File name:

c8269b6919b50f1400134e84d343e70c886c024a6e9282463832d81815195897.zip

Full analysis: https://app.any.run/tasks/4e001d1c-946d-4cc1-884f-fd1365e03bd8
Verdict: Malicious activity
Threats:

Chaos ransomware is a malware family known for its destructive capabilities and diverse variants. It first appeared in 2021 as a ransomware builder and later acted as a wiper. Unlike most ransomware strains that encrypt data to extort payment, early Chaos variants permanently corrupted files, while later versions adopted more conventional encryption techniques.

Malware Trends Tracker     >>>
Analysis date: June 21, 2025, 19:33:33
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
ransomware
crypto-regex
chaos
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

88E44A70909DB8B707B177550BB08E70

SHA1:

AD8F94A7D600214B87DD6BC8E07A78165FB461FD

SHA256:

FFB5B880FD438DC6777243F59F4885000DC474E93B7CBEF1EC86D0BFE7F6DE34

SSDEEP:

384:53q5NpGa/Y261YjyRHURh98S54tvUZok+Sj:yGYlvh6SSMD+Sj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Renames files like ransomware

      • svchost.exe (PID: 7092)

    • Create files in the Startup directory

      • svchost.exe (PID: 7092)

    • CHAOS has been detected (YARA)

      • svchost.exe (PID: 7092)

    • RANSOMWARE has been detected

      • svchost.exe (PID: 7092)

    • Deletes shadow copies

      • cmd.exe (PID: 6404)
      • cmd.exe (PID: 6216)

    • Using BCDEDIT.EXE to modify recovery options

      • cmd.exe (PID: 6180)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • c8269b6919b50f1400134e84d343e70c886c024a6e9282463832d81815195897.exe (PID: 2628)

    • Reads security settings of Internet Explorer

      • c8269b6919b50f1400134e84d343e70c886c024a6e9282463832d81815195897.exe (PID: 2628)
      • svchost.exe (PID: 7092)

    • Reads the date of Windows installation

      • c8269b6919b50f1400134e84d343e70c886c024a6e9282463832d81815195897.exe (PID: 2628)
      • svchost.exe (PID: 7092)

    • The process creates files with name similar to system file names

      • c8269b6919b50f1400134e84d343e70c886c024a6e9282463832d81815195897.exe (PID: 2628)

    • Starts itself from another location

      • c8269b6919b50f1400134e84d343e70c886c024a6e9282463832d81815195897.exe (PID: 2628)

    • Write to the desktop.ini file (may be used to cloak folders)

      • svchost.exe (PID: 7092)

    • Found regular expressions for crypto-addresses (YARA)

      • svchost.exe (PID: 7092)

    • Starts CMD.EXE for commands execution

      • svchost.exe (PID: 7092)

    • Executes as Windows Service

      • VSSVC.exe (PID: 7020)
      • wbengine.exe (PID: 6524)
      • vds.exe (PID: 504)

    • Start notepad (likely ransomware note)

      • svchost.exe (PID: 7092)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3864)

    • Reads the computer name

      • c8269b6919b50f1400134e84d343e70c886c024a6e9282463832d81815195897.exe (PID: 2628)
      • svchost.exe (PID: 7092)

    • Manual execution by a user

      • c8269b6919b50f1400134e84d343e70c886c024a6e9282463832d81815195897.exe (PID: 2628)

    • Reads the machine GUID from the registry

      • c8269b6919b50f1400134e84d343e70c886c024a6e9282463832d81815195897.exe (PID: 2628)
      • svchost.exe (PID: 7092)

    • Checks supported languages

      • c8269b6919b50f1400134e84d343e70c886c024a6e9282463832d81815195897.exe (PID: 2628)
      • svchost.exe (PID: 7092)

    • Disables trace logs

      • c8269b6919b50f1400134e84d343e70c886c024a6e9282463832d81815195897.exe (PID: 2628)
      • svchost.exe (PID: 7092)

    • Reads Environment values

      • c8269b6919b50f1400134e84d343e70c886c024a6e9282463832d81815195897.exe (PID: 2628)
      • svchost.exe (PID: 7092)

    • Checks proxy server information

      • c8269b6919b50f1400134e84d343e70c886c024a6e9282463832d81815195897.exe (PID: 2628)
      • svchost.exe (PID: 7092)
      • slui.exe (PID: 6960)

    • Reads the software policy settings

      • c8269b6919b50f1400134e84d343e70c886c024a6e9282463832d81815195897.exe (PID: 2628)
      • svchost.exe (PID: 7092)
      • slui.exe (PID: 6960)

    • Creates files or folders in the user directory

      • c8269b6919b50f1400134e84d343e70c886c024a6e9282463832d81815195897.exe (PID: 2628)
      • svchost.exe (PID: 7092)

    • Process checks computer location settings

      • c8269b6919b50f1400134e84d343e70c886c024a6e9282463832d81815195897.exe (PID: 2628)
      • svchost.exe (PID: 7092)

    • Launching a file from the Startup directory

      • svchost.exe (PID: 7092)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 2028)
      • notepad.exe (PID: 2804)

    • Reads Microsoft Office registry keys

      • svchost.exe (PID: 7092)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0003
ZipCompression: Unknown (99)
ZipModifyDate: 2025:06:21 19:31:46
ZipCRC: 0x81ce4449
ZipCompressedSize: 10972
ZipUncompressedSize: 23552
ZipFileName: c8269b6919b50f1400134e84d343e70c886c024a6e9282463832d81815195897.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
160
Monitored processes
20
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe c8269b6919b50f1400134e84d343e70c886c024a6e9282463832d81815195897.exe THREAT svchost.exe slui.exe cmd.exe no specs conhost.exe no specs vssadmin.exe no specs vssvc.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs bcdedit.exe no specs bcdedit.exe no specs cmd.exe no specs conhost.exe no specs wbadmin.exe wbengine.exe no specs vdsldr.exe no specs vds.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
472vssadmin delete shadows /all /quiet C:\Windows\System32\vssadmin.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
504C:\WINDOWS\System32\vds.exeC:\Windows\System32\vds.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Virtual Disk Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vds.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2028wmic shadowcopy deleteC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
2628"C:\Users\admin\Desktop\c8269b6919b50f1400134e84d343e70c886c024a6e9282463832d81815195897.exe" C:\Users\admin\Desktop\c8269b6919b50f1400134e84d343e70c886c024a6e9282463832d81815195897.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
1
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\c8269b6919b50f1400134e84d343e70c886c024a6e9282463832d81815195897.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2804"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Roaming\read_it.txtC:\Windows\System32\notepad.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3112bcdedit /set {default} recoveryenabled noC:\Windows\System32\bcdedit.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Boot Configuration Data Editor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\bcdedit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cryptsp.dll
3608wbadmin delete catalog -quietC:\Windows\System32\wbadmin.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Command Line Interface for Microsoft® BLB Backup
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3864"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\c8269b6919b50f1400134e84d343e70c886c024a6e9282463832d81815195897.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
5008\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5764\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
11 732
Read events
11 662
Write events
52
Delete events
18

Modification events

(PID) Process:(3864) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(3864) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(3864) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(3864) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\c8269b6919b50f1400134e84d343e70c886c024a6e9282463832d81815195897.zip
(PID) Process:(3864) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3864) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3864) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3864) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3864) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3864) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
Executable files
2
Suspicious files
1
Text files
620
Unknown types
0

Dropped files

PID
Process
Filename
Type
3864WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3864.24316\c8269b6919b50f1400134e84d343e70c886c024a6e9282463832d81815195897.exeexecutable
MD5:8536FA1FE6C23759BA25BAD70155145D
SHA256:C8269B6919B50F1400134E84D343E70C886C024A6E9282463832D81815195897
2628c8269b6919b50f1400134e84d343e70c886c024a6e9282463832d81815195897.exeC:\Users\admin\AppData\Roaming\svchost.exeexecutable
MD5:8536FA1FE6C23759BA25BAD70155145D
SHA256:C8269B6919B50F1400134E84D343E70C886C024A6E9282463832D81815195897
7092svchost.exeC:\Users\admin\Desktop\desktop.initext
MD5:076DC0B2F5926B0259E6FCC1B991F683
SHA256:406410B548C3679610013AC823D2CE9633B5D1158536DA429F8281F58CCB91FB
7092svchost.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.urlbinary
MD5:83660DEB1A47E0B191FDA82BDFD61827
SHA256:87089BD6FEDDA43B5E4D738B5BF246BA1B2E5C248B9220F0D1E742B827F30B0D
7092svchost.exeC:\Users\admin\Desktop\needsart.png.livftext
MD5:6FF9726AA7C313F01F22E871F0DF5249
SHA256:093E17A119A03C0918C73AB474B9730595231A3C5EE8CB8EC85357F0EC926E27
7092svchost.exeC:\Users\admin\Desktop\foodidea.jpgtext
MD5:87522F241FEFBA929435E5A8C0DD2086
SHA256:3BECC2D6A43C2B0ADAB6983E1166B0E093CC86A43C601C6BB6301256BAEEBA34
7092svchost.exeC:\Users\admin\Desktop\mediacommunity.rtf.tqg8text
MD5:C5D8AC192DD6C7D413C0CA28505D2D8D
SHA256:C6FF5D3A74B5D352D4A0E5DCA9BB3C21DEA2EB7A4E20855B84CD40275700278C
7092svchost.exeC:\Users\admin\Desktop\fishweb.rtf.i4nntext
MD5:3A7B5B2152C082C4CFE09219BDD11CC2
SHA256:60E91E6DEC1F8681A3A35D9A896704FC59F82FD861D62817D6848061AF298275
7092svchost.exeC:\Users\admin\Desktop\fishweb.rtftext
MD5:3A7B5B2152C082C4CFE09219BDD11CC2
SHA256:60E91E6DEC1F8681A3A35D9A896704FC59F82FD861D62817D6848061AF298275
7092svchost.exeC:\Users\admin\Desktop\lookwere.rtftext
MD5:04BFDD144DD0A8FAC7059498B654069F
SHA256:DD27B7475B79CFD9E78C2063AE985191016708B0661078A986C945FFD229C994
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
28
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2596
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1180
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1180
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4680
RUXIMICS.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2336
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2596
svchost.exe
40.126.32.133:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2596
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.206
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 40.126.32.133
  • 20.190.160.67
  • 40.126.32.74
  • 20.190.160.2
  • 40.126.32.76
  • 20.190.160.14
  • 40.126.32.136
  • 20.190.160.64
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
www.microsoft.com
  • 69.192.161.161
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.11
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted

Threats

No threats detected
Process
Message
wbadmin.exe
Invalid parameter passed to C runtime function.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
c8269b6919b50f1400134e84d343e70c886c024a6e9282463832d81815195897.zip