File name:

2025-05-27_4fe881fe21a95fa721d0241b0a6288b0_destroyer_elex_wannacry

Full analysis: https://app.any.run/tasks/c0b2697f-ca81-4c5b-801b-c81d4a8d6a15
Verdict: Malicious activity
Threats:

Chaos ransomware is a malware family known for its destructive capabilities and diverse variants. It first appeared in 2021 as a ransomware builder and later acted as a wiper. Unlike most ransomware strains that encrypt data to extort payment, early Chaos variants permanently corrupted files, while later versions adopted more conventional encryption techniques.

Malware Trends Tracker     >>>
Analysis date: May 27, 2025, 00:56:28
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
ransomware
auto-startup
crypto-regex
chaos
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

4FE881FE21A95FA721D0241B0A6288B0

SHA1:

549E66B2EE02B11654AA4A974BB01A0B4914B1A0

SHA256:

03E95120DD13B7654D1FB701C2E5A773F2EDF9CC8416472B4DD6149DB3900ED7

SSDEEP:

1536:ydpI0r9Fj7GAEm/OV+IARmoonpDChaXGKv/Tit0L:ydK0r9FnYmCnhl7r2t0L

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • svchost.exe (PID: 4208)

    • Renames files like ransomware

      • svchost.exe (PID: 4208)

    • CHAOS has been detected (YARA)

      • svchost.exe (PID: 4208)

    • Deletes shadow copies

      • cmd.exe (PID: 5540)
      • cmd.exe (PID: 1268)

    • Using BCDEDIT.EXE to modify recovery options

      • cmd.exe (PID: 6416)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • 2025-05-27_4fe881fe21a95fa721d0241b0a6288b0_destroyer_elex_wannacry.exe (PID: 2244)
      • svchost.exe (PID: 4208)

    • Starts itself from another location

      • 2025-05-27_4fe881fe21a95fa721d0241b0a6288b0_destroyer_elex_wannacry.exe (PID: 2244)

    • The process creates files with name similar to system file names

      • 2025-05-27_4fe881fe21a95fa721d0241b0a6288b0_destroyer_elex_wannacry.exe (PID: 2244)

    • Reads security settings of Internet Explorer

      • 2025-05-27_4fe881fe21a95fa721d0241b0a6288b0_destroyer_elex_wannacry.exe (PID: 2244)
      • svchost.exe (PID: 4208)

    • Executable content was dropped or overwritten

      • 2025-05-27_4fe881fe21a95fa721d0241b0a6288b0_destroyer_elex_wannacry.exe (PID: 2244)

    • Write to the desktop.ini file (may be used to cloak folders)

      • svchost.exe (PID: 4208)

    • Found regular expressions for crypto-addresses (YARA)

      • svchost.exe (PID: 4208)

    • Executes as Windows Service

      • VSSVC.exe (PID: 4068)
      • vds.exe (PID: 340)
      • wbengine.exe (PID: 1164)

    • Starts CMD.EXE for commands execution

      • svchost.exe (PID: 4208)

    • Start notepad (likely ransomware note)

      • svchost.exe (PID: 4208)

  • INFO

    • Checks supported languages

      • 2025-05-27_4fe881fe21a95fa721d0241b0a6288b0_destroyer_elex_wannacry.exe (PID: 2244)
      • svchost.exe (PID: 4208)

    • Reads the computer name

      • 2025-05-27_4fe881fe21a95fa721d0241b0a6288b0_destroyer_elex_wannacry.exe (PID: 2244)
      • svchost.exe (PID: 4208)

    • Creates files or folders in the user directory

      • 2025-05-27_4fe881fe21a95fa721d0241b0a6288b0_destroyer_elex_wannacry.exe (PID: 2244)
      • svchost.exe (PID: 4208)

    • Process checks computer location settings

      • 2025-05-27_4fe881fe21a95fa721d0241b0a6288b0_destroyer_elex_wannacry.exe (PID: 2244)
      • svchost.exe (PID: 4208)

    • Auto-launch of the file from Startup directory

      • svchost.exe (PID: 4208)

    • Reads the machine GUID from the registry

      • svchost.exe (PID: 4208)

    • Manual execution by a user

      • rundll32.exe (PID: 5544)
      • rundll32.exe (PID: 1012)
      • notepad.exe (PID: 2140)
      • rundll32.exe (PID: 772)
      • notepad.exe (PID: 660)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 660)
      • WMIC.exe (PID: 4192)
      • notepad.exe (PID: 4620)

    • Reads Microsoft Office registry keys

      • svchost.exe (PID: 4208)

    • Create files in a temporary directory

      • svchost.exe (PID: 4208)

    • Checks proxy server information

      • slui.exe (PID: 2148)

    • Reads the software policy settings

      • slui.exe (PID: 2148)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.9)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:04:26 06:22:54+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 58880
InitializedDataSize: 6656
UninitializedDataSize: -
EntryPoint: 0x105de
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 0.0.0.0
InternalName: Windows Defender Updater.exe
LegalCopyright:
OriginalFileName: Windows Defender Updater.exe
ProductVersion: 0.0.0.0
AssemblyVersion: 0.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
151
Monitored processes
25
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 2025-05-27_4fe881fe21a95fa721d0241b0a6288b0_destroyer_elex_wannacry.exe #CHAOS svchost.exe rundll32.exe no specs notepad.exe no specs notepad.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs cmd.exe no specs conhost.exe no specs vssadmin.exe no specs vssvc.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs bcdedit.exe no specs bcdedit.exe no specs cmd.exe no specs conhost.exe no specs wbadmin.exe no specs wbengine.exe no specs vdsldr.exe no specs vds.exe no specs notepad.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
340C:\WINDOWS\System32\vds.exeC:\Windows\System32\vds.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Virtual Disk Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vds.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
660"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Downloads\read_it.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
772"C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\admin\Downloads\spaceplace.pngC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
1012"C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\admin\Downloads\soundchapter.pngC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
1164"C:\WINDOWS\system32\wbengine.exe"C:\Windows\System32\wbengine.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Block Level Backup Engine Service EXE
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbengine.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1268"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quietC:\Windows\System32\cmd.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1560bcdedit /set {default} bootstatuspolicy ignoreallfailures C:\Windows\System32\bcdedit.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Boot Configuration Data Editor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\bcdedit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cryptsp.dll
1680\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1760\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2140"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Downloads\desktop.iniC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
Total events
8 707
Read events
8 672
Write events
17
Delete events
18

Modification events

(PID) Process:(6060) bcdedit.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:delete keyName:(default)
Value:
(PID) Process:(6060) bcdedit.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:writeName:Element
Value:
0000000000000000000000000000000006000000000000004800000000000000715E5C2FA985EB1190A89A9B763584210000000000000000745E5C2FA985EB1190A89A9B7635842100000000000000000000000000000000
(PID) Process:(6060) bcdedit.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\12000002
Operation:delete keyName:(default)
Value:
(PID) Process:(6060) bcdedit.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\12000002
Operation:writeName:Element
Value:
\EFI\Microsoft\Boot\bootmgfw.efi
(PID) Process:(6060) bcdedit.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{5b970157-8568-11eb-b45c-806e6f6e6963}\Elements\11000001
Operation:delete keyName:(default)
Value:
(PID) Process:(6060) bcdedit.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{5b970157-8568-11eb-b45c-806e6f6e6963}\Elements\11000001
Operation:writeName:Element
Value:
0000000000000000000000000000000006000000000000004800000000000000715E5C2FA985EB1190A89A9B763584210000000000000000745E5C2FA985EB1190A89A9B7635842100000000000000000000000000000000
(PID) Process:(6060) bcdedit.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{5b970157-8568-11eb-b45c-806e6f6e6963}\Elements\12000002
Operation:delete keyName:(default)
Value:
(PID) Process:(6060) bcdedit.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{5b970157-8568-11eb-b45c-806e6f6e6963}\Elements\12000002
Operation:writeName:Element
Value:
\EFI\Boot\Loader.efi
(PID) Process:(6060) bcdedit.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{a5a30fa2-3d06-4e9f-b5f4-a01df9d1fcba}\Description
Operation:delete keyName:(default)
Value:
(PID) Process:(6060) bcdedit.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{a5a30fa2-3d06-4e9f-b5f4-a01df9d1fcba}\Elements\24000001
Operation:delete keyName:(default)
Value:
Executable files
1
Suspicious files
1
Text files
613
Unknown types
0

Dropped files

PID
Process
Filename
Type
4208svchost.exeC:\Users\admin\Desktop\excellentpoints.rtf.pnrbtext
MD5:D089DC852BD358A18334E7A619BE6D0E
SHA256:15313BA51F1B6D1A3E9BFF0C4D35806C61091E853E8D062548C7AA8F499FC075
4208svchost.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.urlbinary
MD5:83660DEB1A47E0B191FDA82BDFD61827
SHA256:87089BD6FEDDA43B5E4D738B5BF246BA1B2E5C248B9220F0D1E742B827F30B0D
4208svchost.exeC:\Users\admin\Desktop\governmentsomeone.jpg.vtmrtext
MD5:B97808F9B7517DDFADA13CDC4A928390
SHA256:F73BCDC9FD1D528929E27F7E470A4BC83F0EA5954BCA0F115A110FD25AFC0975
4208svchost.exeC:\Users\admin\Desktop\keephalf.rtftext
MD5:E5339506E53EBC95A6B37EF935B21B45
SHA256:9ED70BFC4CD182376A57BA2C78E02269ABA3B0A52330615C3DAF0F7482B5CF91
4208svchost.exeC:\Users\admin\Desktop\read_it.txttext
MD5:CC57C2D16146BAD142F011C15D982B97
SHA256:1820563E222EA162B34C2FF4142BABF38E1D6F2F905081CC4C2877C26B6C7756
4208svchost.exeC:\Users\admin\Desktop\catpicture.png.xwc6text
MD5:4F5B94014236A02EC19A9DBAC6D8582E
SHA256:6520B8B1AB5DBEBBCF74A242F0227E685606715A9E886F0F3DD21FA817B6EACB
4208svchost.exeC:\Users\admin\Desktop\augusteducation.rtftext
MD5:9ED1589C266B8922C81D9F555E5B2969
SHA256:35475B71ECBC03DC28D53EA0C37316DFB9332A0D02BB38953DCCA321B8987C66
4208svchost.exeC:\Users\admin\Desktop\augusteducation.rtf.pq12text
MD5:9ED1589C266B8922C81D9F555E5B2969
SHA256:35475B71ECBC03DC28D53EA0C37316DFB9332A0D02BB38953DCCA321B8987C66
4208svchost.exeC:\Users\admin\Desktop\governmentsomeone.jpgtext
MD5:B97808F9B7517DDFADA13CDC4A928390
SHA256:F73BCDC9FD1D528929E27F7E470A4BC83F0EA5954BCA0F115A110FD25AFC0975
4208svchost.exeC:\Users\admin\Desktop\excellentpoints.rtftext
MD5:D089DC852BD358A18334E7A619BE6D0E
SHA256:15313BA51F1B6D1A3E9BFF0C4D35806C61091E853E8D062548C7AA8F499FC075
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
20
DNS requests
5
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
5304
RUXIMICS.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5304
RUXIMICS.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5304
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5304
RUXIMICS.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5304
RUXIMICS.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6036
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2148
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 216.58.206.78
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-05-27_4fe881fe21a95fa721d0241b0a6288b0_destroyer_elex_wannacry