File name:

Chinese Skull Ransomware.zip

Full analysis: https://app.any.run/tasks/ddac447f-b378-42cf-9d82-6457c3441b4f
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: May 10, 2025, 23:08:37
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
ransomware
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

6CF82FA980200ADD754664E498452196

SHA1:

004FD09ABF2EF87FF85CB8CAFA314AC353E67C12

SHA256:

C2E6D239A6525991611F76166C13AAAE962629DCFBFB4933F7FD03715D052A65

SSDEEP:

6144:ey/kUjxKEgBUd8hfxP4BRO26GpgOCXaw4qj7Q8ApW4HF0mI3cONi2P:ewk8xKEgW8sbDpAXJ4qXbApW4HemI3tD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • Chinese Skull Ransomware.exe (PID: 7860)
      • Chinese Skull Ransomware.exe (PID: 8008)

    • RANSOMWARE has been detected

      • AcroRd32.exe (PID: 7916)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Chinese Skull Ransomware.exe (PID: 7860)

    • Reads security settings of Internet Explorer

      • Chinese Skull Ransomware.exe (PID: 7860)

    • Reads the date of Windows installation

      • Chinese Skull Ransomware.exe (PID: 7860)

    • Starts itself from another location

      • Chinese Skull Ransomware.exe (PID: 7860)

    • Creates file in the systems drive root

      • AcroRd32.exe (PID: 7916)

  • INFO

    • Checks supported languages

      • Chinese Skull Ransomware.exe (PID: 7860)
      • AcroRd32.exe (PID: 7916)
      • Chinese Skull Ransomware.exe (PID: 8008)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 660)

    • Creates files or folders in the user directory

      • Chinese Skull Ransomware.exe (PID: 7860)

    • Manual execution by a user

      • Chinese Skull Ransomware.exe (PID: 7860)
      • Chinese Skull Ransomware.exe (PID: 8008)
      • Chinese Skull Ransomware.exe (PID: 7192)

    • Reads the computer name

      • Chinese Skull Ransomware.exe (PID: 7860)
      • AcroRd32.exe (PID: 7916)
      • Chinese Skull Ransomware.exe (PID: 8008)

    • Reads the machine GUID from the registry

      • Chinese Skull Ransomware.exe (PID: 7860)
      • AcroRd32.exe (PID: 7916)
      • Chinese Skull Ransomware.exe (PID: 8008)

    • Process checks computer location settings

      • Chinese Skull Ransomware.exe (PID: 7860)

    • Creates files in the program directory

      • AcroRd32.exe (PID: 7916)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0001
ZipCompression: Deflated
ZipModifyDate: 2024:09:16 22:49:10
ZipCRC: 0x791808e2
ZipCompressedSize: 199950
ZipUncompressedSize: 253952
ZipFileName: Chinese Skull Ransomware.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
9
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe chinese skull ransomware.exe THREAT acrord32.exe no specs chinese skull ransomware.exe slui.exe no specs chinese skull ransomware.exe no specs openwith.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
660"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Chinese Skull Ransomware.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1532C:\WINDOWS\system32\OpenWith.exe -EmbeddingC:\Windows\System32\OpenWith.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
7192"C:\Users\admin\Desktop\Chinese Skull Ransomware.exe" C:\Users\admin\Desktop\Chinese Skull Ransomware.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
37.0.2.5583
Modules
Images
c:\users\admin\desktop\chinese skull ransomware.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
7196C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7236"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7860"C:\Users\admin\Desktop\Chinese Skull Ransomware.exe" C:\Users\admin\Desktop\Chinese Skull Ransomware.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Firefox
Exit code:
0
Version:
37.0.2.5583
Modules
Images
c:\users\admin\desktop\chinese skull ransomware.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
7916"C:\Users\admin\AppData\Local\Adobe (x86)\AcroRd32.exe" C:\Users\admin\Desktop\Chinese?Skull?Ransomware.exeC:\Users\admin\AppData\Local\Adobe (x86)\AcroRd32.exe
Chinese Skull Ransomware.exe
User:
admin
Integrity Level:
HIGH
Description:
Firefox
Version:
37.0.2.5583
Modules
Images
c:\users\admin\appdata\local\adobe (x86)\acrord32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
8008"C:\Users\admin\Desktop\Chinese Skull Ransomware.exe" C:\Users\admin\Desktop\Chinese Skull Ransomware.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
37.0.2.5583
Modules
Images
c:\users\admin\desktop\chinese skull ransomware.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
8136C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
14 589
Read events
14 567
Write events
22
Delete events
0

Modification events

(PID) Process:(660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Chinese Skull Ransomware.zip
(PID) Process:(660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF1B01000072000000DB04000028020000
Executable files
4
Suspicious files
557
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
7916AcroRd32.exeC:\Program Files\Microsoft Office\AppXManifest.xml.locked —
MD5:—
SHA256:—
7916AcroRd32.exeC:\bootTel.dat.lockedbinary
MD5:D29CB831C8622762EAE77A9718DAA868
SHA256:7FA32D84723B76208446283F23E44947B9988A05C830FCE5829FC3245BAE66CB
660WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb660.35207\Chinese Skull Ransomware.exeexecutable
MD5:58284D741ED273587E91D59B75D1BFBE
SHA256:0B36B95EC0CFDC80ACC25027CE1BF8FA632249653C5CF0524EB6B52029CEBB68
7860Chinese Skull Ransomware.exeC:\Users\admin\AppData\Local\Adobe (x86)\AcroRd32.exeexecutable
MD5:58284D741ED273587E91D59B75D1BFBE
SHA256:0B36B95EC0CFDC80ACC25027CE1BF8FA632249653C5CF0524EB6B52029CEBB68
7916AcroRd32.exeC:\Program Files\CUAssistant\CUAssistantTask.xml.lockedbinary
MD5:ACB43E27D5103617655AD882284D73F0
SHA256:5815422E5FECD60B82CA99B30235DE42283E0FEB6405DDACBC0B980459CCBDA1
7916AcroRd32.exeC:\Program Files\CUAssistant\DesktopKeepOnToastImg.gif.lockedbinary
MD5:69E3A27A940C64F03C8ACF0AEB5ABC4B
SHA256:2A77C1DBA2A024AF3608352C31DEBF6452DDA1BCF4ECDAAD85FE4B0A16EB57F2
7916AcroRd32.exeC:\$WinREAgent\Backup\ReAgent.xml.lockedbinary
MD5:BA8970E2283A72F287E8543FC6FB4D76
SHA256:0D0A65820793748D4117F448ABDBFD27223BCCF8DB7DB57E0C9E8CC61BA36B5B
7916AcroRd32.exeC:\Program Files\CUAssistant\OkDone_80.png.lockedbinary
MD5:6512A592685E00CFF68A329EC94C0EAA
SHA256:A02BAE9B37CFBCDBCED5A39CFF1B8E19039255E66DED715989F80EA80D281859
7916AcroRd32.exeC:\Program Files\CUAssistant\CUAssistantRebootTask.xml.lockedbinary
MD5:0DFB1658C2D3A5687866508EEBF57533
SHA256:C26B22BBFBE408B40DBD92C0BFFFC7C3F77CA4D184D57A6EC9AD307719463203
7916AcroRd32.exeC:\found.000\dir0001.chk\WmiApRpl.h.lockedbinary
MD5:34B01E991BE74BC497691ED07F8DF2F6
SHA256:FC02AF852784437F70180307821033E31AF361742D7B66CD50C241B724A54A0B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
41
DNS requests
14
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7676
SIHClient.exe
20.109.210.53:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7676
SIHClient.exe
13.85.23.206:443
fe3cr.delivery.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.110
whitelisted
client.wns.windows.com
  • 172.211.123.248
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.160.64
  • 20.190.160.132
  • 20.190.160.131
  • 40.126.32.133
  • 20.190.160.3
  • 20.190.160.22
  • 20.190.160.67
  • 20.190.160.4
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
  • 2603:1030:800:5::bfee:a08d
whitelisted
206.23.85.13.in-addr.arpa
  • —
unknown
d.8.0.a.e.e.f.b.0.0.0.0.0.0.0.0.5.0.0.0.0.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa
  • —
unknown
nexusrules.officeapps.live.com
  • 52.111.227.11
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Chinese Skull Ransomware.zip