File name:

Solarabootstrapper.exe

Full analysis: https://app.any.run/tasks/fd8d8152-13a8-4326-bc8d-6fd47b9d3a97
Verdict: Malicious activity
Threats:

Chaos ransomware is a malware family known for its destructive capabilities and diverse variants. It first appeared in 2021 as a ransomware builder and later acted as a wiper. Unlike most ransomware strains that encrypt data to extort payment, early Chaos variants permanently corrupted files, while later versions adopted more conventional encryption techniques.

Malware Trends Tracker     >>>
Analysis date: April 05, 2025, 21:11:47
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
ransomware
chaos
crypto-regex
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

66B926753096B6D4DB684294CB542170

SHA1:

E7A2026EB6D14E4D44031AF8A6DC4C1A6A3FA17B

SHA256:

6120FB34EF61C7379348B5A1FB6BAEA5508A8846E70B27460F2C640675DC570B

SSDEEP:

12288:WH0mgj/WQfb48yX/yPqYZjSwBjx9QkTzNMoS7LUKUlVlgvAIsfO8Z9IHzNeC5UaK:xdVEH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Deletes shadow copies

      • cmd.exe (PID: 2240)
      • cmd.exe (PID: 4408)

    • Disables task manager

      • svchost.exe (PID: 1056)

    • Actions looks like stealing of personal data

      • svchost.exe (PID: 1056)

    • Changes the autorun value in the registry

      • svchost.exe (PID: 1056)

    • Using BCDEDIT.EXE to modify recovery options

      • cmd.exe (PID: 6324)

    • Create files in the Startup directory

      • svchost.exe (PID: 1056)

    • Steals credentials from Web Browsers

      • svchost.exe (PID: 1056)

    • Modifies files in the Chrome extension folder

      • svchost.exe (PID: 1056)

    • RANSOMWARE has been detected

      • svchost.exe (PID: 1056)

    • CHAOS has been detected (YARA)

      • svchost.exe (PID: 1056)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Solarabootstrapper.exe (PID: 672)

    • Reads security settings of Internet Explorer

      • Solarabootstrapper.exe (PID: 672)
      • svchost.exe (PID: 1056)

    • Reads the date of Windows installation

      • Solarabootstrapper.exe (PID: 672)
      • svchost.exe (PID: 1056)

    • The process creates files with name similar to system file names

      • Solarabootstrapper.exe (PID: 672)

    • Starts itself from another location

      • Solarabootstrapper.exe (PID: 672)

    • Executes as Windows Service

      • wbengine.exe (PID: 2040)
      • vds.exe (PID: 4724)
      • VSSVC.exe (PID: 3100)

    • Starts CMD.EXE for commands execution

      • svchost.exe (PID: 1056)

    • Found regular expressions for crypto-addresses (YARA)

      • svchost.exe (PID: 1056)

    • Start notepad (likely ransomware note)

      • svchost.exe (PID: 1056)

  • INFO

    • Reads the computer name

      • Solarabootstrapper.exe (PID: 672)
      • svchost.exe (PID: 1056)

    • Creates files or folders in the user directory

      • Solarabootstrapper.exe (PID: 672)
      • svchost.exe (PID: 1056)

    • Checks supported languages

      • Solarabootstrapper.exe (PID: 672)
      • svchost.exe (PID: 1056)

    • Reads the machine GUID from the registry

      • Solarabootstrapper.exe (PID: 672)
      • svchost.exe (PID: 1056)

    • Process checks computer location settings

      • Solarabootstrapper.exe (PID: 672)
      • svchost.exe (PID: 1056)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 3888)
      • notepad.exe (PID: 5964)
      • notepad.exe (PID: 1676)

    • Create files in a temporary directory

      • svchost.exe (PID: 1056)

    • Manual execution by a user

      • rundll32.exe (PID: 6112)
      • notepad.exe (PID: 5964)
      • rundll32.exe (PID: 6184)
      • rundll32.exe (PID: 3900)
      • OpenWith.exe (PID: 332)
      • rundll32.exe (PID: 2148)
      • rundll32.exe (PID: 5640)
      • rundll32.exe (PID: 1628)
      • rundll32.exe (PID: 5064)
      • OpenWith.exe (PID: 4336)
      • OpenWith.exe (PID: 2644)
      • OpenWith.exe (PID: 4408)
      • OpenWith.exe (PID: 6424)
      • OpenWith.exe (PID: 336)
      • OpenWith.exe (PID: 496)

    • Reads Microsoft Office registry keys

      • OpenWith.exe (PID: 332)
      • OpenWith.exe (PID: 4408)
      • svchost.exe (PID: 1056)
      • OpenWith.exe (PID: 4336)
      • OpenWith.exe (PID: 336)
      • OpenWith.exe (PID: 2644)
      • OpenWith.exe (PID: 6424)
      • OpenWith.exe (PID: 496)

    • Creates files in the program directory

      • svchost.exe (PID: 1056)

    • Checks proxy server information

      • slui.exe (PID: 5744)

    • Reads the software policy settings

      • slui.exe (PID: 5744)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.9)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:04:05 21:06:07+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 465920
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x73a7e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 0.0.0.0
InternalName: Solarabootstrapper.exe
LegalCopyright:
OriginalFileName: Solarabootstrapper.exe
ProductVersion: 0.0.0.0
AssemblyVersion: 0.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
157
Monitored processes
34
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start solarabootstrapper.exe #CHAOS svchost.exe cmd.exe no specs conhost.exe no specs vssadmin.exe no specs vssvc.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs bcdedit.exe no specs bcdedit.exe no specs cmd.exe no specs conhost.exe no specs wbadmin.exe no specs wbengine.exe no specs vdsldr.exe no specs vds.exe no specs rundll32.exe no specs rundll32.exe no specs notepad.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs notepad.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
332"C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Downloads\wauthors.png.whp2C:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
2147943623
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
336"C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Downloads\runningcommand.jpg.cx0rC:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
2147943623
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
496"C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Downloads\libraryscore.jpg.9aj2C:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
2147943623
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
672"C:\Users\admin\Desktop\Solarabootstrapper.exe" C:\Users\admin\Desktop\Solarabootstrapper.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
1
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\solarabootstrapper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
680bcdedit /set {default} bootstatuspolicy ignoreallfailures C:\Windows\System32\bcdedit.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Boot Configuration Data Editor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\bcdedit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cryptsp.dll
1056"C:\Users\admin\AppData\Roaming\svchost.exe" C:\Users\admin\AppData\Roaming\svchost.exe
Solarabootstrapper.exe
User:
admin
Integrity Level:
HIGH
Description:
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1196\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1388bcdedit /set {default} recoveryenabled noC:\Windows\System32\bcdedit.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Boot Configuration Data Editor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\bcdedit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cryptsp.dll
1512vssadmin delete shadows /all /quiet C:\Windows\System32\vssadmin.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1628"C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\admin\Downloads\libraryscore.jpgC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
Total events
12 686
Read events
12 649
Write events
19
Delete events
18

Modification events

(PID) Process:(1056) svchost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:UpdateTask
Value:
C:\Users\admin\AppData\Roaming\svchost.exe
(PID) Process:(680) bcdedit.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:delete keyName:(default)
Value:
(PID) Process:(680) bcdedit.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:writeName:Element
Value:
0000000000000000000000000000000006000000000000004800000000000000715E5C2FA985EB1190A89A9B763584210000000000000000745E5C2FA985EB1190A89A9B7635842100000000000000000000000000000000
(PID) Process:(680) bcdedit.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\12000002
Operation:delete keyName:(default)
Value:
(PID) Process:(680) bcdedit.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\12000002
Operation:writeName:Element
Value:
\EFI\Microsoft\Boot\bootmgfw.efi
(PID) Process:(680) bcdedit.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{5b970157-8568-11eb-b45c-806e6f6e6963}\Elements\11000001
Operation:delete keyName:(default)
Value:
(PID) Process:(680) bcdedit.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{5b970157-8568-11eb-b45c-806e6f6e6963}\Elements\11000001
Operation:writeName:Element
Value:
0000000000000000000000000000000006000000000000004800000000000000715E5C2FA985EB1190A89A9B763584210000000000000000745E5C2FA985EB1190A89A9B7635842100000000000000000000000000000000
(PID) Process:(680) bcdedit.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{5b970157-8568-11eb-b45c-806e6f6e6963}\Elements\12000002
Operation:delete keyName:(default)
Value:
(PID) Process:(680) bcdedit.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{5b970157-8568-11eb-b45c-806e6f6e6963}\Elements\12000002
Operation:writeName:Element
Value:
\EFI\Boot\Loader.efi
(PID) Process:(680) bcdedit.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{a5a30fa2-3d06-4e9f-b5f4-a01df9d1fcba}\Description
Operation:delete keyName:(default)
Value:
Executable files
1
Suspicious files
571
Text files
871
Unknown types
0

Dropped files

PID
Process
Filename
Type
1056svchost.exeC:\$WinREAgent\Rollback.xml.0m97binary
MD5:2F269EE1C92DB1DE6A6C883D6342EF27
SHA256:7F6E7E2ED37D685B78D6A667E9397B5119B48621AFA04558817EB62C3F157F5A
1056svchost.exeC:\$WinREAgent\Rollback.xmlbinary
MD5:D1457B72C3FB323A2671125AEF3EAB5D
SHA256:8A8DE823D5ED3E12746A62EF169BCF372BE0CA44F0A1236ABC35DF05D96928E1
1056svchost.exeC:\$WinREAgent\Backup\location.txtbinary
MD5:D1457B72C3FB323A2671125AEF3EAB5D
SHA256:8A8DE823D5ED3E12746A62EF169BCF372BE0CA44F0A1236ABC35DF05D96928E1
1056svchost.exeC:\Recovery\ReAgentOld.xml.hdn4binary
MD5:8125AF20346EF37522BB84894E3B8F48
SHA256:6DA6CB3BEE703A7EE755115E458BCB7960F8FB119C102F1A891E138EBF4F2B4B
1056svchost.exeC:\$WinREAgent\Backup\read_it.txttext
MD5:E990FFBDDA50323F5F96879CD8D89247
SHA256:A7C5CBC52F72977320F185655313D2C69C26A89002643562C901DB7027227DF7
1056svchost.exeC:\$WinREAgent\Backup\location.txt.ee59binary
MD5:2233FA7A160E7CC37EBCFB27B36B9B18
SHA256:429DE40FD388C2C92A91D92F107A4642E735DF20D03B0A24A88025745122947B
1056svchost.exeC:\$WinREAgent\RollbackInfo.inibinary
MD5:D1457B72C3FB323A2671125AEF3EAB5D
SHA256:8A8DE823D5ED3E12746A62EF169BCF372BE0CA44F0A1236ABC35DF05D96928E1
1056svchost.exeC:\found.000\dir0001.chk\WmiApRpl.ini.jgckbinary
MD5:9C64125D04C95BBD99AFDB8979DFF7AC
SHA256:2942B50D0C5B1CD201F85AACFA3CC4E7DD0F5B07A858A1DA5AD2C1F8B08ACD50
1056svchost.exeC:\$WinREAgent\read_it.txttext
MD5:E990FFBDDA50323F5F96879CD8D89247
SHA256:A7C5CBC52F72977320F185655313D2C69C26A89002643562C901DB7027227DF7
1056svchost.exeC:\$WinREAgent\Backup\ReAgent.xml.4ek8binary
MD5:8A8FBBED03BF454E79953CEA0016A9C9
SHA256:AB037CEE76CEC527EE65B61F4250BE559BA8F8259ECD497EF7CEFB6A31CE63E6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
20
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
POST
500
20.83.72.98:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
POST
500
20.83.72.98:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2108
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5744
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 142.250.186.174
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Solarabootstrapper.exe