File name:

LENA.zip

Full analysis: https://app.any.run/tasks/6c4d4f78-0e42-45b5-8312-b9b5c7b286df
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: February 08, 2025, 11:35:47
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
ransomware
stealer
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

2FC9454248C6328D34D1C491BAF0F6FB

SHA1:

0D09E222918FBFB408711015CD8F21BD46D0F8DB

SHA256:

44DDABBEB2FC125D5EA67033A714386E0221773178D26E4C44B1BC52AE4D0599

SSDEEP:

1536:UbwJfIOcXDK0fPE96BtqSKAgxM6hGyUuX60SfyZlG0JGPIZ:3MTK0HE96BtqMgxMwX6nfyfPZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 5404)

    • Create files in the Startup directory

      • LENA.exe (PID: 5544)

    • RANSOMWARE has been detected

      • LENA.exe (PID: 5544)

    • Actions looks like stealing of personal data

      • LENA.exe (PID: 5544)

    • Renames files like ransomware

      • LENA.exe (PID: 5544)

    • Deletes shadow copies

      • cmd.exe (PID: 5752)
      • cmd.exe (PID: 2076)

    • Using BCDEDIT.EXE to modify recovery options

      • cmd.exe (PID: 6776)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • LENA.exe (PID: 6952)
      • LENA.exe (PID: 5544)

    • Reads the date of Windows installation

      • LENA.exe (PID: 6952)
      • LENA.exe (PID: 5544)

    • Executable content was dropped or overwritten

      • LENA.exe (PID: 6952)

    • Starts itself from another location

      • LENA.exe (PID: 6952)

    • Write to the desktop.ini file (may be used to cloak folders)

      • LENA.exe (PID: 5544)

    • Executes as Windows Service

      • wbengine.exe (PID: 7012)
      • VSSVC.exe (PID: 4864)
      • vds.exe (PID: 6988)

    • Start notepad (likely ransomware note)

      • LENA.exe (PID: 5544)

    • Starts CMD.EXE for commands execution

      • LENA.exe (PID: 5544)

  • INFO

    • Manual execution by a user

      • LENA.exe (PID: 6952)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5404)

    • Creates files or folders in the user directory

      • LENA.exe (PID: 6952)
      • LENA.exe (PID: 5544)

    • Reads the computer name

      • LENA.exe (PID: 6952)
      • LENA.exe (PID: 5544)

    • Process checks computer location settings

      • LENA.exe (PID: 6952)
      • LENA.exe (PID: 5544)

    • Checks supported languages

      • LENA.exe (PID: 6952)
      • LENA.exe (PID: 5544)

    • Reads the machine GUID from the registry

      • LENA.exe (PID: 5544)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 3532)
      • notepad.exe (PID: 3884)

    • Reads Microsoft Office registry keys

      • LENA.exe (PID: 5544)
      • OpenWith.exe (PID: 4976)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2025:02:08 19:45:50
ZipCRC: 0xcb45b54b
ZipCompressedSize: 56204
ZipUncompressedSize: 87552
ZipFileName: LENA.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
153
Monitored processes
20
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe lena.exe THREAT lena.exe cmd.exe no specs conhost.exe no specs vssadmin.exe no specs vssvc.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs bcdedit.exe no specs bcdedit.exe no specs cmd.exe no specs conhost.exe no specs wbadmin.exe wbengine.exe no specs vdsldr.exe no specs vds.exe no specs notepad.exe no specs openwith.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1876vssadmin delete shadows /all /quiet C:\Windows\System32\vssadmin.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2076"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quietC:\Windows\System32\cmd.exe—LENA.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
3532wmic shadowcopy deleteC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
3884"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Roaming\LENA.txtC:\Windows\System32\notepad.exe—LENA.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Notepad
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4264\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4864C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4932C:\WINDOWS\System32\vdsldr.exe -EmbeddingC:\Windows\System32\vdsldr.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Virtual Disk Service Loader
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vdsldr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4976C:\WINDOWS\system32\OpenWith.exe -EmbeddingC:\Windows\System32\OpenWith.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
5316\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5404"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\LENA.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
7 155
Read events
7 086
Write events
38
Delete events
31

Modification events

(PID) Process:(5404) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(5404) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(5404) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(5404) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\LENA.zip
(PID) Process:(5404) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5404) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5404) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5404) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5404) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
(PID) Process:(5404) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:14
Value:
Executable files
2
Suspicious files
1
Text files
617
Unknown types
0

Dropped files

PID
Process
Filename
Type
6952LENA.exeC:\Users\admin\AppData\Roaming\LENA.exeexecutable
MD5:38EB98EC99A09140EB3632707084F819
SHA256:CEF73BFA612C582874CBF1C81752D47FD7709098771FFBDED0E5E0C8C11271E8
5544LENA.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LENA.urlbinary
MD5:B7B949DFD0464D6CE5B4D111879843B7
SHA256:933B3BFF3D2D3D6B09F69DF9ED4A3E66923E6E411CF4CD9F25243FEFEEB12FFB
5404WinRAR.exeC:\Users\admin\Desktop\LENA.exeexecutable
MD5:38EB98EC99A09140EB3632707084F819
SHA256:CEF73BFA612C582874CBF1C81752D47FD7709098771FFBDED0E5E0C8C11271E8
5544LENA.exeC:\Users\admin\Desktop\LENA.txttext
MD5:FCF7E583ACCF4A63479B965FC16E0CC9
SHA256:E27512FAEDB4CD65A9E2B3F62BB549BDB5089D966EA179F19F57491B22AB92CA
5544LENA.exeC:\Users\admin\Desktop\desktop.ini.lenatext
MD5:EE187BB4F336FA820B70AB825BA0F318
SHA256:C048AC5BB766EC8901F1105F045F6E6D08A2ECAE3596225650E67C69985C055B
5544LENA.exeC:\Users\admin\Desktop\largestschedule.jpgtext
MD5:E649573EECEF9E9F561B6DCCB16C6BEA
SHA256:0DCED3B70B5AA0FF2ABC937C01CDCB01F75B8C80F251E82AFBE827DCF18B13FD
5544LENA.exeC:\Users\admin\Desktop\afamilies.rtf.lenatext
MD5:F713FAF566FF9F19238C5FBCF13828AD
SHA256:59CEA6B94A6C894850514CD3670EB6AAC0959351479746E963231DA0363C3E3B
5544LENA.exeC:\Users\admin\Desktop\largestschedule.jpg.lenatext
MD5:E649573EECEF9E9F561B6DCCB16C6BEA
SHA256:0DCED3B70B5AA0FF2ABC937C01CDCB01F75B8C80F251E82AFBE827DCF18B13FD
5544LENA.exeC:\Users\admin\Desktop\LENA.ziptext
MD5:9D78164709CC4983B826EB175D78C93B
SHA256:BAC871C4EFA7DFE8A4F0A480E4B73684C6C29E0F5ADD6F025500BC6624E92163
5544LENA.exeC:\Users\admin\Desktop\nyprior.rtftext
MD5:0FA91BC97F0F47D985A9D6D4B7025948
SHA256:4DDEA8F098A148677560ED2C03DA4002C3D3667554C22AAA6DD160645D90D00F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
25
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1176
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6356
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
4392
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4392
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1076
svchost.exe
184.28.89.167:443
go.microsoft.com
AKAMAI-AS
US
whitelisted
4804
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
40.126.32.74:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
2.23.77.188:80
—
AKAMAI-AS
DE
unknown
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5004
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6356
backgroundTaskHost.exe
20.223.36.55:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
go.microsoft.com
  • 184.28.89.167
whitelisted
login.live.com
  • 40.126.32.74
  • 40.126.32.72
  • 20.190.160.20
  • 20.190.160.3
  • 40.126.32.140
  • 40.126.32.133
  • 40.126.32.76
  • 20.190.160.131
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
fd.api.iris.microsoft.com
  • 20.31.169.57
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
nexusrules.officeapps.live.com
  • 52.111.236.22
whitelisted

Threats

No threats detected
Process
Message
wbadmin.exe
Invalid parameter passed to C runtime function.
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
LENA.zip