File name:

Chinese Skull Ransomware.zip

Full analysis: https://app.any.run/tasks/ddac447f-b378-42cf-9d82-6457c3441b4f
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: May 10, 2025, 23:08:37
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
ransomware
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

6CF82FA980200ADD754664E498452196

SHA1:

004FD09ABF2EF87FF85CB8CAFA314AC353E67C12

SHA256:

C2E6D239A6525991611F76166C13AAAE962629DCFBFB4933F7FD03715D052A65

SSDEEP:

6144:ey/kUjxKEgBUd8hfxP4BRO26GpgOCXaw4qj7Q8ApW4HF0mI3cONi2P:ewk8xKEgW8sbDpAXJ4qXbApW4HemI3tD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • Chinese Skull Ransomware.exe (PID: 7860)
      • Chinese Skull Ransomware.exe (PID: 8008)

    • RANSOMWARE has been detected

      • AcroRd32.exe (PID: 7916)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • Chinese Skull Ransomware.exe (PID: 7860)

    • Reads security settings of Internet Explorer

      • Chinese Skull Ransomware.exe (PID: 7860)

    • Executable content was dropped or overwritten

      • Chinese Skull Ransomware.exe (PID: 7860)

    • Starts itself from another location

      • Chinese Skull Ransomware.exe (PID: 7860)

    • Creates file in the systems drive root

      • AcroRd32.exe (PID: 7916)

  • INFO

    • Manual execution by a user

      • Chinese Skull Ransomware.exe (PID: 7860)
      • Chinese Skull Ransomware.exe (PID: 8008)
      • Chinese Skull Ransomware.exe (PID: 7192)

    • Creates files or folders in the user directory

      • Chinese Skull Ransomware.exe (PID: 7860)

    • Reads the computer name

      • Chinese Skull Ransomware.exe (PID: 7860)
      • AcroRd32.exe (PID: 7916)
      • Chinese Skull Ransomware.exe (PID: 8008)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 660)

    • Reads the machine GUID from the registry

      • Chinese Skull Ransomware.exe (PID: 7860)
      • AcroRd32.exe (PID: 7916)
      • Chinese Skull Ransomware.exe (PID: 8008)

    • Process checks computer location settings

      • Chinese Skull Ransomware.exe (PID: 7860)

    • Checks supported languages

      • Chinese Skull Ransomware.exe (PID: 7860)
      • AcroRd32.exe (PID: 7916)
      • Chinese Skull Ransomware.exe (PID: 8008)

    • Creates files in the program directory

      • AcroRd32.exe (PID: 7916)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0001
ZipCompression: Deflated
ZipModifyDate: 2024:09:16 22:49:10
ZipCRC: 0x791808e2
ZipCompressedSize: 199950
ZipUncompressedSize: 253952
ZipFileName: Chinese Skull Ransomware.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
9
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe chinese skull ransomware.exe THREAT acrord32.exe no specs chinese skull ransomware.exe slui.exe no specs chinese skull ransomware.exe no specs openwith.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
660"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Chinese Skull Ransomware.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1532C:\WINDOWS\system32\OpenWith.exe -EmbeddingC:\Windows\System32\OpenWith.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
7192"C:\Users\admin\Desktop\Chinese Skull Ransomware.exe" C:\Users\admin\Desktop\Chinese Skull Ransomware.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
37.0.2.5583
Modules
Images
c:\users\admin\desktop\chinese skull ransomware.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
7196C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7236"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7860"C:\Users\admin\Desktop\Chinese Skull Ransomware.exe" C:\Users\admin\Desktop\Chinese Skull Ransomware.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Firefox
Exit code:
0
Version:
37.0.2.5583
Modules
Images
c:\users\admin\desktop\chinese skull ransomware.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
7916"C:\Users\admin\AppData\Local\Adobe (x86)\AcroRd32.exe" C:\Users\admin\Desktop\Chinese?Skull?Ransomware.exeC:\Users\admin\AppData\Local\Adobe (x86)\AcroRd32.exe
Chinese Skull Ransomware.exe
User:
admin
Integrity Level:
HIGH
Description:
Firefox
Version:
37.0.2.5583
Modules
Images
c:\users\admin\appdata\local\adobe (x86)\acrord32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
8008"C:\Users\admin\Desktop\Chinese Skull Ransomware.exe" C:\Users\admin\Desktop\Chinese Skull Ransomware.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
37.0.2.5583
Modules
Images
c:\users\admin\desktop\chinese skull ransomware.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
8136C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
14 589
Read events
14 567
Write events
22
Delete events
0

Modification events

(PID) Process:(660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Chinese Skull Ransomware.zip
(PID) Process:(660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF1B01000072000000DB04000028020000
Executable files
4
Suspicious files
557
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
7916AcroRd32.exeC:\Program Files\Microsoft Office\AppXManifest.xml.locked —
MD5:—
SHA256:—
660WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb660.35207\Chinese Skull Ransomware.exeexecutable
MD5:58284D741ED273587E91D59B75D1BFBE
SHA256:0B36B95EC0CFDC80ACC25027CE1BF8FA632249653C5CF0524EB6B52029CEBB68
7916AcroRd32.exeC:\$WinREAgent\Rollback.xml.lockedbinary
MD5:ED040B0A8F530E7F47193421E5DD1477
SHA256:C3CEC03E6972FFDA9B4F5C1399B77BE0A4157F007F61061262DC40E19D158E63
7916AcroRd32.exeC:\bootTel.dat.lockedbinary
MD5:D29CB831C8622762EAE77A9718DAA868
SHA256:7FA32D84723B76208446283F23E44947B9988A05C830FCE5829FC3245BAE66CB
7916AcroRd32.exeC:\$WinREAgent\Backup\location.txt.lockedbinary
MD5:542606506EA8F749988EF144857F2043
SHA256:E728AD809FD4E2FC0D1A9402041EA4A050B093417378FC5145F7AF0A585219A7
7860Chinese Skull Ransomware.exeC:\Users\admin\AppData\Roaming\Google (x86)\Chrome32.exeexecutable
MD5:58284D741ED273587E91D59B75D1BFBE
SHA256:0B36B95EC0CFDC80ACC25027CE1BF8FA632249653C5CF0524EB6B52029CEBB68
7916AcroRd32.exeC:\found.000\dir0001.chk\WmiApRpl.h.lockedbinary
MD5:34B01E991BE74BC497691ED07F8DF2F6
SHA256:FC02AF852784437F70180307821033E31AF361742D7B66CD50C241B724A54A0B
7916AcroRd32.exeC:\Program Files\CUAssistant\Snooze_80.png.lockedbinary
MD5:521D3E3911E6CE8079126C13CE42AF99
SHA256:A48D4D4E5779003ADB0BA30CFBF4AA90C9B3C715EC1D57176D5BD21EFFB6203A
7916AcroRd32.exeC:\Program Files\CUAssistant\LaptopPlugInToastImg.gif.lockedbinary
MD5:817F3FC7C43BE49300F576D682DA2561
SHA256:02301E86B91D5A5944719E83130592F44ED5DBD033EEBF46BFAB302CFA116971
7916AcroRd32.exeC:\Program Files\CUAssistant\OkDone_80.png.lockedbinary
MD5:6512A592685E00CFF68A329EC94C0EAA
SHA256:A02BAE9B37CFBCDBCED5A39CFF1B8E19039255E66DED715989F80EA80D281859
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
41
DNS requests
14
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7676
SIHClient.exe
20.109.210.53:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7676
SIHClient.exe
13.85.23.206:443
fe3cr.delivery.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.110
whitelisted
client.wns.windows.com
  • 172.211.123.248
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.160.64
  • 20.190.160.132
  • 20.190.160.131
  • 40.126.32.133
  • 20.190.160.3
  • 20.190.160.22
  • 20.190.160.67
  • 20.190.160.4
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
  • 2603:1030:800:5::bfee:a08d
whitelisted
206.23.85.13.in-addr.arpa
  • —
unknown
d.8.0.a.e.e.f.b.0.0.0.0.0.0.0.0.5.0.0.0.0.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa
  • —
unknown
nexusrules.officeapps.live.com
  • 52.111.227.11
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Chinese Skull Ransomware.zip