| File name: | Echo-Scanner.exe |
| Full analysis: | https://app.any.run/tasks/eac26024-e98d-4692-be59-09a257bdaa31 |
| Verdict: | Malicious activity |
| Threats: | Chaos ransomware is a malware family known for its destructive capabilities and diverse variants. It first appeared in 2021 as a ransomware builder and later acted as a wiper. Unlike most ransomware strains that encrypt data to extort payment, early Chaos variants permanently corrupted files, while later versions adopted more conventional encryption techniques. |
| Analysis date: | April 13, 2025, 01:44:42 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MD5: | 818B2D4040E1CD5147936107AE00E2DE |
| SHA1: | 0C0CECF79650B70548D521351821E3479C6CAB77 |
| SHA256: | E888BD6A36D2B00EA8F2223E1FE8370CF3F0277F13B83FF57923834FC5608A66 |
| SSDEEP: | 12288:U5g97bqHS+cFjdCr7fY7ryQOyXbeB9DN1XPGAovqkdaRSTyZZdoYSJU/vHUemrHl:dj7+nyCTeavH2 |
MALICIOUS
CHAOS has been detected (YARA)
- Echo-Scanner.exe (PID: 7444)
- svchost.exe (PID: 7768)
Changes the autorun value in the registry
- svchost.exe (PID: 7768)
Using BCDEDIT.EXE to modify recovery options
- cmd.exe (PID: 4448)
Deletes shadow copies
- cmd.exe (PID: 7868)
- cmd.exe (PID: 5408)
Disables task manager
- svchost.exe (PID: 7768)
Steals credentials from Web Browsers
- svchost.exe (PID: 7768)
RANSOMWARE has been detected
- svchost.exe (PID: 7768)
Actions looks like stealing of personal data
- svchost.exe (PID: 7768)
Create files in the Startup directory
- svchost.exe (PID: 7768)
Modifies files in the Chrome extension folder
- svchost.exe (PID: 7768)
SUSPICIOUS
Reads the date of Windows installation
- Echo-Scanner.exe (PID: 7444)
- svchost.exe (PID: 7768)
Executable content was dropped or overwritten
- Echo-Scanner.exe (PID: 7444)
Reads security settings of Internet Explorer
- svchost.exe (PID: 7768)
- Echo-Scanner.exe (PID: 7444)
Starts itself from another location
- Echo-Scanner.exe (PID: 7444)
Starts CMD.EXE for commands execution
- svchost.exe (PID: 7768)
Found regular expressions for crypto-addresses (YARA)
- Echo-Scanner.exe (PID: 7444)
- svchost.exe (PID: 7768)
Executes as Windows Service
- vds.exe (PID: 7020)
- VSSVC.exe (PID: 7956)
- wbengine.exe (PID: 2616)
Start notepad (likely ransomware note)
- svchost.exe (PID: 7768)
The process creates files with name similar to system file names
- Echo-Scanner.exe (PID: 7444)
INFO
Checks supported languages
- Echo-Scanner.exe (PID: 7444)
- svchost.exe (PID: 7768)
Reads the computer name
- Echo-Scanner.exe (PID: 7444)
- svchost.exe (PID: 7768)
Reads the machine GUID from the registry
- svchost.exe (PID: 7768)
- Echo-Scanner.exe (PID: 7444)
Process checks computer location settings
- svchost.exe (PID: 7768)
- Echo-Scanner.exe (PID: 7444)
Reads security settings of Internet Explorer
- WMIC.exe (PID: 8064)
- notepad.exe (PID: 5204)
- notepad.exe (PID: 7684)
Creates files or folders in the user directory
- svchost.exe (PID: 7768)
- Echo-Scanner.exe (PID: 7444)
Creates files in the program directory
- svchost.exe (PID: 7768)
Manual execution by a user
- rundll32.exe (PID: 3240)
- notepad.exe (PID: 5204)
- rundll32.exe (PID: 7500)
- OpenWith.exe (PID: 1328)
- rundll32.exe (PID: 680)
- OpenWith.exe (PID: 1128)
- OpenWith.exe (PID: 6676)
Create files in a temporary directory
- svchost.exe (PID: 7768)
Reads Microsoft Office registry keys
- OpenWith.exe (PID: 1328)
- OpenWith.exe (PID: 1128)
- OpenWith.exe (PID: 6676)
- svchost.exe (PID: 7768)
Checks proxy server information
- slui.exe (PID: 6108)
Reads the software policy settings
- slui.exe (PID: 6108)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
154
Monitored processes
26
Malicious processes
4
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 496 | bcdedit /set {default} recoveryenabled no | C:\Windows\System32\bcdedit.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Boot Configuration Data Editor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 680 | "C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\admin\Downloads\musicalmatter.png | C:\Windows\System32\rundll32.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1128 | "C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Downloads\musicalmatter.png.e3em | C:\Windows\System32\OpenWith.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Pick an app Exit code: 2147943623 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1132 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1328 | "C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Downloads\unknowncommunity.png.uo8f | C:\Windows\System32\OpenWith.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Pick an app Exit code: 2147943623 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1852 | wbadmin delete catalog -quiet | C:\Windows\System32\wbadmin.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Command Line Interface for Microsoft® BLB Backup Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2616 | "C:\WINDOWS\system32\wbengine.exe" | C:\Windows\System32\wbengine.exe | — | services.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft® Block Level Backup Engine Service EXE Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3240 | "C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\admin\Downloads\interestinghighly.jpg | C:\Windows\System32\rundll32.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4448 | "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no | C:\Windows\System32\cmd.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5204 | "C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Downloads\read_it.txt | C:\Windows\System32\notepad.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Notepad Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
10 548
Read events
10 511
Write events
19
Delete events
18
Modification events
| (PID) Process: | (7768) svchost.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | UpdateTask |
Value: C:\Users\admin\AppData\Roaming\svchost.exe | |||
| (PID) Process: | (496) bcdedit.exe | Key: | HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001 |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (496) bcdedit.exe | Key: | HKEY_LOCAL_MACHINE\BCD00000000\Objects\{5b970157-8568-11eb-b45c-806e6f6e6963}\Elements\11000001 |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (496) bcdedit.exe | Key: | HKEY_LOCAL_MACHINE\BCD00000000\Objects\{5b970157-8568-11eb-b45c-806e6f6e6963}\Elements\11000001 |
| Operation: | write | Name: | Element |
Value: 0000000000000000000000000000000006000000000000004800000000000000715E5C2FA985EB1190A89A9B763584210000000000000000745E5C2FA985EB1190A89A9B7635842100000000000000000000000000000000 | |||
| (PID) Process: | (496) bcdedit.exe | Key: | HKEY_LOCAL_MACHINE\BCD00000000\Objects\{5b970157-8568-11eb-b45c-806e6f6e6963}\Elements\12000002 |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (496) bcdedit.exe | Key: | HKEY_LOCAL_MACHINE\BCD00000000\Objects\{5b970157-8568-11eb-b45c-806e6f6e6963}\Elements\12000002 |
| Operation: | write | Name: | Element |
Value: \EFI\Boot\Loader.efi | |||
| (PID) Process: | (496) bcdedit.exe | Key: | HKEY_LOCAL_MACHINE\BCD00000000\Objects\{a5a30fa2-3d06-4e9f-b5f4-a01df9d1fcba}\Description |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (496) bcdedit.exe | Key: | HKEY_LOCAL_MACHINE\BCD00000000\Objects\{a5a30fa2-3d06-4e9f-b5f4-a01df9d1fcba}\Elements\24000001 |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (496) bcdedit.exe | Key: | HKEY_LOCAL_MACHINE\BCD00000000\Objects\{a5a30fa2-3d06-4e9f-b5f4-a01df9d1fcba}\Elements\25000004 |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (496) bcdedit.exe | Key: | HKEY_LOCAL_MACHINE\BCD00000000\Objects\{a5a30fa2-3d06-4e9f-b5f4-a01df9d1fcba}\Elements |
| Operation: | delete key | Name: | (default) |
Value: | |||
Executable files
1
Suspicious files
557
Text files
873
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7768 | svchost.exe | C:\$WinREAgent\RollbackInfo.ini.vc8f | binary | |
MD5:2B58B1AC0EA71580C5ABFDBE455C8764 | SHA256:44AC32B44ECEBD36D0EA02143852912496B253370E81CEA39BA7A36F68569E27 | |||
| 7768 | svchost.exe | C:\$WinREAgent\read_it.txt | text | |
MD5:0FD983D1DEE552ACD643B519981367F0 | SHA256:207DE2F7DB4CCB36D3B968D8EC22B851CCD1EC975F07AEFE0F2DB7F5995DFB78 | |||
| 7768 | svchost.exe | C:\$WinREAgent\Rollback.xml.cqsv | binary | |
MD5:EC0098FB7762C9F70B9F19831A6A7EA8 | SHA256:F68503434F9FE18287143DFAF7CAAAFC9FB0F86F0D2A9D9FD87A0A3F38BE2204 | |||
| 7768 | svchost.exe | C:\$WinREAgent\Backup\ReAgent.xml.lbpt | binary | |
MD5:55A7E60D625A871F5E6E6D0B08A0D0F7 | SHA256:F2AD08872B6D400240F7869B7445B29911CD104F5F47B3B5DAB11539238A1B0E | |||
| 7444 | Echo-Scanner.exe | C:\Users\admin\AppData\Roaming\svchost.exe | executable | |
MD5:818B2D4040E1CD5147936107AE00E2DE | SHA256:E888BD6A36D2B00EA8F2223E1FE8370CF3F0277F13B83FF57923834FC5608A66 | |||
| 7768 | svchost.exe | C:\$WinREAgent\Backup\location.txt.n26z | binary | |
MD5:035A6EFD25F5FFE9028622F899248DAD | SHA256:AABD4445951387915E5F65CAF14F333A0150CD7263362B379B029BFC1A9F9F7A | |||
| 7768 | svchost.exe | C:\found.000\dir0001.chk\read_it.txt | text | |
MD5:0FD983D1DEE552ACD643B519981367F0 | SHA256:207DE2F7DB4CCB36D3B968D8EC22B851CCD1EC975F07AEFE0F2DB7F5995DFB78 | |||
| 7768 | svchost.exe | C:\Recovery\ReAgentOld.xml | binary | |
MD5:D1457B72C3FB323A2671125AEF3EAB5D | SHA256:8A8DE823D5ED3E12746A62EF169BCF372BE0CA44F0A1236ABC35DF05D96928E1 | |||
| 7768 | svchost.exe | C:\Recovery\ReAgentOld.xml.z5qb | binary | |
MD5:D055D3F5074ACA2AC59BEC1AEDA7E011 | SHA256:5CC7936B35047A3BB3CCD3668E1F26F106CED5785E65B58427B2EB96CCCCCD18 | |||
| 7768 | svchost.exe | C:\Recovery\OEM\ResetConfig.xml.343d | binary | |
MD5:53601F92829F4B60177C2D19F9D27566 | SHA256:0E0D853C3A5BFEA0C9F3FDBBD282D91F11F575DBAB224D487BA7272DFE586726 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
22
DNS requests
6
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2104 | svchost.exe | GET | 200 | 2.16.164.120:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6392 | RUXIMICS.exe | GET | 200 | 2.16.164.120:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | POST | 500 | 40.91.76.224:443 | https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail | unknown | xml | 512 b | whitelisted |
— | — | POST | 500 | 40.91.76.224:443 | https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail | unknown | xml | 512 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2104 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6392 | RUXIMICS.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2104 | svchost.exe | 2.16.164.120:80 | crl.microsoft.com | Akamai International B.V. | NL | whitelisted |
6392 | RUXIMICS.exe | 2.16.164.120:80 | crl.microsoft.com | Akamai International B.V. | NL | whitelisted |
2104 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
7312 | slui.exe | 40.91.76.224:443 | activation-v2.sls.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
6108 | slui.exe | 40.91.76.224:443 | activation-v2.sls.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
activation-v2.sls.microsoft.com |
| whitelisted |