File name:

Annabelle.exe

Full analysis: https://app.any.run/tasks/dd98ae4b-21a3-4c4b-a806-7032fa2be7d3
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: December 09, 2024, 00:28:13
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
confuser
ransomware
evasion
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows, 2 sections
MD5:

0F743287C9911B4B1C726C7C7EDCAF7D

SHA1:

9760579E73095455FCBADDFE1E7E98A2BB28BFE0

SHA256:

716335BA5CD1E7186C40295B199190E2B6655E48F1C1CBE12139BA67FAA5E1AC

SSDEEP:

393216:UMwm0qBknxdEX+LbMUgoSZmWSmh4aaRN22ChHCMNku1y4:UMcKX+Lbjgd7W1RNVC9ku1x

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the login/logoff helper path in the registry

      • Annabelle.exe (PID: 4864)

    • Deletes shadow copies

      • Annabelle.exe (PID: 4864)

    • Changes the autorun value in the registry

      • Annabelle.exe (PID: 4864)

    • Disables the Run the Start menu

      • Annabelle.exe (PID: 4864)

    • Disables Windows Defender

      • Annabelle.exe (PID: 4864)

    • UAC/LUA settings modification

      • Annabelle.exe (PID: 4864)

    • Changes image file execution options

      • Annabelle.exe (PID: 4864)
      • Annabelle.exe (PID: 4208)

    • RANSOMWARE has been detected

      • Annabelle.exe (PID: 4864)

  • SUSPICIOUS

    • Uses NETSH.EXE to change the status of the firewall

      • Annabelle.exe (PID: 4864)

    • Executes as Windows Service

      • VSSVC.exe (PID: 6188)

    • Reads security settings of Internet Explorer

      • ShellExperienceHost.exe (PID: 6492)
      • Annabelle.exe (PID: 4864)

    • Creates file in the systems drive root

      • Annabelle.exe (PID: 4864)
      • Annabelle.exe (PID: 4208)

    • Reads the date of Windows installation

      • Annabelle.exe (PID: 4864)

    • The system shut down or reboot

      • Annabelle.exe (PID: 4864)

    • The process executes via Task Scheduler

      • PLUGScheduler.exe (PID: 1372)

    • Checks for external IP

      • Annabelle.exe (PID: 4208)

  • INFO

    • Reads the machine GUID from the registry

      • Annabelle.exe (PID: 4864)
      • Annabelle.exe (PID: 4208)

    • Confuser has been detected (YARA)

      • Annabelle.exe (PID: 4864)

    • Checks supported languages

      • ShellExperienceHost.exe (PID: 6492)
      • Annabelle.exe (PID: 4864)
      • PLUGScheduler.exe (PID: 1372)
      • Annabelle.exe (PID: 4208)

    • Reads the computer name

      • ShellExperienceHost.exe (PID: 6492)
      • Annabelle.exe (PID: 4208)
      • PLUGScheduler.exe (PID: 1372)

    • The process uses the downloaded file

      • Annabelle.exe (PID: 4864)

    • Process checks computer location settings

      • Annabelle.exe (PID: 4864)

    • Creates files in the program directory

      • PLUGScheduler.exe (PID: 1372)

    • Reads Environment values

      • Annabelle.exe (PID: 4208)

    • Checks proxy server information

      • Annabelle.exe (PID: 4208)

    • Disables trace logs

      • Annabelle.exe (PID: 4208)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2018:02:18 17:54:24+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 80
CodeSize: 16437248
InitializedDataSize: 274432
UninitializedDataSize: -
EntryPoint: 0x0000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 2.1.0.0
ProductVersionNumber: 2.1.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: Annabelle
FileVersion: 2.1.0.0
InternalName: Annabelle.exe
LegalCopyright: Copyright © 2018
LegalTrademarks: -
OriginalFileName: Annabelle.exe
ProductName: UpdateBackup
ProductVersion: 2.1.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
230
Monitored processes
16
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start THREAT annabelle.exe vssadmin.exe no specs vssadmin.exe no specs conhost.exe no specs vssadmin.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs conhost.exe no specs vssvc.exe no specs shellexperiencehost.exe no specs shutdown.exe no specs conhost.exe no specs plugscheduler.exe no specs annabelle.exe annabelle.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
836\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—vssadmin.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
848vssadmin delete shadows /all /quietC:\Windows\System32\vssadmin.exe—Annabelle.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1372"C:\Program Files\RUXIM\PLUGscheduler.exe"C:\Program Files\RUXIM\PLUGScheduler.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Update LifeCycle Component Scheduler
Exit code:
0
Version:
10.0.19041.3623 (WinBuild.160101.0800)
Modules
Images
c:\program files\ruxim\plugscheduler.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
2324\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netsh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2788"C:\Users\admin\AppData\Local\Temp\Annabelle.exe" C:\Users\admin\AppData\Local\Temp\Annabelle.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Annabelle
Exit code:
3221226540
Version:
2.1.0.0
Modules
Images
c:\users\admin\appdata\local\temp\annabelle.exe
c:\windows\system32\ntdll.dll
4208C:\Users\admin\AppData\Local\Temp\Annabelle.exeC:\Users\admin\AppData\Local\Temp\Annabelle.exe
userinit.exe
User:
admin
Integrity Level:
HIGH
Description:
Annabelle
Version:
2.1.0.0
Modules
Images
c:\users\admin\appdata\local\temp\annabelle.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4864"C:\Users\admin\AppData\Local\Temp\Annabelle.exe" C:\Users\admin\AppData\Local\Temp\Annabelle.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Annabelle
Exit code:
1073807364
Version:
2.1.0.0
Modules
Images
c:\windows\system32\wldp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\amsi.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\programdata\microsoft\windows defender\platform\4.18.2207.7-0\mpoav.dll
c:\programdata\microsoft\windows defender\platform\4.18.2207.7-0\mpclient.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\msasn1.dll
5092\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—vssadmin.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5640vssadmin delete shadows /all /quietC:\Windows\System32\vssadmin.exe—Annabelle.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5712vssadmin delete shadows /all /quietC:\Windows\System32\vssadmin.exe—Annabelle.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
3 448
Read events
3 344
Write events
104
Delete events
0

Modification events

(PID) Process:(4864) Annabelle.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:UpdateBackup
Value:
C:\Users\admin\AppData\Local\Temp\Annabelle.exe
(PID) Process:(4864) Annabelle.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:UpdateBackup
Value:
C:\Users\admin\AppData\Local\Temp\Annabelle.exe
(PID) Process:(4864) Annabelle.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:UpdateBackup
Value:
C:\Users\admin\AppData\Local\Temp\Annabelle.exe
(PID) Process:(4864) Annabelle.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
Operation:writeName:DisableAntiSpyware
Value:
1
(PID) Process:(4864) Annabelle.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
Operation:writeName:DisableRoutinelyTakingAction
Value:
1
(PID) Process:(4864) Annabelle.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:WindowsDefenderMAJ
Value:
1
(PID) Process:(4864) Annabelle.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:WindowsDefenderMAJ
Value:
1
(PID) Process:(4864) Annabelle.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script Host\Settings
Operation:writeName:Enabled
Value:
0
(PID) Process:(4864) Annabelle.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings
Operation:writeName:Enabled
Value:
0
(PID) Process:(4864) Annabelle.exeKey:HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore
Operation:writeName:DisableSR
Value:
1
Executable files
0
Suspicious files
60
Text files
2
Unknown types
8

Dropped files

PID
Process
Filename
Type
4864Annabelle.exeC:\Users\admin\Documents\yourmountain.rtf.ANNABELLEbinary
MD5:7CF94DE5AB08C5F9C9AD4DF48A254BE7
SHA256:C6FF3DFCEA86AB6EFACBC9EDAF9C1A05376F99564B885642743099286CF09BC0
4864Annabelle.exeC:\Users\admin\Pictures\afterstandards.png.ANNABELLEbinary
MD5:AB58273CEB7DB3D6DC5832905096B470
SHA256:D7F68D5420246B91C67AE30D3F67C3B25CE59D1100EEA2654DE4679606625ADD
4864Annabelle.exeC:\Users\admin\Pictures\endingad.png.ANNABELLEbinary
MD5:A4FB717EC3090B776F87E4EDC5F88733
SHA256:04F6CE8FD883C86865FFB73A58C5DCCD66623E6C28EF23514D9DC35EF63DB083
4864Annabelle.exeC:\Users\admin\Documents\stylevisitors.rtf.ANNABELLEbinary
MD5:BCEC9824EE37DA55F755E7EEAEC221FB
SHA256:2C0CF90C1278C7A6F875DA82FE99A5FD3FD50A0ECA6BFA3CC77C3CFC6CFF74F4
4864Annabelle.exeC:\Users\admin\Pictures\difficultannual.jpg.ANNABELLEbinary
MD5:CD217258B3F7ED24834C4FB9D300F4CC
SHA256:52E7C580EF8C7A62C8BECE6E66BEF9592C41D979A7FC59A49F3E20A9DE6F7B23
4864Annabelle.exeC:\Users\admin\Documents\songseveral.rtf.ANNABELLEbinary
MD5:696707DE2DBE15C8D442887023FCD4C5
SHA256:7E38E48DB148E86FFA8A561D562CCE50184A1D7372BF2D257ACCC3F37087DC78
4864Annabelle.exeC:\Users\admin\Downloads\pinkculture.jpg.ANNABELLEbinary
MD5:847C8C85C69C86ED1014007425D17C10
SHA256:1BD0DB67BD69164F677F69A236F2B81D91E4BB3E7A08FC279C31C23E7578069F
4864Annabelle.exeC:\Users\admin\Pictures\askedpalm.jpg.ANNABELLEbinary
MD5:F5CEBEA9E3D1A62B5A4A9791CEB80EA8
SHA256:5F3056BFE7C0098EFA010D4D75E24B61455CB6E3DA50BD8CD1A2C7B1C54F565C
4864Annabelle.exeC:\Users\admin\Downloads\cataloghad.png.ANNABELLEbinary
MD5:EB90E2DD3F93765D165303FFE1D32B56
SHA256:95602B9618E07BAD2C654B3D4FE3C80F0700161EF86864ABC65F5C033E16D6BE
4864Annabelle.exeC:\Users\admin\Downloads\shoppinginto.jpg.ANNABELLEbinary
MD5:FF05CAFDE7441D6CFCF6471960A22AF4
SHA256:2214606E13D412F3B13DBD15133B0A182F9A568A014111CCDC7C570CC9F7DA18
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
49
DNS requests
21
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2160
svchost.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2160
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4752
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4208
Annabelle.exe
GET
429
146.112.255.205:80
http://myip.dnsomatic.com/
unknown
—
—
unknown
4752
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2160
svchost.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
2160
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
2.23.209.182:443
—
Akamai International B.V.
GB
unknown
2160
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.9
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 2.23.181.156
whitelisted
google.com
  • 216.58.206.78
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.74
  • 40.126.32.138
  • 20.190.160.20
  • 40.126.32.140
  • 20.190.160.22
  • 40.126.32.68
  • 40.126.32.134
  • 20.190.160.17
whitelisted
go.microsoft.com
  • 23.32.186.57
whitelisted
self.events.data.microsoft.com
  • 52.168.117.174
  • 20.189.173.26
whitelisted
officeclient.microsoft.com
  • 52.109.32.97
whitelisted
ecs.office.com
  • 52.113.194.132
whitelisted

Threats

PID
Process
Class
Message
4208
Annabelle.exe
Device Retrieving External IP Address Detected
ET POLICY Internal Host Retrieving External IP via myip.dnsomatic.com
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Annabelle.exe