Edit tour

Windows Analysis Report
ab.exe

Overview

General Information

Sample Name:	ab.exe
Analysis ID:	1730341
MD5:	0b486fe0503524cfe4726a4022fa6a68
SHA1:	297dea71d489768ce45d23b0f8a45424b469ab00
SHA256:	1228d0f04f0ba82569fc1c0609f9fd6c377a91b9ea44c1e7f9f84b2b90552da2
Infos:

Detection

Avaddon

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Found detection on Joe Sandbox Cloud Basic

Antivirus detection for dropped file

Machine Learning detection for dropped file

Spreads via windows shares (copies files to share folders)

Deletes shadow drive data (may be related to ransomware)

Creates processes via WMI

Uses 32bit PE files

Checks if the current process is being debugged

Checks for available system drives (often done to infect USB drives)

Classification

Process Tree

System is start

ab.exe (PID: 2704 cmdline: "C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe" MD5: 0B486FE0503524CFE4726A4022FA6A68)

ab.exe (PID: 4556 cmdline: "C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe" MD5: 0B486FE0503524CFE4726A4022FA6A68)

WMIC.exe (PID: 6576 cmdline: wmic SHADOWCOPY DELETE /nointeractive MD5: 82BB8430531876FBF5266E53460A393E)

conhost.exe (PID: 3392 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: D837FA4DEE7D84C19FF6F71FC48A6625)

WMIC.exe (PID: 5372 cmdline: wmic SHADOWCOPY DELETE /nointeractive MD5: 82BB8430531876FBF5266E53460A393E)

conhost.exe (PID: 5956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: D837FA4DEE7D84C19FF6F71FC48A6625)

WMIC.exe (PID: 5540 cmdline: wmic SHADOWCOPY DELETE /nointeractive MD5: 82BB8430531876FBF5266E53460A393E)

conhost.exe (PID: 412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: D837FA4DEE7D84C19FF6F71FC48A6625)

WMIC.exe (PID: 7136 cmdline: wmic SHADOWCOPY DELETE /nointeractive MD5: A2EF3F0AD95FDA9262A5F9533B6DD1BD)

conhost.exe (PID: 460 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: D837FA4DEE7D84C19FF6F71FC48A6625)

WMIC.exe (PID: 5968 cmdline: wmic SHADOWCOPY DELETE /nointeractive MD5: A2EF3F0AD95FDA9262A5F9533B6DD1BD)

conhost.exe (PID: 3084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: D837FA4DEE7D84C19FF6F71FC48A6625)

WMIC.exe (PID: 3836 cmdline: wmic SHADOWCOPY DELETE /nointeractive MD5: A2EF3F0AD95FDA9262A5F9533B6DD1BD)

conhost.exe (PID: 4316 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: D837FA4DEE7D84C19FF6F71FC48A6625)

ab.exe (PID: 6468 cmdline: C:\Users\abbas\AppData\Roaming\Microsoft\Windows\ab.exe MD5: 0B486FE0503524CFE4726A4022FA6A68)

cleanup

Yara Overview

⊘No yara matches

Sigma Overview

⊘No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: ab.exe	Virustotal: Detection: 86%	Perma Link
Source: ab.exe	Metadefender: Detection: 65%	Perma Link
Source: ab.exe	ReversingLabs: Detection: 96%

Antivirus detection for dropped file

Source: C:\Users\abbas\AppData\Roaming\Microsoft\Windows\ab.exe

Avira: detection malicious, Label: HEUR/AGEN.1136765

Machine Learning detection for dropped file

Source: C:\Users\abbas\AppData\Roaming\Microsoft\Windows\ab.exe

Joe Sandbox ML: detected

Source: ab.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	File created: C:\Users\abbas\Desktop\GAOBCVIQIJ\GVYSd_readme_.txt
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	File created: C:\Users\abbas\Desktop\GVYSd_readme_.txt
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	File created: \\DC-01\public\GVYSd_readme_.txt
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	File created: C:\Users\abbas\Desktop\QCFWYSKMHA\GVYSd_readme_.txt

Source: ab.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Spreading

Spreads via windows shares (copies files to share folders)

Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	File created: Z:\$RECYCLE.BIN
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	File created: Z:\$RECYCLE.BIN\S-1-5-21-3384971621-2488082584-654606338-1105
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	File created: Z:\$RECYCLE.BIN\S-1-5-21-3384971621-2488082584-654606338-1105\desktop.ini

Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	File opened: z:
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	File opened: x:
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	File opened: v:
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	File opened: t:
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	File opened: r:
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	File opened: p:
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	File opened: n:
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	File opened: l:
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	File opened: j:
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	File opened: h:
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	File opened: f:
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	File opened: d:
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	File opened: b:
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	File opened: y:
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	File opened: w:
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	File opened: u:
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	File opened: s:
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	File opened: q:
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	File opened: o:
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	File opened: m:
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	File opened: k:
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	File opened: i:
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	File opened: g:
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	File opened: e:
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	File opened: c:
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	File opened: a:

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: 140.31.126.40.in-addr.arpa

Spam, unwanted Advertisements and Ransom Demands

Deletes shadow drive data (may be related to ransomware)

Source: unknown	Process created: C:\Windows\System32\wbem\WMIC.exe wmic SHADOWCOPY DELETE /nointeractive
Source: unknown	Process created: C:\Windows\System32\wbem\WMIC.exe wmic SHADOWCOPY DELETE /nointeractive
Source: unknown	Process created: C:\Windows\System32\wbem\WMIC.exe wmic SHADOWCOPY DELETE /nointeractive
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic SHADOWCOPY DELETE /nointeractive
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic SHADOWCOPY DELETE /nointeractive
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic SHADOWCOPY DELETE /nointeractive
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic SHADOWCOPY DELETE /nointeractive
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic SHADOWCOPY DELETE /nointeractive
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic SHADOWCOPY DELETE /nointeractive

System Summary

Found detection on Joe Sandbox Cloud Basic

Source: ab.exe

Joe Sandbox Cloud Basic: Detection: malicious Score: 100 Threat Name: Avaddon

Perma Link

Source: ab.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: ab.exe	Virustotal: Detection: 86%
Source: ab.exe	Metadefender: Detection: 65%
Source: ab.exe	ReversingLabs: Detection: 96%

Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe

File read: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe

Source: ab.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: unknown	Process created: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe "C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe"
Source: unknown	Process created: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe "C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe"
Source: unknown	Process created: C:\Windows\System32\wbem\WMIC.exe wmic SHADOWCOPY DELETE /nointeractive
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\wbem\WMIC.exe wmic SHADOWCOPY DELETE /nointeractive
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\wbem\WMIC.exe wmic SHADOWCOPY DELETE /nointeractive
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic SHADOWCOPY DELETE /nointeractive
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic SHADOWCOPY DELETE /nointeractive
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic SHADOWCOPY DELETE /nointeractive
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic SHADOWCOPY DELETE /nointeractive
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic SHADOWCOPY DELETE /nointeractive
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic SHADOWCOPY DELETE /nointeractive
Source: unknown	Process created: C:\Users\abbas\AppData\Roaming\Microsoft\Windows\ab.exe C:\Users\abbas\AppData\Roaming\Microsoft\Windows\ab.exe

Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create

Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe

File created: C:\Users\abbas\AppData\Roaming\Microsoft\Windows\ab.exe

Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe

File written: C:\$RECYCLE.BIN\S-1-5-21-3384971621-2488082584-654606338-1105\desktop.ini

Source: classification engine

Classification label: mal80.rans.spre.winEXE@18/46@9/0

Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe

File read: C:\$RECYCLE.BIN\S-1-5-21-3384971621-2488082584-654606338-1105\desktop.ini

Source: ab.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: ab.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: ab.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: ab.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: ab.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: ab.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: ab.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: ab.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: ab.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: ab.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: ab.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: ab.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: ab.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Persistence and Installation Behavior

Creates processes via WMI

Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create

Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	File created: C:\Users\abbas\Desktop\GAOBCVIQIJ\GVYSd_readme_.txt
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	File created: C:\Users\abbas\Desktop\GVYSd_readme_.txt
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	File created: \\DC-01\public\GVYSd_readme_.txt
Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe	File created: C:\Users\abbas\Desktop\QCFWYSKMHA\GVYSd_readme_.txt

Source: C:\Users\abbas\Downloads\MjdQMcMxBd\ab.exe

Process queried: DebugPort

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
1 Replication Through Removable Media	11 Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	1 Taint Shared Content	Data from Local System	Exfiltration Over Other Network Medium	1 Non-Application Layer Protocol	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	1 Replication Through Removable Media	Data from Removable Media	Exfiltration Over Bluetooth	1 Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	11 Peripheral Device Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 File Deletion	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 System Information Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
ab.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Overview

Sigma Overview

Jbx Signature Overview

AV Detection

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Persistence and Installation Behavior

Anti Debugging

Mitre Att&ck Matrix

Screenshots

Thumbnails

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ab.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Overview

Sigma Overview

Jbx Signature Overview

AV Detection

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Persistence and Installation Behavior

Anti Debugging

Mitre Att&ck Matrix

Screenshots

Thumbnails

Windows Analysis Report
ab.exe