File name:

ab.bin

Full analysis: https://app.any.run/tasks/c7387dbd-98ab-4753-995c-0f6d39a77500
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: January 10, 2024, 20:41:48
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
ransomware
avaddon
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

0B486FE0503524CFE4726A4022FA6A68

SHA1:

297DEA71D489768CE45D23B0F8A45424B469AB00

SHA256:

1228D0F04F0BA82569FC1C0609F9FD6C377A91B9EA44C1E7F9F84B2B90552DA2

SSDEEP:

24576:TCs99+OXLpMePfI8TgmBTCDqEbOpPtpFhyxfqC:5GOXLpMePfzVTCD7gPtLhSfqC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • UAC/LUA settings modification

      • ab.bin.exe (PID: 2488)

    • Deletes shadow copies

      • ab.bin.exe (PID: 2488)

    • Renames files like ransomware

      • ab.bin.exe (PID: 2488)

  • SUSPICIOUS

    • Write to the desktop.ini file (may be used to cloak folders)

      • ab.bin.exe (PID: 2488)

    • Creates files like ransomware instruction

      • ab.bin.exe (PID: 2488)

    • Uses pipe srvsvc via SMB (transferring data)

      • ab.bin.exe (PID: 2488)

  • INFO

    • Process drops legitimate windows executable

      • ab.bin.exe (PID: 2488)

    • Drops the executable file immediately after the start

      • ab.bin.exe (PID: 2488)

    • Checks supported languages

      • ab.bin.exe (PID: 2488)
      • ShellExperienceHost.exe (PID: 1828)
      • ab.bin.exe (PID: 640)

    • Reads the computer name

      • ab.bin.exe (PID: 2488)
      • ShellExperienceHost.exe (PID: 1828)
      • ab.bin.exe (PID: 640)

    • Creates files or folders in the user directory

      • ab.bin.exe (PID: 2488)

    • Reads the machine GUID from the registry

      • ab.bin.exe (PID: 2488)

    • Executed via WMI

      • WMIC.exe (PID: 6264)
      • WMIC.exe (PID: 6312)
      • WMIC.exe (PID: 6368)

    • Executes as Windows Service

      • VSSVC.exe (PID: 6784)

    • Manual execution by a user

      • notepad++.exe (PID: 6468)

    • Dropped object may contain TOR URL's

      • ab.bin.exe (PID: 2488)

    • The process executes via Task Scheduler

      • ab.bin.exe (PID: 640)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:04:03 18:35:19+02:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.28
CodeSize: 535040
InitializedDataSize: 262656
UninitializedDataSize: -
EntryPoint: 0x3f186
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.1
ProductVersionNumber: 1.0.0.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Host Process for Windows Tasks
FileVersion: 10.0.17763.831 (WinBuild.160101.0800)
InternalName: taskhost.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: taskhost.exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 10.0.17763.831
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
144
Monitored processes
19
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start ab.bin.exe shellexperiencehost.exe no specs wmic.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs wmic.exe no specs wmic.exe no specs conhost.exe no specs conhost.exe no specs vssvc.exe no specs wmic.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs rundll32.exe no specs notepad++.exe ab.bin.exe no specs ab.bin.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
640C:\Users\admin\AppData\Roaming\Microsoft\Windows\ab.bin.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\ab.bin.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Host Process for Windows Tasks
Exit code:
0
Version:
10.0.17763.831 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\roaming\microsoft\windows\ab.bin.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1828"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mcaC:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shell Experience Host
Exit code:
0
Version:
10.0.19041.1151 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\dxgi.dll
2488"C:\Users\admin\Desktop\ab.bin.exe" C:\Users\admin\Desktop\ab.bin.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Host Process for Windows Tasks
Exit code:
0
Version:
10.0.17763.831 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\desktop\ab.bin.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4776"C:\Users\admin\Desktop\ab.bin.exe" C:\Users\admin\Desktop\ab.bin.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Tasks
Exit code:
3221226540
Version:
10.0.17763.831 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\desktop\ab.bin.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
6264wmic SHADOWCOPY DELETE /nointeractiveC:\Windows\System32\wbem\WMIC.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
2147749890
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
6292\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—WMIC.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6312wmic SHADOWCOPY DELETE /nointeractiveC:\Windows\System32\wbem\WMIC.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
2147749890
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
6332\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—WMIC.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6368wmic SHADOWCOPY DELETE /nointeractiveC:\Windows\System32\wbem\WMIC.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
6396wmic SHADOWCOPY DELETE /nointeractiveC:\Windows\SysWOW64\wbem\WMIC.exe—ab.bin.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
2147749908
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
4 363
Read events
4 033
Write events
54
Delete events
276

Modification events

(PID) Process:(2488) ab.bin.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:EnableLUA
Value:
1
(PID) Process:(2488) ab.bin.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:ConsentPromptBehaviorAdmin
Value:
0
(PID) Process:(1828) ShellExperienceHost.exeKey:\REGISTRY\A\{02e92daa-7b59-a79f-9e93-c174e6c66258}\LocalState
Operation:writeName:PeekBadges
Value:
5B005D000000525CF796963CD901
(PID) Process:(1828) ShellExperienceHost.exeKey:\REGISTRY\A\{02e92daa-7b59-a79f-9e93-c174e6c66258}\LocalState
Operation:writeName:PeekBadges
Value:
5B005D000000BAE26B780544DA01
(PID) Process:(2488) ab.bin.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(2488) ab.bin.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0004
Operation:writeName:Sequence
Value:
1
(PID) Process:(2488) ab.bin.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0002
Operation:writeName:Sequence
Value:
1
(PID) Process:(2488) ab.bin.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:Sequence
Value:
1
(PID) Process:(2488) ab.bin.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0006
Operation:writeName:Sequence
Value:
1
(PID) Process:(2488) ab.bin.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:delete valueName:RegFilesHash
Value:
CE67EB02CE562EEC0C145E7B24A9208A14C8E6E6784D33ED207BB2D9C40001C5
Executable files
3
Suspicious files
92
Text files
21
Unknown types
0

Dropped files

PID
Process
Filename
Type
2488ab.bin.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\ab.bin.exeexecutable
MD5:0B486FE0503524CFE4726A4022FA6A68
SHA256:1228D0F04F0BA82569FC1C0609F9FD6C377A91B9EA44C1E7F9F84B2B90552DA2
2488ab.bin.exeC:\Users\admin\Desktop\resourcescontrol.rtf.aABBBabeACbinary
MD5:57E0929CED6E72474F8B3BE82B3DCF1F
SHA256:D4F59C47813CE63809A8314081883E8534042611EA6164B0EB7D04083B07B731
2488ab.bin.exeC:\Users\admin\Desktop\pacificstatement.rtf.aABBBabeACbinary
MD5:75438A8F146EF4AB515C180CD7BA9386
SHA256:352B4F8E4A62E369DE09CFB9DBEE19611A392521A6E6A101F78F6D9D2F706103
2488ab.bin.exeC:\Users\admin\Desktop\georgeaccommodation.jpgbinary
MD5:44AD54BAA31C300AFFA976CA916A0A93
SHA256:83F6DF206E20C48A35896B8356181B18FDEAE9170F01F852E35C5E137D50F145
2488ab.bin.exeC:\Users\admin\Desktop\eyeslas.png.aABBBabeACbinary
MD5:E1C80F34F9894F83B638C7C151C6E57F
SHA256:16EE299328B2DCECA19AAE22F193F3C9E5707BB34D0BD3969C58206CB0D781F1
2488ab.bin.exeC:\Users\admin\Desktop\resourcescontrol.rtfbinary
MD5:57E0929CED6E72474F8B3BE82B3DCF1F
SHA256:D4F59C47813CE63809A8314081883E8534042611EA6164B0EB7D04083B07B731
2488ab.bin.exeC:\Users\admin\Desktop\itsummary.rtfbinary
MD5:38C8C194E9671D92348259DAC0CD8D46
SHA256:9500DC07FA0B6B07A5C71BB0BD3A13313E4E5A4CA936847B71F9C81F708CCEF6
2488ab.bin.exeC:\Users\admin\Desktop\themselvesup.png.aABBBabeACbinary
MD5:595CBEF226CCEFB51E54AEC67C9C9E76
SHA256:6267236338FA0783B695B9E6C0DA682F0E2410AB966BD039953D026F15DA4886
2488ab.bin.exe\\?\Volume{eaf65672-68c3-4f99-8d5c-104b5f4d8fff}\$RECYCLE.BIN\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.initext
MD5:AD0B0B4416F06AF436328A3C12DC491B
SHA256:23521DE51CA1DB2BC7B18E41DE7693542235284667BF85F6C31902547A947416
2488ab.bin.exe\\?\Volume{2f5c5e73-85a9-11eb-90a8-9a9b76358421}\$RECYCLE.BIN\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.initext
MD5:AD0B0B4416F06AF436328A3C12DC491B
SHA256:23521DE51CA1DB2BC7B18E41DE7693542235284667BF85F6C31902547A947416
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
53
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1092
svchost.exe
POST
302
2.19.86.20:80
http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409
unknown
—
—
unknown
5768
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
5028
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
binary
313 b
unknown
1092
svchost.exe
POST
302
2.19.86.20:80
http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409
unknown
—
—
unknown
1092
svchost.exe
POST
302
2.19.86.20:80
http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409
unknown
—
—
unknown
7000
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
binary
418 b
unknown
1092
svchost.exe
POST
—
2.19.86.20:80
http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409
unknown
—
—
unknown
7000
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
binary
409 b
unknown
2908
svchost.exe
GET
200
23.192.153.142:80
http://x1.c.lencr.org/
unknown
binary
717 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5768
svchost.exe
40.126.32.68:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
3720
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1092
svchost.exe
2.19.86.20:80
go.microsoft.com
Akamai International B.V.
NL
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
5768
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1092
svchost.exe
20.231.121.79:80
dmd.metaservices.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
4
System
192.168.100.1:445
—
—
—
unknown
4
System
192.168.100.1:139
—
—
—
unknown
5612
MoUsoCoreWorker.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5028
SearchApp.exe
104.126.37.161:443
www.bing.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
go.microsoft.com
  • 2.19.86.20
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
dmd.metaservices.microsoft.com
  • 20.231.121.79
whitelisted
www.bing.com
  • 104.126.37.161
  • 104.126.37.170
  • 104.126.37.177
  • 104.126.37.160
  • 104.126.37.176
  • 104.126.37.178
  • 104.126.37.145
  • 104.126.37.171
  • 104.126.37.155
whitelisted
slscr.update.microsoft.com
  • 20.114.59.183
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
x1.c.lencr.org
  • 23.192.153.142
whitelisted

Threats

No threats detected
Process
Message
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
notepad++.exe
VerifyLibrary: error while getting certificate informations
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ab.bin