Malware analysis LSBSetup.exe Malicious activity | ANY.RUN

Add for printing

File name:	LSBSetup.exe
Full analysis:	https://app.any.run/tasks/0dc59225-514b-45b3-a67e-c607ca544e44
Verdict:	Malicious activity
Analysis date:	July 22, 2024, 06:19:14
OS:	Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME:	application/x-dosexec
File info:	PE32 executable (GUI) Intel 80386, for MS Windows
MD5:	96177BA851092FA375FD850DF6AA7219
SHA1:	EB330E1A8A4F94AC014A0507288BCBDBEFF57860
SHA256:	454E5A32B53C8C67982417568E2857FC200968BE1AE710ED968EB1D95B0B94E3
SSDEEP:	98304:agEj36ZEvZKfXhaMqYqRmw8dWvLKpOeAZE/0UWyQsKsWMl6bgaOuIwO8BKJlvJiE:zTz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 240 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: 180 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Drops the executable file immediately after the start
  - LSBSetup.exe (PID: 2648)
  - LSBSetup.tmp (PID: 4816)
SUSPICIOUS
- Executable content was dropped or overwritten
  - LSBSetup.exe (PID: 2648)
  - LSBSetup.tmp (PID: 4816)
- Process drops legitimate windows executable
  - LSBSetup.tmp (PID: 4816)
- Reads the Windows owner or organization settings
  - LSBSetup.tmp (PID: 4816)
INFO
- Create files in a temporary directory
  - LSBSetup.exe (PID: 2648)
  - LSBSetup.tmp (PID: 4816)
- Checks supported languages
  - LSBSetup.exe (PID: 2648)
  - LSBSetup.tmp (PID: 4816)
  - CreateWTSTask.exe (PID: 7080)
  - CreateWTSTask.exe (PID: 7464)
  - LSB.exe (PID: 7092)
  - LSB.exe (PID: 4872)
  - LSB.exe (PID: 7692)
  - LSB.exe (PID: 7348)
  - LSB.exe (PID: 3628)
- Reads the computer name
  - LSBSetup.tmp (PID: 4816)
  - CreateWTSTask.exe (PID: 7080)
  - CreateWTSTask.exe (PID: 7464)
  - LSB.exe (PID: 7092)
  - LSB.exe (PID: 3628)
  - LSB.exe (PID: 7692)
  - LSB.exe (PID: 4872)
  - LSB.exe (PID: 7348)
- Creates files or folders in the user directory
  - LSBSetup.tmp (PID: 4816)
- Creates a software uninstall entry
  - LSBSetup.tmp (PID: 4816)
- Reads the machine GUID from the registry
  - LSB.exe (PID: 7092)
  - LSB.exe (PID: 7348)
- Reads Environment values
  - LSB.exe (PID: 7092)
  - LSB.exe (PID: 7348)
- Manual execution by a user
  - LSB.exe (PID: 3628)
  - LSB.exe (PID: 4872)
  - LSB.exe (PID: 7692)
  - Taskmgr.exe (PID: 7432)
  - Taskmgr.exe (PID: 2436)
  - LSB.exe (PID: 7348)
- Reads security settings of Internet Explorer
  - Taskmgr.exe (PID: 7432)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	Inno Setup installer (71.1)
.exe	\|	Win32 Executable Delphi generic (9.1)
.scr	\|	Windows screen saver (8.4)
.dll	\|	Win32 Dynamic Link Library (generic) (4.2)
.exe	\|	Win32 Executable (generic) (2.9)

EXIF

EXE

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	1992:06:19 22:22:17+00:00
ImageFileCharacteristics:	No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType:	PE32
LinkerVersion:	2.25
CodeSize:	40448
InitializedDataSize:	33280
UninitializedDataSize:	-
EntryPoint:	0xa5f8
OSVersion:	1
ImageVersion:	6
SubsystemVersion:	4
Subsystem:	Windows GUI
FileVersionNumber:	5.0.2.17
ProductVersionNumber:	5.0.2.17
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Win32
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Unicode
Comments:	This installation was built with Inno Setup.
CompanyName:	Lenovo
FileDescription:	LenovoServiceBridge Setup
FileVersion:	5.0.2.17
LegalCopyright:
ProductName:	LenovoServiceBridge
ProductVersion:	5.0.2.17

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

158

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

2436

"C:\WINDOWS\system32\taskmgr.exe" /4

C:\Windows\System32\Taskmgr.exe

—

explorer.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Task Manager

Exit code:

3221226540

Version:

10.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll

2648

"C:\Users\admin\Desktop\LSBSetup.exe"

C:\Users\admin\Desktop\LSBSetup.exe

explorer.exe

User:

admin

Company:

Lenovo

Integrity Level:

MEDIUM

Description:

LenovoServiceBridge Setup

Exit code:

Version:

5.0.2.17

Modules

Images
c:\users\admin\desktop\lsbsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll

3628

"C:\Users\admin\AppData\Local\Programs\Lenovo\Lenovo Service Bridge\LSB.exe"

C:\Users\admin\AppData\Local\Programs\Lenovo\Lenovo Service Bridge\LSB.exe

—

explorer.exe

User:

admin

Company:

Lenovo Group Limited

Integrity Level:

MEDIUM

Description:

Lenovo Service Bridge

Exit code:

Version:

5.0.2.17

Modules

Images
c:\users\admin\appdata\local\programs\lenovo\lenovo service bridge\lsb.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll

4816

"C:\Users\admin\AppData\Local\Temp\is-A0UUS.tmp\LSBSetup.tmp" /SL5="$60246,3427779,74752,C:\Users\admin\Desktop\LSBSetup.exe"

C:\Users\admin\AppData\Local\Temp\is-A0UUS.tmp\LSBSetup.tmp

LSBSetup.exe

User:

admin

Integrity Level:

MEDIUM

Description:

Setup/Uninstall

Exit code:

Version:

51.52.0.0

Modules

Images
c:\users\admin\appdata\local\temp\is-a0uus.tmp\lsbsetup.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll

4872

"C:\Users\admin\AppData\Local\Programs\Lenovo\Lenovo Service Bridge\LSB.exe"

C:\Users\admin\AppData\Local\Programs\Lenovo\Lenovo Service Bridge\LSB.exe

—

explorer.exe

User:

admin

Company:

Lenovo Group Limited

Integrity Level:

MEDIUM

Description:

Lenovo Service Bridge

Exit code:

Version:

5.0.2.17

Modules

Images
c:\users\admin\appdata\local\programs\lenovo\lenovo service bridge\lsb.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll

5400

C:\WINDOWS\System32\slui.exe -Embedding

C:\Windows\System32\slui.exe

—

svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Activation Client

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll

7080

"C:\Users\admin\AppData\Local\Programs\Lenovo\Lenovo Service Bridge\CreateWTSTask.exe" /uninstall

C:\Users\admin\AppData\Local\Programs\Lenovo\Lenovo Service Bridge\CreateWTSTask.exe

—

LSBSetup.tmp

User:

admin

Integrity Level:

MEDIUM

Exit code:

Modules

Images
c:\users\admin\appdata\local\programs\lenovo\lenovo service bridge\createwtstask.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll

7092

"C:\Users\admin\AppData\Local\Programs\Lenovo\Lenovo Service Bridge\LSB.exe"

C:\Users\admin\AppData\Local\Programs\Lenovo\Lenovo Service Bridge\LSB.exe

—

LSBSetup.tmp

User:

admin

Company:

Lenovo Group Limited

Integrity Level:

MEDIUM

Description:

Lenovo Service Bridge

Exit code:

Version:

5.0.2.17

Modules

Images
c:\users\admin\appdata\local\programs\lenovo\lenovo service bridge\lsb.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll

7348

"C:\Users\admin\AppData\Local\Programs\Lenovo\Lenovo Service Bridge\LSB.exe"

C:\Users\admin\AppData\Local\Programs\Lenovo\Lenovo Service Bridge\LSB.exe

—

explorer.exe

User:

admin

Company:

Lenovo Group Limited

Integrity Level:

MEDIUM

Description:

Lenovo Service Bridge

Version:

5.0.2.17

Modules

Images
c:\users\admin\appdata\local\programs\lenovo\lenovo service bridge\lsb.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll

7432

"C:\WINDOWS\system32\taskmgr.exe" /4

C:\Windows\System32\Taskmgr.exe

explorer.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Task Manager

Exit code:

Version:

10.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\combase.dll

Add for printing

Total events

8 713

Read events

8 667

Write events

Delete events

Modification events


(PID) Process:	(4816) LSBSetup.tmp	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:	write	Name:	Owner
Value: D012000079842318FFDBDA01
(PID) Process:	(4816) LSBSetup.tmp	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:	write	Name:	SessionHash
Value: B7A00A11E207DEB6CA524FE5D2D8E160A9FFBFB1DB3AE863E240A2DD7D052677
(PID) Process:	(4816) LSBSetup.tmp	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:	write	Name:	Sequence
Value: 1
(PID) Process:	(4816) LSBSetup.tmp	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:	write	Name:	RegFiles0000
Value: C:\Users\admin\AppData\Local\Programs\Lenovo\Lenovo Service Bridge\Adup.dll
(PID) Process:	(4816) LSBSetup.tmp	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:	write	Name:	RegFilesHash
Value: 719BC8A7C2FDD06E63206726A2EDBD59359717B00885BEB8481AECBCFD2096B8
(PID) Process:	(4816) LSBSetup.tmp	Key:	HKEY_CURRENT_USER\SOFTWARE\Lenovo\Lenovo Service Bridge
Operation:	write	Name:	Version
Value: 5.0.2.17
(PID) Process:	(4816) LSBSetup.tmp	Key:	HKEY_CURRENT_USER\SOFTWARE\Lenovo\Lenovo Service Bridge
Operation:	write	Name:	InstallationDir
Value: C:\Users\admin\AppData\Local\Programs\Lenovo\Lenovo Service Bridge
(PID) Process:	(4816) LSBSetup.tmp	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2C74547D-EF88-47F4-85F5-BE46A31E26B7}_is1
Operation:	write	Name:	Inno Setup: Setup Version
Value: 5.5.5 (a)
(PID) Process:	(4816) LSBSetup.tmp	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2C74547D-EF88-47F4-85F5-BE46A31E26B7}_is1
Operation:	write	Name:	Inno Setup: App Path
Value: C:\Users\admin\AppData\Local\Programs\Lenovo\Lenovo Service Bridge
(PID) Process:	(4816) LSBSetup.tmp	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2C74547D-EF88-47F4-85F5-BE46A31E26B7}_is1
Operation:	write	Name:	InstallLocation
Value: C:\Users\admin\AppData\Local\Programs\Lenovo\Lenovo Service Bridge\

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
4816	LSBSetup.tmp	C:\Users\admin\AppData\Local\Temp\is-L039M.tmp\_isetup\_setup64.tmp		executable
		MD5:526426126AE5D326D0A24706C77D8C5C	SHA256:B20A8D88C550981137ED831F2015F5F11517AEB649C29642D9D61DEA5EBC37D1
4816	LSBSetup.tmp	C:\Users\admin\AppData\Local\Programs\Lenovo\Lenovo Service Bridge\is-21TDN.tmp		executable
		MD5:F744E2CD462A24E1A362C802AEC53E15	SHA256:E173D7F203A24B4ED5EE394053EB956DCE693A7C69DB7B3776AD373C211687FF
4816	LSBSetup.tmp	C:\Users\admin\AppData\Local\Programs\Lenovo\Lenovo Service Bridge\is-OG7IA.tmp		executable
		MD5:6AA029BBCFAA55D8740E80472EFEA5E9	SHA256:8B39D0CEBEEA241B2F747B44561263EBFA1C8DDA2BBA3B56B7E4AD133A1FFC55
4816	LSBSetup.tmp	C:\Users\admin\AppData\Local\Programs\Lenovo\Lenovo Service Bridge\is-UNL82.tmp		executable
		MD5:F0B3E112CE4807A28E2B5D66A840ED7F	SHA256:333903C7D22A27098E45FC64B77A264AA220605CFBD3E329C200D7E4B42C881C
4816	LSBSetup.tmp	C:\Users\admin\AppData\Local\Programs\Lenovo\Lenovo Service Bridge\CreateWTSTask.exe		executable
		MD5:6E65C4FC34BB4BE9A7A4C015D973B9B7	SHA256:F6515F81704D2D6A17280475BEBE1CB2236912B68B77607BDB5A4A3A41738DDD
4816	LSBSetup.tmp	C:\Users\admin\AppData\Local\Programs\Lenovo\Lenovo Service Bridge\jose-jwt.dll		executable
		MD5:A767950E8712CB7A1EFE5B269BA9B7A0	SHA256:A2C30AC3C6AC430C10497B60F99D390875F807B6C129FC010BBCD83A374A0961
4816	LSBSetup.tmp	C:\Users\admin\AppData\Local\Programs\Lenovo\Lenovo Service Bridge\DownloadManager.dll		executable
		MD5:51D5A3B7DD5A2B676ABE42CC7A890EC2	SHA256:06ACCAB21AB9F79936BFDE3CB0FA2EA1458B1C82A5A5DE8961552287696F9084
4816	LSBSetup.tmp	C:\Users\admin\AppData\Local\Programs\Lenovo\Lenovo Service Bridge\is-3HAD5.tmp		executable
		MD5:A767950E8712CB7A1EFE5B269BA9B7A0	SHA256:A2C30AC3C6AC430C10497B60F99D390875F807B6C129FC010BBCD83A374A0961
4816	LSBSetup.tmp	C:\Users\admin\AppData\Local\Programs\Lenovo\Lenovo Service Bridge\is-653IJ.tmp		executable
		MD5:6E65C4FC34BB4BE9A7A4C015D973B9B7	SHA256:F6515F81704D2D6A17280475BEBE1CB2236912B68B77607BDB5A4A3A41738DDD
4816	LSBSetup.tmp	C:\Users\admin\AppData\Local\Programs\Lenovo\Lenovo Service Bridge\BouncyCastle.Crypto.dll		executable
		MD5:F0B3E112CE4807A28E2B5D66A840ED7F	SHA256:333903C7D22A27098E45FC64B77A264AA220605CFBD3E329C200D7E4B42C881C

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5628	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D	unknown	—	—	whitelisted
5628	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D	unknown	—	—	whitelisted
5628	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
4716	svchost.exe	40.126.31.67:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
4032	svchost.exe	239.255.255.250:1900	—	—	—	whitelisted
5620	MoUsoCoreWorker.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
2760	svchost.exe	40.115.3.253:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
7856	svchost.exe	4.209.33.156:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	US	unknown
6192	slui.exe	40.91.76.224:443	activation-v2.sls.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
4716	svchost.exe	20.190.159.64:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
5212	backgroundTaskHost.exe	20.103.156.88:443	arc.msn.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	unknown
7292	svchost.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	51.124.78.146 51.104.136.2 4.231.128.59	whitelisted
google.com	142.250.185.110	whitelisted
activation-v2.sls.microsoft.com	40.91.76.224	whitelisted
arc.msn.com	20.103.156.88	whitelisted
fd.api.iris.microsoft.com	20.103.156.88	whitelisted
www.bing.com	2.23.209.175 2.23.209.182 2.23.209.168 2.23.209.171 2.23.209.178 2.23.209.186 2.23.209.173 2.23.209.181 2.23.209.183	whitelisted
slscr.update.microsoft.com	20.12.23.50	whitelisted
fe3cr.delivery.mp.microsoft.com	20.166.126.56	whitelisted
a-ring-fallback.msedge.net	131.253.33.254	unknown
t-ring-s.msedge.net	13.107.246.254	unknown

Threats

No threats detected

Add for printing

No debug info

General Info

LSBSetup.exe

96177BA851092FA375FD850DF6AA7219

EB330E1A8A4F94AC014A0507288BCBDBEFF57860

454E5A32B53C8C67982417568E2857FC200968BE1AE710ED968EB1D95B0B94E3

98304:agEj36ZEvZKfXhaMqYqRmw8dWvLKpOeAZE/0UWyQsKsWMl6bgaOuIwO8BKJlvJiE:zTz

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Drops the executable file immediately after the start

SUSPICIOUS

Executable content was dropped or overwritten

Process drops legitimate windows executable

Reads the Windows owner or organization settings

INFO

Create files in a temporary directory

Checks supported languages

Reads the computer name

Creates files or folders in the user directory

Creates a software uninstall entry

Reads the machine GUID from the registry

Reads Environment values

Manual execution by a user

Reads security settings of Internet Explorer

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings