File name:

5-27-2025_1-09_35323.jpg

Full analysis: https://app.any.run/tasks/a4082e43-d0d5-4bfa-823a-513736ab92f4
Verdict: Malicious activity
Threats:

LockBit, a ransomware variant, encrypts data on infected machines, demanding a ransom payment for decryption. Used in targeted attacks, It's a significant risk to organizations.

Malware Trends Tracker     >>>
Analysis date: May 30, 2025, 14:18:30
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
ransomware
lockbit
arch-exec
Indicators:
MIME: image/jpeg
File info: JPEG image data, JFIF standard 1.01, resolution (DPI), density 120x120, segment length 16, baseline, precision 8, 640x480, components 3
MD5:

DEAC84D1DAF5059C4EF706A2D62394F9

SHA1:

592F48D51EF8958978074B8427563816B24756C1

SHA256:

643AC3B398032BD4CCA48619648CD188F0D52AD837946A78AA26D41DFBBF0882

SSDEEP:

1536:kfHLx5fXJoMMGjUOwInvxZ2RAqdLzzJj4tgjXA3xU7r9:arziFGjeInJZ2RA8LZj4QaxM9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • [YARA] LockBit is detected

      • builder.exe (PID: 1568)
      • LB3.exe (PID: 7564)

    • Known privilege escalation attack

      • dllhost.exe (PID: 8088)

    • Renames files like ransomware

      • LB3.exe (PID: 7564)

    • LOCKBIT3 has been detected

      • 5C3F.tmp (PID: 2404)

    • RANSOMWARE has been detected

      • LB3.exe (PID: 7564)

  • SUSPICIOUS

    • There is functionality for taking screenshot (YARA)

      • builder.exe (PID: 1568)
      • LB3.exe (PID: 7564)

    • Executable content was dropped or overwritten

      • builder.exe (PID: 7608)
      • builder.exe (PID: 7928)
      • builder.exe (PID: 7408)
      • builder.exe (PID: 7584)
      • builder.exe (PID: 720)
      • builder.exe (PID: 7804)
      • LB3.exe (PID: 7564)

    • The process creates files with name similar to system file names

      • builder.exe (PID: 7804)

    • Executes application which crashes

      • LB3_pass.exe (PID: 1116)

    • Write to the desktop.ini file (may be used to cloak folders)

      • LB3.exe (PID: 7564)

    • Reads security settings of Internet Explorer

      • ShellExperienceHost.exe (PID: 7652)

    • Starts application with an unusual extension

      • LB3.exe (PID: 7564)

    • Starts CMD.EXE for commands execution

      • 5C3F.tmp (PID: 2404)

    • Hides command output

      • cmd.exe (PID: 7676)

  • INFO

    • Checks supported languages

      • builder.exe (PID: 1568)
      • builder.exe (PID: 7584)
      • builder.exe (PID: 7928)
      • builder.exe (PID: 5232)
      • builder.exe (PID: 7608)
      • builder.exe (PID: 2064)
      • builder.exe (PID: 7804)
      • builder.exe (PID: 7408)
      • keygen.exe (PID: 8096)
      • keygen.exe (PID: 2320)
      • LB3_pass.exe (PID: 1116)
      • builder.exe (PID: 720)
      • LB3.exe (PID: 7564)
      • ShellExperienceHost.exe (PID: 7652)
      • LB3.exe (PID: 8116)

    • Reads the computer name

      • builder.exe (PID: 5232)
      • builder.exe (PID: 2064)
      • builder.exe (PID: 1568)
      • LB3.exe (PID: 7564)
      • ShellExperienceHost.exe (PID: 7652)
      • LB3.exe (PID: 8116)

    • Manual execution by a user

      • WinRAR.exe (PID: 7264)
      • cmd.exe (PID: 7456)
      • cmd.exe (PID: 7268)
      • LB3_pass.exe (PID: 1116)
      • LB3.exe (PID: 8116)
      • notepad.exe (PID: 8000)
      • LB3Decryptor.exe (PID: 7908)
      • LB3Decryptor.exe (PID: 472)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7264)

    • Creates files in the program directory

      • LB3.exe (PID: 7564)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 7732)
      • LB3.exe (PID: 7564)

    • Reads the software policy settings

      • slui.exe (PID: 3884)

    • Reads the machine GUID from the registry

      • LB3.exe (PID: 8116)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 8088)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.jpg | JFIF JPEG bitmap (50)
.jpg | JPEG bitmap (37.4)
.mp3 | MP3 audio (12.4)

EXIF

JFIF

JFIFVersion: 1.01
ResolutionUnit: inches
XResolution: 120
YResolution: 120

Composite

ImageSize: 640x480
Megapixels: 0.307
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
174
Monitored processes
37
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start rundll32.exe no specs sppextcomobj.exe no specs slui.exe winrar.exe rundll32.exe no specs cmd.exe no specs conhost.exe no specs keygen.exe no specs builder.exe no specs builder.exe no specs #LOCKBIT builder.exe no specs slui.exe no specs cmd.exe no specs conhost.exe no specs keygen.exe no specs builder.exe builder.exe builder.exe builder.exe builder.exe builder.exe lb3_pass.exe werfault.exe no specs lb3.exe no specs CMSTPLUA THREAT lb3.exe shellexperiencehost.exe no specs notepad.exe no specs searchapp.exe splwow64.exe no specs lb3decryptor.exe no specs lb3decryptor.exe printfilterpipelinesvc.exe no specs onenote.exe #LOCKBIT 5c3f.tmp no specs cmd.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
472"C:\Users\admin\Desktop\LockBit-main\Build\LB3Decryptor.exe" C:\Users\admin\Desktop\LockBit-main\Build\LB3Decryptor.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\lockbit-main\build\lb3decryptor.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
720builder -type enc -ref -pubkey Build\pub.key -config config.json -ofile Build\LB3_ReflectiveDll_DllMain.dllC:\Users\admin\Desktop\LockBit-main\builder.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\lockbit-main\builder.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
1116"C:\Users\admin\Desktop\LockBit-main\Build\LB3_pass.exe" C:\Users\admin\Desktop\LockBit-main\Build\LB3_pass.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\desktop\lockbit-main\build\lb3_pass.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\gdi32.dll
1568builder -type enc -exe -pass -pubkey Build\pub.key -config config.json -ofile Build\LB3_pass.exeC:\Users\admin\Desktop\LockBit-main\builder.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\lockbit-main\builder.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
1748C:\WINDOWS\splwow64.exe 12288C:\Windows\splwow64.exe—LB3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Print driver host for applications
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\splwow64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2064builder -type enc -exe -pubkey Build\pub.key -config config.json -ofile Build\LB3.exeC:\Users\admin\Desktop\LockBit-main\builder.exe—cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\lockbit-main\builder.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
2320keygen -path Build -pubkey pub.key -privkey priv.keyC:\Users\admin\Desktop\LockBit-main\keygen.exe—cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\lockbit-main\keygen.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2404"C:\ProgramData\5C3F.tmp"C:\ProgramData\5C3F.tmp
LB3.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\programdata\5c3f.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\gdi32.dll
2596"C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\admin\AppData\Local\Temp\5-27-2025_1-09_35323.jpgC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
3676C:\WINDOWS\system32\printfilterpipelinesvc.exe -EmbeddingC:\Windows\System32\printfilterpipelinesvc.exe—svchost.exe
User:
LOCAL SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Print Filter Pipeline Host
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\printfilterpipelinesvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
15 791
Read events
13 233
Write events
2 548
Delete events
10

Modification events

(PID) Process:(2596) rundll32.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Photo Viewer\Viewer
Operation:writeName:MainWndPos
Value:
6000000033000000A00400007502000000000000
(PID) Process:(7264) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7264) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7264) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7264) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(8088) dllhost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(7652) ShellExperienceHost.exeKey:\REGISTRY\A\{eb5b25cb-d683-8921-36ff-f17d1be23cfd}\LocalState
Operation:writeName:PeekBadges
Value:
5B005D0000001EF211F96DD1DB01
(PID) Process:(5112) SearchApp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\SearchSettings
Operation:writeName:SafeSearchMode
Value:
1
(PID) Process:(5112) SearchApp.exeKey:\REGISTRY\A\{23e390d0-6b9c-a392-7bb5-da9029bd0dbe}\LocalState
Operation:writeName:BINGIDENTITY_PROP_USEREMAIL
Value:
0000B9253D2F6ED1DB01
(PID) Process:(5112) SearchApp.exeKey:\REGISTRY\A\{23e390d0-6b9c-a392-7bb5-da9029bd0dbe}\LocalState
Operation:writeName:BINGIDENTITY_PROP_ACCOUNTTYPETEXT
Value:
0000B9253D2F6ED1DB01
Executable files
10
Suspicious files
2 502
Text files
2 384
Unknown types
236

Dropped files

PID
Process
Filename
Type
7928builder.exeC:\Users\admin\Desktop\LockBit-main\Build\LB3Decryptor.exeexecutable
MD5:E3265AD092FF6C6ADBDCC7404FC2F0D7
SHA256:6AB34E9DAE405BC6753E2000F4110F53D24F0BDE9A9E45FDD5F8BD347B098126
7264WinRAR.exeC:\Users\admin\Desktop\LockBit-main\README.mdtext
MD5:DC8D96087E0094C3CC793B3445BEF8DE
SHA256:64312260BF9F040C92ECE170D05250526F138F059760B8A5B9023D6D38E71DB1
8096keygen.exeC:\Users\admin\Desktop\LockBit-main\Build\pub.keytext
MD5:48F5D9990CD0AE233AA11FF1E3E1CFA1
SHA256:9772278FBEDF2E7A5EEE5B9781F72BF980CFDA9CF88F13ACD703FC254EF6BB21
7732WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_LB3_pass.exe_2b4a443d98d2ecb187ae8a96695a6579a8b0907a_d9cc3852_e0b74572-d523-4f59-9fed-faf06a7f9295\Report.wer —
MD5:—
SHA256:—
7608builder.exeC:\Users\admin\Desktop\LockBit-main\Build\Password_exe.txttext
MD5:56A52A127EA63AB6B54CB4BBF17F064D
SHA256:5C65F715A7B408FE4EDC960A7AFAA551A3FA06D11523237E791194C763A81EA6
7264WinRAR.exeC:\Users\admin\Desktop\LockBit-main\config.jsonbinary
MD5:DE177FA08E9B2EAA378760AFD53BE6B2
SHA256:D121F4293160E0A39CBB184C032CD45BAF1372DB00CD33AFB0E166AC0A60AC4C
7264WinRAR.exeC:\Users\admin\Desktop\LockBit-main\Build.battext
MD5:B8F24EFD1D30AAC9D360DB90C8717AEE
SHA256:95DF1D82137315708931F1FC3411E891CD42D1CAB413D4380B479788729248ED
8096keygen.exeC:\Users\admin\Desktop\LockBit-main\Build\DECRYPTION_ID.txttext
MD5:CA3833E86675807C9536BC69FB762857
SHA256:AE1450A92728E653CE5B74B59A5BB8AE04108E839FEA3CF1A3788581A7F781A3
7264WinRAR.exeC:\Users\admin\Desktop\LockBit-main\keygen.exeexecutable
MD5:71C3B2F765B04D0B7EA0328F6CE0C4E2
SHA256:EA6D4DEDD8C85E4A6BB60408A0DC1D56DEF1F4AD4F069C730DC5431B1C23DA37
2320keygen.exeC:\Users\admin\Desktop\LockBit-main\Build\pub.keytext
MD5:8EA706641F7341AD7E2D7F39A71B4843
SHA256:179D39F31FE22CF8DC1C0E384A4253C90F727C845DC8C28B1064CA5E3AECEE04
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
29
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
960
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
960
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5112
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7920
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
960
SIHClient.exe
20.109.210.53:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
960
SIHClient.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
960
SIHClient.exe
13.85.23.206:443
fe3cr.delivery.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 2.23.246.101
whitelisted
google.com
  • 142.250.186.142
whitelisted
client.wns.windows.com
  • 172.211.123.249
  • 172.211.123.250
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted
login.live.com
  • 20.190.160.4
  • 20.190.160.130
  • 40.126.32.76
  • 20.190.160.3
  • 40.126.32.68
  • 40.126.32.134
  • 20.190.160.131
  • 40.126.32.136
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 2.17.190.73
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
5-27-2025_1-09_35323.jpg