (PID: 8000)
      • dllhost.exe (PID: 7296)

    • Reads Microsoft Office registry keys

      • WinRAR.exe (PID: 6476)
      • OpenWith.exe (PID: 8040)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 5048)
      • LB3.exe (PID: 7988)

    • Checks supported languages

      • LB3_pass.exe (PID: 1680)
      • LB3.exe (PID: 5376)
      • LB3.exe (PID: 7988)
      • ShellExperienceHost.exe (PID: 8168)

    • Reads the computer name

      • LB3.exe (PID: 5376)
      • LB3.exe (PID: 7988)
      • ShellExperienceHost.exe (PID: 8168)

    • Reads the machine GUID from the registry

      • LB3.exe (PID: 5376)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6476)

    • Creates files in the program directory

      • LB3.exe (PID: 7988)

    • Manual execution by a user

      • osk.exe (PID: 5032)
      • osk.exe (PID: 5792)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2025:05:16 19:59:26
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: Build/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
300
Monitored processes
15
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe no specs notepad.exe no specs lb3_pass.exe werfault.exe no specs openwith.exe no specs notepad.exe no specs lb3.exe no specs CMSTPLUA THREAT lb3.exe no specs shellexperiencehost.exe no specs plugscheduler.exe no specs osk.exe no specs osk.exe

Process information

PID
CMD
Path
Indicators
Parent process
1600"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\Rar$DIa6476.18712\Password_dll.txtC:\Windows\System32\notepad.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
1680"C:\Users\admin\AppData\Local\Temp\Rar$EXa6476.20043\Build\LB3_pass.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa6476.20043\Build\LB3_pass.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa6476.20043\build\lb3_pass.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\gdi32.dll
4084"C:\Program Files\RUXIM\PLUGscheduler.exe"C:\Program Files\RUXIM\PLUGScheduler.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Update LifeCycle Component Scheduler
Exit code:
0
Version:
10.0.19041.3623 (WinBuild.160101.0800)
Modules
Images
c:\program files\ruxim\plugscheduler.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
5032"C:\WINDOWS\system32\osk.exe" C:\Windows\System32\osk.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Accessibility On-Screen Keyboard
Exit code:
3221226540
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\osk.exe
c:\windows\system32\ntdll.dll
5048C:\WINDOWS\SysWOW64\WerFault.exe -u -p 1680 -s 272C:\Windows\SysWOW64\WerFault.exe—LB3_pass.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
5304C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
5376"C:\Users\admin\AppData\Local\Temp\Rar$EXa6476.23965\Build\LB3.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa6476.23965\Build\LB3.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa6476.23965\build\lb3.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\gdi32.dll
5792"C:\WINDOWS\system32\osk.exe" C:\Windows\System32\osk.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Accessibility On-Screen Keyboard
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\osk.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\gdi32.dll
6248"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6476"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\Build.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
1073807364
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
9 148
Read events
9 040
Write events
107
Delete events
1

Modification events

(PID) Process:(6476) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6476) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6476) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6476) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Build.zip
(PID) Process:(6476) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6476) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6476) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6476) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6476) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithProgids
Operation:writeName:txtfile
Value:
(PID) Process:(7296) dllhost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
Executable files
10
Suspicious files
178
Text files
302
Unknown types
104

Dropped files

PID
Process
Filename
Type
5048WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_LB3_pass.exe_d37dc549bc1e7d6c94ecae1c6a15a69f69da5_d9cc3852_7ec5b404-b94c-47a4-b618-b87731d59c20\Report.wer —
MD5:—
SHA256:—
6476WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa6476.20043\Build\LB3.exeexecutable
MD5:74554CCE961F59B4B50BCFD3BB8CCA18
SHA256:4EDAF26A7EF2CE81CEF6630A4262A2D488819C4E8ABF57F6CC93CB912B10612C
6476WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa6476.18712\Password_dll.txttext
MD5:5042D5008A03D9A802B70DB7DB670DF8
SHA256:93FF71CCD4F101AAF3D2CF3140C4D4C4DEA6966035CE678CA0CB5A84F7C627B6
6476WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa6476.20043\Build\Password_exe.txttext
MD5:BE35FBF734030AB125671E0AC7C35F7D
SHA256:47BEC0D059C7FA8B865429D436358B2CABA8CC20597A35274D1D4C7BD5A6BE7F
6476WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa6476.20043\Build\LB3_Rundll32_pass.dllexecutable
MD5:94472911C70F020B7678790A4E51E0D7
SHA256:9D298CAFBDF180C9CBA6A40A4CBD34D04EF93CA5652333E394FDB0D8DCD1FF84
6476WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa6476.20043\Build\LB3_Rundll32.dllexecutable
MD5:020E35F996FED7F84A1B5719E68F321A
SHA256:4D503EB6D3DBDD7D3D1088163FE55BEA1AE1BFD64A4AA0A6A77A50F78DB1AAFE
6476WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa6476.20043\Build\DECRYPTION_ID.txttext
MD5:564A8EF7B5662AAE6B78105C43CD3BC0
SHA256:8829D73DB4D307A1A541BE7E2024762BDB6AC2274C76CD78A78FB2BDFBA61DBA
6476WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa6476.20043\Build\LB3_pass.exeexecutable
MD5:094E95270FE03D025563E25F76528B06
SHA256:42CC442ADBB8F34DFB1C2ABF6528259CC9B0E2AC93458F2839DE40635CCB10B8
6476WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa6476.20043\Build\LB3_ReflectiveDll_DllMain.dllexecutable
MD5:88A1389D4DE21569A3E032568FF5B1BA
SHA256:2816E7DB39699BFCBFD9770208CEF7D8362277E4D8E8278BBC2737F9336DEFF2
6476WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa6476.20043\Build\pub.keytext
MD5:E457160EB8CEDE25C9D71017D32ED37F
SHA256:6A511D62B3C8A217B16751C695EFF2DD6C7AF573B7F06349258FBB573D86AEF6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
101
DNS requests
28
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2920
svchost.exe
GET
404
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2920
svchost.exe
GET
404
23.48.23.187:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7292
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
40.126.31.129:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6564
SIHClient.exe
20.109.210.53:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6564
SIHClient.exe
13.85.23.206:443
fe3cr.delivery.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2920
svchost.exe
23.48.23.187:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2920
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 142.250.184.206
whitelisted
login.live.com
  • 40.126.31.129
  • 40.126.31.0
  • 20.190.159.0
  • 40.126.31.67
  • 20.190.159.75
  • 20.190.159.73
  • 20.190.159.128
  • 40.126.31.130
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
  • 2603:1030:c02:2::284
whitelisted
206.23.85.13.in-addr.arpa
  • —
unknown
4.8.2.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.0.0.2.0.c.0.0.3.0.1.3.0.6.2.ip6.arpa
  • —
unknown
crl.microsoft.com
  • 23.48.23.187
  • 23.48.23.175
  • 23.48.23.179
  • 23.48.23.182
  • 23.48.23.185
  • 23.48.23.177
  • 23.48.23.170
  • 23.48.23.181
  • 23.48.23.183
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
self.events.data.microsoft.com
  • 20.189.173.9
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Build.zip