File name:

MDE_File_Sample_0545f020921b3a105bcd53e9848edcd31f3fc2c5.zip.zip

Full analysis: https://app.any.run/tasks/50414cd5-48fc-402c-8513-493bd86a1ecf
Verdict: Malicious activity
Threats:

LockBit, a ransomware variant, encrypts data on infected machines, demanding a ransom payment for decryption. Used in targeted attacks, It's a significant risk to organizations.

Malware Trends Tracker     >>>
Analysis date: May 19, 2025, 09:02:05
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
ransomware
lockbit
lockbit3
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

A847F6D1A17BE69C8256CA4DD710E57A

SHA1:

EAD75001DDF0FAD7AFC37C011F565E7421FF6B8D

SHA256:

730023A7C3F212FBC93FCF3ED8F4CDC19EDE960FA9B4D15380D63E43A4F42761

SSDEEP:

3072:IUe8gWRPv92XowFdhAqUfqDGhKmX4saGguf9uo8i:IUeOPvYXTdhAOyMsaGgufei

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Known privilege escalation attack

      • dllhost.exe (PID: 3900)
      • dllhost.exe (PID: 1272)

    • Renames files like ransomware

      • LB3.exe (PID: 5116)

    • RANSOMWARE has been detected

      • LB3.exe (PID: 5116)

    • [YARA] LockBit is detected

      • LB3.exe (PID: 5116)

    • LOCKBIT3 has been detected

      • 9826.tmp (PID: 3332)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 6184)
      • WinRAR.exe (PID: 1324)
      • ShellExperienceHost.exe (PID: 1096)
      • 9826.tmp (PID: 3332)

    • Generic archive extractor

      • WinRAR.exe (PID: 6184)

    • Application launched itself

      • WinRAR.exe (PID: 6184)

    • Write to the desktop.ini file (may be used to cloak folders)

      • LB3.exe (PID: 5116)

    • Hides command output

      • cmd.exe (PID: 5416)

    • Executable content was dropped or overwritten

      • LB3.exe (PID: 4220)

    • Starts CMD.EXE for commands execution

      • 9826.tmp (PID: 3332)

    • Starts application with an unusual extension

      • LB3.exe (PID: 4220)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1324)

    • Checks supported languages

      • LB3.exe (PID: 1660)
      • LB3.exe (PID: 5116)
      • ShellExperienceHost.exe (PID: 1096)
      • 9826.tmp (PID: 3332)
      • LB3.exe (PID: 4220)
      • LB3.exe (PID: 4164)

    • Reads the computer name

      • LB3.exe (PID: 1660)
      • LB3.exe (PID: 5116)
      • ShellExperienceHost.exe (PID: 1096)
      • LB3.exe (PID: 4164)
      • LB3.exe (PID: 4220)
      • 9826.tmp (PID: 3332)

    • Reads the machine GUID from the registry

      • LB3.exe (PID: 1660)
      • LB3.exe (PID: 4164)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 3900)
      • dllhost.exe (PID: 1272)

    • Creates files in the program directory

      • LB3.exe (PID: 5116)
      • LB3.exe (PID: 4220)

    • Creates files or folders in the user directory

      • LB3.exe (PID: 5116)

    • Process checks computer location settings

      • 9826.tmp (PID: 3332)

    • Create files in a temporary directory

      • LB3.exe (PID: 5116)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2025:05:19 08:35:46
ZipCRC: 0x476b46ca
ZipCompressedSize: 96359
ZipUncompressedSize: 96329
ZipFileName: MDE_File_Sample_0545f020921b3a105bcd53e9848edcd31f3fc2c5.zip
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
144
Monitored processes
14
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs sppextcomobj.exe no specs slui.exe no specs winrar.exe lb3.exe no specs CMSTPLUA THREAT lb3.exe no specs shellexperiencehost.exe no specs lb3.exe no specs CMSTPLUA lb3.exe #LOCKBIT 9826.tmp no specs cmd.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1096"C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mcaC:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shell Experience Host
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\dxgi.dll
1272C:\WINDOWS\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}C:\Windows\SysWOW64\dllhost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ucrtbase.dll
c:\windows\syswow64\combase.dll
1324"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Rar$DIa6184.14795\MDE_File_Sample_0545f020921b3a105bcd53e9848edcd31f3fc2c5.zipC:\Program Files\WinRAR\WinRAR.exe
WinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1660"C:\Users\admin\AppData\Local\Temp\Rar$EXb1324.15031\LB3.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb1324.15031\LB3.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb1324.15031\lb3.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\gdi32.dll
1764\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3332"C:\ProgramData\9826.tmp"C:\ProgramData\9826.tmp
LB3.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\programdata\9826.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\gdi32.dll
3900C:\WINDOWS\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}C:\Windows\SysWOW64\dllhost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ucrtbase.dll
c:\windows\syswow64\combase.dll
4164"C:\Users\admin\AppData\Local\Temp\Rar$EXb1324.18730\LB3.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb1324.18730\LB3.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb1324.18730\lb3.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\gdi32.dll
4220"C:\Users\admin\AppData\Local\Temp\Rar$EXb1324.18730\LB3.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb1324.18730\LB3.exe
dllhost.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb1324.18730\lb3.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\gdi32.dll
4268C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
Total events
6 684
Read events
6 662
Write events
22
Delete events
0

Modification events

(PID) Process:(6184) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6184) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6184) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6184) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\MDE_File_Sample_0545f020921b3a105bcd53e9848edcd31f3fc2c5.zip.zip
(PID) Process:(6184) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6184) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6184) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6184) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1324) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(1324) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
Executable files
10
Suspicious files
626
Text files
575
Unknown types
0

Dropped files

PID
Process
Filename
Type
5116LB3.exeC:\ProgramData\E9GHnVu7o.icoimage
MD5:88D9337C4C9CFE2D9AFF8A2C718EC76B
SHA256:95E059EF72686460884B9AEA5C292C22917F75D56FE737D43BE440F82034F438
5116LB3.exeC:\$Recycle.Bin\S-1-5-18\AAAAAAAAAAAbinary
MD5:56D3B3727B2AEA856E27B709489DCD6C
SHA256:6BD19FDF957E670C7D69011B495380E0A4B4B866CDF1A7B31C04B88AA7048C78
5116LB3.exeC:\$Recycle.Bin\S-1-5-18\desktop.inibinary
MD5:56D3B3727B2AEA856E27B709489DCD6C
SHA256:6BD19FDF957E670C7D69011B495380E0A4B4B866CDF1A7B31C04B88AA7048C78
5116LB3.exeC:\$Recycle.Bin\S-1-5-18\EEEEEEEEEEEbinary
MD5:56D3B3727B2AEA856E27B709489DCD6C
SHA256:6BD19FDF957E670C7D69011B495380E0A4B4B866CDF1A7B31C04B88AA7048C78
5116LB3.exeC:\$Recycle.Bin\S-1-5-18\DDDDDDDDDDDbinary
MD5:56D3B3727B2AEA856E27B709489DCD6C
SHA256:6BD19FDF957E670C7D69011B495380E0A4B4B866CDF1A7B31C04B88AA7048C78
5116LB3.exeC:\$Recycle.Bin\S-1-5-18\FFFFFFFFFFFbinary
MD5:56D3B3727B2AEA856E27B709489DCD6C
SHA256:6BD19FDF957E670C7D69011B495380E0A4B4B866CDF1A7B31C04B88AA7048C78
5116LB3.exeC:\$Recycle.Bin\S-1-5-18\BBBBBBBBBBBbinary
MD5:56D3B3727B2AEA856E27B709489DCD6C
SHA256:6BD19FDF957E670C7D69011B495380E0A4B4B866CDF1A7B31C04B88AA7048C78
5116LB3.exeC:\$Recycle.Bin\S-1-5-18\IIIIIIIIIIIbinary
MD5:56D3B3727B2AEA856E27B709489DCD6C
SHA256:6BD19FDF957E670C7D69011B495380E0A4B4B866CDF1A7B31C04B88AA7048C78
5116LB3.exeC:\$Recycle.Bin\S-1-5-18\GGGGGGGGGGGbinary
MD5:56D3B3727B2AEA856E27B709489DCD6C
SHA256:6BD19FDF957E670C7D69011B495380E0A4B4B866CDF1A7B31C04B88AA7048C78
5116LB3.exeC:\$Recycle.Bin\S-1-5-18\HHHHHHHHHHHbinary
MD5:56D3B3727B2AEA856E27B709489DCD6C
SHA256:6BD19FDF957E670C7D69011B495380E0A4B4B866CDF1A7B31C04B88AA7048C78
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
19
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
3888
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
3888
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 95.101.149.131
whitelisted
google.com
  • 142.250.185.78
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.159.64
  • 20.190.159.68
  • 40.126.31.69
  • 20.190.159.128
  • 20.190.159.75
  • 40.126.31.128
  • 40.126.31.130
  • 40.126.31.2
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
MDE_File_Sample_0545f020921b3a105bcd53e9848edcd31f3fc2c5.zip.zip