File name:

csrss.zip

Full analysis: https://app.any.run/tasks/29c3c6e3-ec22-4423-91dd-43edf46fcfd7
Verdict: Malicious activity
Threats:

Chaos ransomware is a malware family known for its destructive capabilities and diverse variants. It first appeared in 2021 as a ransomware builder and later acted as a wiper. Unlike most ransomware strains that encrypt data to extort payment, early Chaos variants permanently corrupted files, while later versions adopted more conventional encryption techniques.

Malware Trends Tracker     >>>
Analysis date: May 30, 2025, 12:21:46
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
chaos
ransomware
crypto-regex
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

674D326CF8A83DDA1BF4D2CBFC7D72F7

SHA1:

923CBBE28C2244D358B4E7E9198B3CF40EB05C4E

SHA256:

417408E4CAAD10F675E24C26A082DFAEF113647D0ED277DDF888646C4A2A13B4

SSDEEP:

1536:t9j4Mny2CPW3zwPrwQz/qgeRZA2ZTnjtIs:t9EMyw8wQzqRZ9xF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • CHAOS has been detected (YARA)

      • csrss.exe (PID: 7960)
      • explorer.exe (PID: 8124)

    • Create files in the Startup directory

      • explorer.exe (PID: 8124)

    • Renames files like ransomware

      • explorer.exe (PID: 8124)

    • Using BCDEDIT.EXE to modify recovery options

      • cmd.exe (PID: 7156)

    • RANSOMWARE has been detected

      • explorer.exe (PID: 8124)

    • Deletes shadow copies

      • cmd.exe (PID: 904)
      • cmd.exe (PID: 7404)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • WinRAR.exe (PID: 6040)
      • csrss.exe (PID: 7960)

    • Found regular expressions for crypto-addresses (YARA)

      • csrss.exe (PID: 7960)
      • explorer.exe (PID: 8124)

    • Executable content was dropped or overwritten

      • csrss.exe (PID: 7960)

    • Reads security settings of Internet Explorer

      • csrss.exe (PID: 7960)
      • explorer.exe (PID: 8124)

    • Reads the date of Windows installation

      • csrss.exe (PID: 7960)
      • explorer.exe (PID: 8124)

    • Starts itself from another location

      • csrss.exe (PID: 7960)

    • Write to the desktop.ini file (may be used to cloak folders)

      • explorer.exe (PID: 8124)

    • Starts CMD.EXE for commands execution

      • explorer.exe (PID: 8124)

    • Executes as Windows Service

      • VSSVC.exe (PID: 1188)
      • wbengine.exe (PID: 7500)
      • vds.exe (PID: 5200)

    • Start notepad (likely ransomware note)

      • explorer.exe (PID: 8124)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6040)

    • Manual execution by a user

      • csrss.exe (PID: 7960)

    • Checks supported languages

      • csrss.exe (PID: 7960)
      • explorer.exe (PID: 8124)

    • Reads the computer name

      • csrss.exe (PID: 7960)
      • explorer.exe (PID: 8124)

    • Creates files or folders in the user directory

      • csrss.exe (PID: 7960)
      • explorer.exe (PID: 8124)

    • Reads the software policy settings

      • slui.exe (PID: 7256)
      • slui.exe (PID: 8028)

    • Process checks computer location settings

      • csrss.exe (PID: 7960)
      • explorer.exe (PID: 8124)

    • Launch of the file from Startup directory

      • explorer.exe (PID: 8124)

    • Reads the machine GUID from the registry

      • explorer.exe (PID: 8124)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 4696)
      • notepad.exe (PID: 1096)

    • Reads Microsoft Office registry keys

      • explorer.exe (PID: 8124)
      • OpenWith.exe (PID: 5244)
      • OpenWith.exe (PID: 7672)

    • Checks proxy server information

      • slui.exe (PID: 8028)

    • Create files in a temporary directory

      • explorer.exe (PID: 8124)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2025:05:30 04:48:54
ZipCRC: 0xb265f33e
ZipCompressedSize: 58661
ZipUncompressedSize: 202240
ZipFileName: csrss.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
163
Monitored processes
25
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe #CHAOS csrss.exe slui.exe THREAT explorer.exe cmd.exe no specs conhost.exe no specs vssadmin.exe no specs vssvc.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs bcdedit.exe no specs bcdedit.exe no specs cmd.exe no specs conhost.exe no specs wbadmin.exe no specs wbengine.exe no specs vdsldr.exe no specs vds.exe no specs notepad.exe no specs openwith.exe no specs openwith.exe no specs rundll32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
904"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy deleteC:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1096"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Roaming\bitten-README.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Notepad
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1188C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4172\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4696wmic shadowcopy deleteC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
5172C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
5200C:\WINDOWS\System32\vds.exeC:\Windows\System32\vds.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Virtual Disk Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vds.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
5244C:\WINDOWS\system32\OpenWith.exe -EmbeddingC:\Windows\System32\OpenWith.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
5256\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6040"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\csrss.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
8 468
Read events
8 413
Write events
37
Delete events
18

Modification events

(PID) Process:(6040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\csrss.zip
(PID) Process:(6040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
(PID) Process:(6040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
Executable files
2
Suspicious files
0
Text files
663
Unknown types
1

Dropped files

PID
Process
Filename
Type
6040WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6040.4653\csrss.exeexecutable
MD5:BE8AE0DB4B5FB7727899E4B516FC725D
SHA256:7B1D359FCC4A800CE6D8EEA24BC7C57B4525AE767A79092C8EE083D8C5664508
7960csrss.exeC:\Users\admin\AppData\Roaming\explorer.exeexecutable
MD5:BE8AE0DB4B5FB7727899E4B516FC725D
SHA256:7B1D359FCC4A800CE6D8EEA24BC7C57B4525AE767A79092C8EE083D8C5664508
8124explorer.exeC:\Users\admin\Desktop\csrss.zip.bittentext
MD5:C1DE28A6C0F1717C3CE06A08854C39FF
SHA256:4716AEBAAA8D64CF284FE09EDCAFB31A6DA764E5DA8FDA59C9D30222352F8E04
8124explorer.exeC:\Users\admin\Desktop\csrss.exe.bittentext
MD5:17BFB8700D2FF2AA731999FD75D8A46E
SHA256:88D9041DD1DD6D02DDD63D71933807A6AFAB642E2E7E5D95B2334500E2E78C47
8124explorer.exeC:\Users\admin\Desktop\desktop.initext
MD5:DD6625AFE9E813A3DE925E5889D77183
SHA256:346D385D499275C3BB5BB1D0F7F246010677BD977FF684A7F4A8EE618D38F92C
8124explorer.exeC:\Users\admin\Desktop\desktop.ini.bittentext
MD5:DD6625AFE9E813A3DE925E5889D77183
SHA256:346D385D499275C3BB5BB1D0F7F246010677BD977FF684A7F4A8EE618D38F92C
8124explorer.exeC:\Users\admin\Desktop\filtergreen.rtf.bittentext
MD5:19914180EB30A474169FA4293FDA965E
SHA256:EB5D6BB2D450E5DED24ADC15083E035A7738E08FE58E567E89F8EE354EC2A17C
8124explorer.exeC:\Users\admin\Desktop\figureoral.rtftext
MD5:6BCFA97F2D6A85473C526079544DD2B8
SHA256:29BE88364F2779D02D3EEEA3E5232A93D76042AE49413E244821B06E959B4234
8124explorer.exeC:\Users\admin\Desktop\filtergreen.rtftext
MD5:19914180EB30A474169FA4293FDA965E
SHA256:EB5D6BB2D450E5DED24ADC15083E035A7738E08FE58E567E89F8EE354EC2A17C
8124explorer.exeC:\Users\admin\Desktop\figureoral.rtf.bittentext
MD5:6BCFA97F2D6A85473C526079544DD2B8
SHA256:29BE88364F2779D02D3EEEA3E5232A93D76042AE49413E244821B06E959B4234
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
37
DNS requests
22
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.32.238.107:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7816
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
7816
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
23.32.238.107:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6544
svchost.exe
40.126.32.136:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
google.com
  • 142.250.74.206
whitelisted
crl.microsoft.com
  • 23.32.238.107
  • 23.32.238.112
whitelisted
www.microsoft.com
  • 2.23.181.156
whitelisted
login.live.com
  • 40.126.32.136
  • 20.190.160.128
  • 20.190.160.17
  • 20.190.160.20
  • 20.190.160.67
  • 20.190.160.130
  • 20.190.160.14
  • 20.190.160.5
  • 40.126.31.73
  • 20.190.159.73
  • 40.126.31.128
  • 20.190.159.129
  • 20.190.159.4
  • 20.190.159.71
  • 40.126.31.130
  • 40.126.31.71
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.43
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
csrss.zip