File name:

Lockbit Ransomware.exe

Full analysis: https://app.any.run/tasks/b75156fa-7da5-4835-8af9-6ffe6913eff0
Verdict: Malicious activity
Threats:

LockBit, a ransomware variant, encrypts data on infected machines, demanding a ransom payment for decryption. Used in targeted attacks, It's a significant risk to organizations.

Malware Trends Tracker     >>>
Analysis date: September 02, 2024, 17:58:45
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
stealer
lockbit
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

337559AE1B02B42586781787918B4B6C

SHA1:

114577CE6270FDE6ED9DBC782484BFA36766BAED

SHA256:

C394E1673274A8D0861ED637C425DE244EAD5F8FFBC7CB84862D9B81EC884505

SSDEEP:

1536:BLnrGGho8OfmhXfwdO3uRpLD6fungFJSxcSXKLER7uuO4zT73C57T4S25AqXoiTd:amhXodguLLDzaJ/A7z7zT73Q4zLT4We

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Known privilege escalation attack

      • dllhost.exe (PID: 2516)

    • Actions looks like stealing of personal data

      • Lockbit Ransomware.exe (PID: 3712)

    • Steals credentials from Web Browsers

      • Lockbit Ransomware.exe (PID: 3712)

    • [YARA] LockBit is detected

      • Lockbit Ransomware.exe (PID: 3712)

  • SUSPICIOUS

    • Write to the desktop.ini file (may be used to cloak folders)

      • Lockbit Ransomware.exe (PID: 3712)

    • Reads browser cookies

      • Lockbit Ransomware.exe (PID: 3712)

    • Changes the desktop background image

      • Lockbit Ransomware.exe (PID: 3712)

    • Executable content was dropped or overwritten

      • Lockbit Ransomware.exe (PID: 3712)

    • Starts application with an unusual extension

      • Lockbit Ransomware.exe (PID: 3712)

    • Reads the Internet Settings

      • printfilterpipelinesvc.exe (PID: 2580)

  • INFO

    • Checks supported languages

      • Lockbit Ransomware.exe (PID: 1992)
      • Lockbit Ransomware.exe (PID: 3712)
      • wmpnscfg.exe (PID: 2820)
      • 8F25.tmp (PID: 2348)
      • ONENOTE.EXE (PID: 2092)
      • ONENOTEM.EXE (PID: 1412)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 2516)

    • Creates files in the program directory

      • Lockbit Ransomware.exe (PID: 3712)

    • Reads the computer name

      • Lockbit Ransomware.exe (PID: 1992)
      • Lockbit Ransomware.exe (PID: 3712)
      • wmpnscfg.exe (PID: 2820)
      • ONENOTE.EXE (PID: 2092)

    • Reads the machine GUID from the registry

      • Lockbit Ransomware.exe (PID: 3712)
      • Lockbit Ransomware.exe (PID: 1992)
      • ONENOTE.EXE (PID: 2092)

    • The process uses the downloaded file

      • dllhost.exe (PID: 2516)

    • Checks transactions between databases Windows and Oracle

      • Lockbit Ransomware.exe (PID: 1992)

    • Creates files or folders in the user directory

      • Lockbit Ransomware.exe (PID: 3712)
      • printfilterpipelinesvc.exe (PID: 2580)
      • ONENOTE.EXE (PID: 2092)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 2820)

    • Dropped object may contain TOR URL's

      • Lockbit Ransomware.exe (PID: 3712)

    • Reads Microsoft Office registry keys

      • ONENOTE.EXE (PID: 2092)
      • ONENOTEM.EXE (PID: 1412)

    • Reads Environment values

      • ONENOTE.EXE (PID: 2092)

    • Create files in a temporary directory

      • ONENOTE.EXE (PID: 2092)
      • Lockbit Ransomware.exe (PID: 3712)

    • Process checks computer location settings

      • ONENOTE.EXE (PID: 2092)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (38.3)
.exe | Win32 Executable (generic) (26.2)
.exe | Win16/32 Executable Delphi generic (12)
.exe | Generic Win/DOS Executable (11.6)
.exe | DOS Executable Generic (11.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:09:13 23:30:57+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.12
CodeSize: 99328
InitializedDataSize: 50688
UninitializedDataSize: -
EntryPoint: 0x1946f
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
54
Monitored processes
8
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start lockbit ransomware.exe no specs CMSTPLUA #LOCKBIT lockbit ransomware.exe wmpnscfg.exe no specs printfilterpipelinesvc.exe no specs 8f25.tmp no specs onenote.exe no specs onenotem.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1412/tsrC:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE—ONENOTE.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft OneNote Quick Launcher
Version:
14.0.6015.1000
Modules
Images
c:\program files\microsoft office\office14\onenotem.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
1992"C:\Users\admin\Desktop\Lockbit Ransomware.exe" C:\Users\admin\Desktop\Lockbit Ransomware.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\lockbit ransomware.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
2092/insertdoc "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\{B7B8FF6C-E1B9-45D6-B735-47413EFF7C04}.xps" 133697736130750000C:\Program Files\Microsoft Office\Office14\ONENOTE.EXE—printfilterpipelinesvc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft OneNote
Exit code:
0
Version:
14.0.6022.1000
Modules
Images
c:\program files\microsoft office\office14\onenote.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2348"C:\ProgramData\8F25.tmp"C:\ProgramData\8F25.tmp—Lockbit Ransomware.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\programdata\8f25.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
2516C:\Windows\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}C:\Windows\System32\dllhost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2580C:\Windows\system32\printfilterpipelinesvc.exe -EmbeddingC:\Windows\System32\printfilterpipelinesvc.exe—svchost.exe
User:
LOCAL SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Print Filter Pipeline Host
Version:
6.1.7601.24537 (win7sp1_ldr_escrow.191114-1547)
Modules
Images
c:\windows\system32\printfilterpipelinesvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2820"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3712"C:\Users\admin\Desktop\Lockbit Ransomware.exe" C:\Users\admin\Desktop\Lockbit Ransomware.exe
dllhost.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\lockbit ransomware.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
Total events
6 898
Read events
5 837
Write events
1 054
Delete events
7

Modification events

(PID) Process:(2516) dllhost.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2516) dllhost.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2516) dllhost.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2516) dllhost.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3712) Lockbit Ransomware.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:GlobalAssocChangedCounter
Value:
116
(PID) Process:(3712) Lockbit Ransomware.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Analytic
Operation:writeName:Enabled
Value:
0
(PID) Process:(3712) Lockbit Ransomware.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Analytic
Operation:writeName:ChannelAccess
Value:
O:BAG:SYD:(A;;0x1;;;SY)(A;;0x5;;;BA)(A;;0x1;;;LA)
(PID) Process:(3712) Lockbit Ransomware.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\DirectShowFilterGraph
Operation:writeName:Enabled
Value:
0
(PID) Process:(3712) Lockbit Ransomware.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\DirectShowFilterGraph
Operation:writeName:ChannelAccess
Value:
O:BAG:SYD:(A;;0x1;;;SY)(A;;0x5;;;BA)(A;;0x1;;;LA)
(PID) Process:(3712) Lockbit Ransomware.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\DirectShowPluginControl
Operation:writeName:Enabled
Value:
0
Executable files
9
Suspicious files
1 398
Text files
972
Unknown types
14

Dropped files

PID
Process
Filename
Type
3712Lockbit Ransomware.exeC:\Users\Administrator\Saved Games\txdM9F1WD.README.txttext
MD5:734928ECDC131BC5F8DE15316A4A3C36
SHA256:5778FEA386E2432C9D30E0A22AD06A4021462D6688C3DD2BF19E7A0206049FD5
3712Lockbit Ransomware.exeC:\Users\Administrator\Videos\txdM9F1WD.README.txttext
MD5:734928ECDC131BC5F8DE15316A4A3C36
SHA256:5778FEA386E2432C9D30E0A22AD06A4021462D6688C3DD2BF19E7A0206049FD5
3712Lockbit Ransomware.exeC:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\desktop.inibinary
MD5:AACFFEC9728B72E4914258A7D08BFEAE
SHA256:E981B32B1A79B072BEC9B318C009BBC83B724D73F3493F3F227D900A75CBF19E
3712Lockbit Ransomware.exeC:\Users\Administrator\txdM9F1WD.README.txttext
MD5:734928ECDC131BC5F8DE15316A4A3C36
SHA256:5778FEA386E2432C9D30E0A22AD06A4021462D6688C3DD2BF19E7A0206049FD5
3712Lockbit Ransomware.exeC:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\BBBBBBBBBBBbinary
MD5:AACFFEC9728B72E4914258A7D08BFEAE
SHA256:E981B32B1A79B072BEC9B318C009BBC83B724D73F3493F3F227D900A75CBF19E
3712Lockbit Ransomware.exeC:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\AAAAAAAAAAAbinary
MD5:AACFFEC9728B72E4914258A7D08BFEAE
SHA256:E981B32B1A79B072BEC9B318C009BBC83B724D73F3493F3F227D900A75CBF19E
3712Lockbit Ransomware.exeC:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\EEEEEEEEEEEbinary
MD5:AACFFEC9728B72E4914258A7D08BFEAE
SHA256:E981B32B1A79B072BEC9B318C009BBC83B724D73F3493F3F227D900A75CBF19E
3712Lockbit Ransomware.exeC:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\DDDDDDDDDDDbinary
MD5:AACFFEC9728B72E4914258A7D08BFEAE
SHA256:E981B32B1A79B072BEC9B318C009BBC83B724D73F3493F3F227D900A75CBF19E
3712Lockbit Ransomware.exeC:\Users\Administrator\Searches\txdM9F1WD.README.txttext
MD5:734928ECDC131BC5F8DE15316A4A3C36
SHA256:5778FEA386E2432C9D30E0A22AD06A4021462D6688C3DD2BF19E7A0206049FD5
3712Lockbit Ransomware.exeC:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\HHHHHHHHHHHbinary
MD5:AACFFEC9728B72E4914258A7D08BFEAE
SHA256:E981B32B1A79B072BEC9B318C009BBC83B724D73F3493F3F227D900A75CBF19E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
12
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1372
svchost.exe
GET
304
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?33775f6043c93e33
unknown
—
—
whitelisted
1372
svchost.exe
GET
200
23.48.23.166:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1372
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1060
svchost.exe
GET
304
23.50.131.196:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8f69642324cc87bd
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
—
—
239.255.255.250:3702
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1372
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1060
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
1372
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1372
svchost.exe
199.232.214.172:80
ctldl.windowsupdate.com
FASTLY
US
whitelisted
1372
svchost.exe
23.48.23.166:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1372
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.46
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
ctldl.windowsupdate.com
  • 199.232.214.172
  • 199.232.210.172
  • 23.50.131.196
  • 23.50.131.213
  • 23.50.131.221
whitelisted
crl.microsoft.com
  • 23.48.23.166
  • 23.48.23.164
  • 23.48.23.159
  • 23.48.23.177
  • 23.48.23.145
  • 23.48.23.194
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Lockbit Ransomware.exe