File name:

Annabelle.exe

Full analysis: https://app.any.run/tasks/dd98ae4b-21a3-4c4b-a806-7032fa2be7d3
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: December 09, 2024, 00:28:13
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
confuser
ransomware
evasion
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows, 2 sections
MD5:

0F743287C9911B4B1C726C7C7EDCAF7D

SHA1:

9760579E73095455FCBADDFE1E7E98A2BB28BFE0

SHA256:

716335BA5CD1E7186C40295B199190E2B6655E48F1C1CBE12139BA67FAA5E1AC

SSDEEP:

393216:UMwm0qBknxdEX+LbMUgoSZmWSmh4aaRN22ChHCMNku1y4:UMcKX+Lbjgd7W1RNVC9ku1x

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • UAC/LUA settings modification

      • Annabelle.exe (PID: 4864)

    • Deletes shadow copies

      • Annabelle.exe (PID: 4864)

    • Changes the login/logoff helper path in the registry

      • Annabelle.exe (PID: 4864)

    • Disables the Run the Start menu

      • Annabelle.exe (PID: 4864)

    • Disables Windows Defender

      • Annabelle.exe (PID: 4864)

    • Changes the autorun value in the registry

      • Annabelle.exe (PID: 4864)

    • Changes image file execution options

      • Annabelle.exe (PID: 4864)
      • Annabelle.exe (PID: 4208)

    • RANSOMWARE has been detected

      • Annabelle.exe (PID: 4864)

  • SUSPICIOUS

    • Uses NETSH.EXE to change the status of the firewall

      • Annabelle.exe (PID: 4864)

    • Executes as Windows Service

      • VSSVC.exe (PID: 6188)

    • Reads security settings of Internet Explorer

      • ShellExperienceHost.exe (PID: 6492)
      • Annabelle.exe (PID: 4864)

    • Creates file in the systems drive root

      • Annabelle.exe (PID: 4864)
      • Annabelle.exe (PID: 4208)

    • Reads the date of Windows installation

      • Annabelle.exe (PID: 4864)

    • The system shut down or reboot

      • Annabelle.exe (PID: 4864)

    • The process executes via Task Scheduler

      • PLUGScheduler.exe (PID: 1372)

    • Checks for external IP

      • Annabelle.exe (PID: 4208)

  • INFO

    • Confuser has been detected (YARA)

      • Annabelle.exe (PID: 4864)

    • Reads the machine GUID from the registry

      • Annabelle.exe (PID: 4864)
      • Annabelle.exe (PID: 4208)

    • Reads the computer name

      • ShellExperienceHost.exe (PID: 6492)
      • Annabelle.exe (PID: 4208)
      • PLUGScheduler.exe (PID: 1372)

    • Checks supported languages

      • ShellExperienceHost.exe (PID: 6492)
      • Annabelle.exe (PID: 4208)
      • Annabelle.exe (PID: 4864)
      • PLUGScheduler.exe (PID: 1372)

    • The process uses the downloaded file

      • Annabelle.exe (PID: 4864)

    • Process checks computer location settings

      • Annabelle.exe (PID: 4864)

    • Reads Environment values

      • Annabelle.exe (PID: 4208)

    • Creates files in the program directory

      • PLUGScheduler.exe (PID: 1372)

    • Disables trace logs

      • Annabelle.exe (PID: 4208)

    • Checks proxy server information

      • Annabelle.exe (PID: 4208)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2018:02:18 17:54:24+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 80
CodeSize: 16437248
InitializedDataSize: 274432
UninitializedDataSize: -
EntryPoint: 0x0000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 2.1.0.0
ProductVersionNumber: 2.1.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: Annabelle
FileVersion: 2.1.0.0
InternalName: Annabelle.exe
LegalCopyright: Copyright © 2018
LegalTrademarks: -
OriginalFileName: Annabelle.exe
ProductName: UpdateBackup
ProductVersion: 2.1.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
230
Monitored processes
16
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start THREAT annabelle.exe vssadmin.exe no specs vssadmin.exe no specs conhost.exe no specs vssadmin.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs conhost.exe no specs vssvc.exe no specs shellexperiencehost.exe no specs shutdown.exe no specs conhost.exe no specs plugscheduler.exe no specs annabelle.exe annabelle.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
836\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—vssadmin.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
848vssadmin delete shadows /all /quietC:\Windows\System32\vssadmin.exe—Annabelle.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1372"C:\Program Files\RUXIM\PLUGscheduler.exe"C:\Program Files\RUXIM\PLUGScheduler.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Update LifeCycle Component Scheduler
Exit code:
0
Version:
10.0.19041.3623 (WinBuild.160101.0800)
Modules
Images
c:\program files\ruxim\plugscheduler.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
2324\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netsh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2788"C:\Users\admin\AppData\Local\Temp\Annabelle.exe" C:\Users\admin\AppData\Local\Temp\Annabelle.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Annabelle
Exit code:
3221226540
Version:
2.1.0.0
Modules
Images
c:\users\admin\appdata\local\temp\annabelle.exe
c:\windows\system32\ntdll.dll
4208C:\Users\admin\AppData\Local\Temp\Annabelle.exeC:\Users\admin\AppData\Local\Temp\Annabelle.exe
userinit.exe
User:
admin
Integrity Level:
HIGH
Description:
Annabelle
Version:
2.1.0.0
Modules
Images
c:\users\admin\appdata\local\temp\annabelle.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4864"C:\Users\admin\AppData\Local\Temp\Annabelle.exe" C:\Users\admin\AppData\Local\Temp\Annabelle.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Annabelle
Exit code:
1073807364
Version:
2.1.0.0
Modules
Images
c:\windows\system32\wldp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\amsi.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\programdata\microsoft\windows defender\platform\4.18.2207.7-0\mpoav.dll
c:\programdata\microsoft\windows defender\platform\4.18.2207.7-0\mpclient.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\msasn1.dll
5092\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—vssadmin.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5640vssadmin delete shadows /all /quietC:\Windows\System32\vssadmin.exe—Annabelle.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5712vssadmin delete shadows /all /quietC:\Windows\System32\vssadmin.exe—Annabelle.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
3 448
Read events
3 344
Write events
104
Delete events
0

Modification events

(PID) Process:(4864) Annabelle.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:UpdateBackup
Value:
C:\Users\admin\AppData\Local\Temp\Annabelle.exe
(PID) Process:(4864) Annabelle.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:UpdateBackup
Value:
C:\Users\admin\AppData\Local\Temp\Annabelle.exe
(PID) Process:(4864) Annabelle.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:UpdateBackup
Value:
C:\Users\admin\AppData\Local\Temp\Annabelle.exe
(PID) Process:(4864) Annabelle.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
Operation:writeName:DisableAntiSpyware
Value:
1
(PID) Process:(4864) Annabelle.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
Operation:writeName:DisableRoutinelyTakingAction
Value:
1
(PID) Process:(4864) Annabelle.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:WindowsDefenderMAJ
Value:
1
(PID) Process:(4864) Annabelle.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:WindowsDefenderMAJ
Value:
1
(PID) Process:(4864) Annabelle.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script Host\Settings
Operation:writeName:Enabled
Value:
0
(PID) Process:(4864) Annabelle.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings
Operation:writeName:Enabled
Value:
0
(PID) Process:(4864) Annabelle.exeKey:HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore
Operation:writeName:DisableSR
Value:
1
Executable files
0
Suspicious files
60
Text files
2
Unknown types
8

Dropped files

PID
Process
Filename
Type
4864Annabelle.exeC:\Users\admin\Documents\sonamong.rtf.ANNABELLEbinary
MD5:217B20A7D5C7D7D60D01872F901FB69C
SHA256:63A15379EA4EB7B671C6A5F4A76C8F1CAA06A52F0EB9BD2038E25AC6097637A6
4864Annabelle.exeC:\Users\admin\Documents\Database1.accdb.ANNABELLEbinary
MD5:6923415A237011EFB8D48C0981D40E42
SHA256:66C65F8208725E985A2DE2E56200173FC3F91FBDB64EFDE9DF799945BF0E9E1C
4864Annabelle.exeC:\Users\admin\Documents\downhousing.rtf.ANNABELLEbinary
MD5:737DCF601F96A1EA12B56972B6559EE0
SHA256:E4186F57624E74E6DBB7D24FFA8D5D934B259FD9F64A4469444209F92D675153
4864Annabelle.exeC:\Users\admin\Downloads\pinkculture.jpg.ANNABELLEbinary
MD5:847C8C85C69C86ED1014007425D17C10
SHA256:1BD0DB67BD69164F677F69A236F2B81D91E4BB3E7A08FC279C31C23E7578069F
4864Annabelle.exeC:\Users\admin\Desktop\cutmethods.png.ANNABELLEbinary
MD5:79761EBB291A426A3438A1F223E1BE70
SHA256:5FEC614BB4D479E92A0DB95F78B70D98A967AB5931D8455B1D325DD0A460AAF4
4864Annabelle.exeC:\Users\admin\Downloads\entirejersey.jpg.ANNABELLEbinary
MD5:4876325C0577A7ABF0A631DD48096FB3
SHA256:DE7FF65AD3F9419CE493EBCA9B9060A0B127133042FCF2CBD59E98D962BFA9E2
4864Annabelle.exeC:\Users\admin\Downloads\shoppinginto.jpg.ANNABELLEbinary
MD5:FF05CAFDE7441D6CFCF6471960A22AF4
SHA256:2214606E13D412F3B13DBD15133B0A182F9A568A014111CCDC7C570CC9F7DA18
4864Annabelle.exeC:\Users\admin\Documents\yourmountain.rtf.ANNABELLEbinary
MD5:7CF94DE5AB08C5F9C9AD4DF48A254BE7
SHA256:C6FF3DFCEA86AB6EFACBC9EDAF9C1A05376F99564B885642743099286CF09BC0
4864Annabelle.exeC:\Users\admin\Documents\muchnature.rtf.ANNABELLEbinary
MD5:0684666CEBA6223501C19393BCBBA8DF
SHA256:728A573B871759A8E05FC03B4BD0813F90AE0FF42EDE8E4493398A578F9E5181
4864Annabelle.exeC:\Users\admin\Pictures\endingad.png.ANNABELLEbinary
MD5:A4FB717EC3090B776F87E4EDC5F88733
SHA256:04F6CE8FD883C86865FFB73A58C5DCCD66623E6C28EF23514D9DC35EF63DB083
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
49
DNS requests
21
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2160
svchost.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4752
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4208
Annabelle.exe
GET
429
146.112.255.205:80
http://myip.dnsomatic.com/
unknown
—
—
unknown
2160
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4752
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4380
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2160
svchost.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
2160
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
2.23.209.182:443
—
Akamai International B.V.
GB
unknown
2160
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.9
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 2.23.181.156
whitelisted
google.com
  • 216.58.206.78
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.74
  • 40.126.32.138
  • 20.190.160.20
  • 40.126.32.140
  • 20.190.160.22
  • 40.126.32.68
  • 40.126.32.134
  • 20.190.160.17
whitelisted
go.microsoft.com
  • 23.32.186.57
whitelisted
self.events.data.microsoft.com
  • 52.168.117.174
  • 20.189.173.26
whitelisted
officeclient.microsoft.com
  • 52.109.32.97
whitelisted
ecs.office.com
  • 52.113.194.132
whitelisted

Threats

PID
Process
Class
Message
4208
Annabelle.exe
Device Retrieving External IP Address Detected
ET POLICY Internal Host Retrieving External IP via myip.dnsomatic.com
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Annabelle.exe