File name:

FireFox.zip

Full analysis: https://app.any.run/tasks/a5ef5ea1-fba9-41a6-a382-cfb3e8a85de6
Verdict: Malicious activity
Threats:

Chaos ransomware is a malware family known for its destructive capabilities and diverse variants. It first appeared in 2021 as a ransomware builder and later acted as a wiper. Unlike most ransomware strains that encrypt data to extort payment, early Chaos variants permanently corrupted files, while later versions adopted more conventional encryption techniques.

Malware Trends Tracker     >>>
Analysis date: May 18, 2025, 15:19:53
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
ransomware
chaos
crypto-regex
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

8C89A58BF77BF447EEDD1BB37513F643

SHA1:

DEC914B3F834ED5B83E1DEE0A8178080E18CAC1F

SHA256:

A944BAECC0E74E0E6BD3E6BFA2671EA0F45E2BAFD7F713319D7F85C5181C9C41

SSDEEP:

3072:W1rlHIjMCriyG8G6IWxs2cHUOmoqHV5symkxv:8lHZCrzD/IW40xHTsy5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 6540)

    • RANSOMWARE has been detected

      • Firefox.exe (PID: 632)

    • Create files in the Startup directory

      • Firefox.exe (PID: 632)

    • Renames files like ransomware

      • Firefox.exe (PID: 632)

    • CHAOS has been detected (YARA)

      • Firefox.exe (PID: 632)

    • Deletes shadow copies

      • cmd.exe (PID: 1240)
      • cmd.exe (PID: 6068)

    • Using BCDEDIT.EXE to modify recovery options

      • cmd.exe (PID: 4528)

    • Drops known malicious image

      • Decrypter.exe (PID: 5392)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • FireFox.exe (PID: 4920)
      • Firefox.exe (PID: 632)

    • Executable content was dropped or overwritten

      • FireFox.exe (PID: 4920)

    • Reads security settings of Internet Explorer

      • FireFox.exe (PID: 4920)
      • Firefox.exe (PID: 632)

    • Starts itself from another location

      • FireFox.exe (PID: 4920)

    • Write to the desktop.ini file (may be used to cloak folders)

      • Firefox.exe (PID: 632)

    • Starts CMD.EXE for commands execution

      • Firefox.exe (PID: 632)

    • Executes as Windows Service

      • VSSVC.exe (PID: 3304)
      • wbengine.exe (PID: 3032)
      • vds.exe (PID: 6800)

    • Start notepad (likely ransomware note)

      • Firefox.exe (PID: 632)

    • Found regular expressions for crypto-addresses (YARA)

      • Firefox.exe (PID: 632)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6540)
      • WinRAR.exe (PID: 344)

    • Manual execution by a user

      • FireFox.exe (PID: 4920)
      • WinRAR.exe (PID: 344)
      • Decrypter.exe (PID: 6740)
      • Decrypter.exe (PID: 5392)

    • Creates files or folders in the user directory

      • FireFox.exe (PID: 4920)
      • Firefox.exe (PID: 632)

    • Checks supported languages

      • Firefox.exe (PID: 632)
      • FireFox.exe (PID: 4920)

    • Reads the computer name

      • FireFox.exe (PID: 4920)
      • Firefox.exe (PID: 632)

    • Process checks computer location settings

      • FireFox.exe (PID: 4920)
      • Firefox.exe (PID: 632)

    • Reads the machine GUID from the registry

      • Firefox.exe (PID: 632)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 3096)
      • notepad.exe (PID: 5416)

    • Reads Microsoft Office registry keys

      • Firefox.exe (PID: 632)

    • Reads the software policy settings

      • slui.exe (PID: 6300)
      • slui.exe (PID: 5868)

    • Create files in a temporary directory

      • Firefox.exe (PID: 632)

    • Checks proxy server information

      • slui.exe (PID: 5868)

    • The sample compiled with english language support

      • Decrypter.exe (PID: 5392)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2025:05:18 08:17:30
ZipCRC: 0xd5c3bff1
ZipCompressedSize: 109920
ZipUncompressedSize: 223744
ZipFileName: FireFox.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
160
Monitored processes
27
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe firefox.exe THREAT firefox.exe cmd.exe no specs conhost.exe no specs vssadmin.exe no specs vssvc.exe no specs wmic.exe no specs slui.exe cmd.exe no specs conhost.exe no specs bcdedit.exe no specs bcdedit.exe no specs cmd.exe no specs conhost.exe no specs wbadmin.exe no specs wbengine.exe no specs vdsldr.exe no specs vds.exe no specs notepad.exe no specs winrar.exe rundll32.exe no specs decrypter.exe no specs decrypter.exe conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
344"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\MANICDecryptor-decrypter.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
632"C:\Users\admin\AppData\Roaming\Firefox.exe" C:\Users\admin\AppData\Roaming\Firefox.exe
FireFox.exe
User:
admin
Integrity Level:
HIGH
Description:
Exit code:
4294967295
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
736\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1240"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy deleteC:\Windows\System32\cmd.exe—Firefox.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
2088C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
3032"C:\WINDOWS\system32\wbengine.exe"C:\Windows\System32\wbengine.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Block Level Backup Engine Service EXE
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbengine.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3096wmic shadowcopy deleteC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
3304C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4284C:\WINDOWS\System32\vdsldr.exe -EmbeddingC:\Windows\System32\vdsldr.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Virtual Disk Service Loader
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vdsldr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4528"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled noC:\Windows\System32\cmd.exe—Firefox.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
Total events
10 709
Read events
10 638
Write events
53
Delete events
18

Modification events

(PID) Process:(6540) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6540) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6540) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6540) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\FireFox.zip
(PID) Process:(6540) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6540) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6540) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6540) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6540) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
(PID) Process:(6540) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:size
Value:
80
Executable files
11
Suspicious files
115
Text files
747
Unknown types
3

Dropped files

PID
Process
Filename
Type
632Firefox.exeC:\Users\admin\Desktop\controlways.rtftext
MD5:D318656B028E9DFF8AA1908ED4FF3AD8
SHA256:6C7F99B07E2C117AEA21CE1A204E909DC2875681B98E2220977484FEAB875E8F
632Firefox.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Firefox.urlbinary
MD5:2D21BEDF6672C2527F9FFB80EFF74042
SHA256:CD0535C2FCDA696D312C3BEC63F21EEE116CF0F0EAE339C425490E11469DDBDD
632Firefox.exeC:\Users\admin\Desktop\controlways.rtf.Lockedtext
MD5:D318656B028E9DFF8AA1908ED4FF3AD8
SHA256:6C7F99B07E2C117AEA21CE1A204E909DC2875681B98E2220977484FEAB875E8F
632Firefox.exeC:\Users\admin\Desktop\desktop.ini.Lockedtext
MD5:35AE28BB154AAE001AEC205C3F25C0BC
SHA256:0EB88B28CFED6730889AB2377DDA7F2D8ED322E19AC9F272D064195F09B57900
632Firefox.exeC:\Users\admin\Desktop\desktop.initext
MD5:35AE28BB154AAE001AEC205C3F25C0BC
SHA256:0EB88B28CFED6730889AB2377DDA7F2D8ED322E19AC9F272D064195F09B57900
4920FireFox.exeC:\Users\admin\AppData\Roaming\Firefox.exeexecutable
MD5:EACFF4E6ADA6C7308C15A3AD9FAFBFEE
SHA256:6A135B3B0B26252C67E6233C49943ADACFD5DDCB2DA96282526C1B498BB7D27A
6540WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6540.43488\FireFox.exeexecutable
MD5:EACFF4E6ADA6C7308C15A3AD9FAFBFEE
SHA256:6A135B3B0B26252C67E6233C49943ADACFD5DDCB2DA96282526C1B498BB7D27A
632Firefox.exeC:\Users\admin\Desktop\FireFox.zip.Lockedtext
MD5:8F8F5858A227ED137CBE562825D4E6E3
SHA256:3167B590FA2D99F7F2CB54BBB56FEC9182D97A51F6D9DF0215B010309EBD1DE3
632Firefox.exeC:\Users\admin\Desktop\edgesometimes.jpg.Lockedtext
MD5:5AFF0EC581F38D97309EDD5639487C37
SHA256:EB7A5F0C3CF18A99D19E84FC815D1F249D2DB533BBBAF563E176EC917517A60E
632Firefox.exeC:\Users\admin\Desktop\maryincome.pngtext
MD5:0FE47CABE4AD644B9002B2E3024EC239
SHA256:CE43AE7E7E56703B4C43DDF1C8BAEF19629F5D2E85696EB2C2E7249A0BC879D6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
21
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1324
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1324
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
69.192.161.161:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6544
svchost.exe
40.126.31.67:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1324
SIHClient.exe
4.175.87.197:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 69.192.161.161
  • 95.101.149.131
whitelisted
google.com
  • 142.250.186.46
whitelisted
login.live.com
  • 40.126.31.67
  • 40.126.31.3
  • 20.190.159.64
  • 40.126.31.71
  • 40.126.31.2
  • 20.190.159.4
  • 20.190.159.129
  • 20.190.159.130
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.19
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
FireFox.zip