download:

/vir/Email-Worm.Win32.Sobig.b

Full analysis: https://app.any.run/tasks/550a91bb-d4b1-41da-aaa1-d552b671cbe7
Verdict: Malicious activity
Analysis date: November 29, 2024, 19:25:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections
MD5:

4EBF94FB8AFF892D6CF99A651348FF5A

SHA1:

20871CF51FDD67018CD9DFB6860AD35539DBE2CF

SHA256:

32C2857AD572CD2390DEA8CFA12E02D62F4D759C34DFA87994E0F7E5A4E71604

SSDEEP:

768:jEHuutiVFbJhmU9Nr9R+ci9Vkv2SGTSJ5h27I3BJkwNK/Oq1IHeeHVfwXXUbpPKk:oAVFbJhr7yaiZExKYKj1IHQKZ65ABROo

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • Email-Worm.Win32.Sobig.b.exe (PID: 2284)

  • SUSPICIOUS

    • Starts another process probably with elevated privileges via RUNAS.EXE

      • runas.exe (PID: 848)

    • Starts itself from another location

      • Email-Worm.Win32.Sobig.b.exe (PID: 2284)

    • Executable content was dropped or overwritten

      • Email-Worm.Win32.Sobig.b.exe (PID: 2284)

    • Reads security settings of Internet Explorer

      • msccn32.exe (PID: 2276)

    • Checks Windows Trust Settings

      • msccn32.exe (PID: 2276)

    • Reads settings of System Certificates

      • msccn32.exe (PID: 2276)

    • Reads the Internet Settings

      • msccn32.exe (PID: 2276)

  • INFO

    • Checks supported languages

      • Email-Worm.Win32.Sobig.b.exe (PID: 2284)
      • msccn32.exe (PID: 2276)
      • wmpnscfg.exe (PID: 444)

    • Checks proxy server information

      • msccn32.exe (PID: 2276)

    • Reads the machine GUID from the registry

      • msccn32.exe (PID: 2276)

    • Disables trace logs

      • msccn32.exe (PID: 2276)

    • Reads the computer name

      • msccn32.exe (PID: 2276)
      • wmpnscfg.exe (PID: 444)

    • Reads the software policy settings

      • msccn32.exe (PID: 2276)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 444)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (39.8)
.exe | Win32 EXE Yoda's Crypter (38.3)
.dll | Win32 Dynamic Link Library (generic) (9.4)
.exe | Win32 Executable (generic) (6.5)
.exe | Generic Win/DOS Executable (2.8)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2003:05:16 16:16:59+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 49152
InitializedDataSize: 4096
UninitializedDataSize: 65536
EntryPoint: 0x1ca80
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start runas.exe no specs email-worm.win32.sobig.b.exe msccn32.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
444"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
848"C:\Windows\System32\runas.exe" /user:administrator C:\Users\admin\Desktop\Email-Worm.Win32.Sobig.b.exeC:\Windows\System32\runas.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Run As Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\runas.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
2276C:\Windows\msccn32.exe xcvfdC:\Windows\msccn32.exe
Email-Worm.Win32.Sobig.b.exe
User:
Administrator
Integrity Level:
HIGH
Modules
Images
c:\windows\msccn32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\mpr.dll
c:\windows\system32\ole32.dll
2284C:\Users\admin\Desktop\Email-Worm.Win32.Sobig.b.exeC:\Users\admin\Desktop\Email-Worm.Win32.Sobig.b.exe
runas.exe
User:
Administrator
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\email-worm.win32.sobig.b.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\mpr.dll
c:\windows\system32\ole32.dll
Total events
4 973
Read events
4 928
Write events
37
Delete events
8

Modification events

(PID) Process:(2284) Email-Worm.Win32.Sobig.b.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:System Tray
Value:
C:\Windows\msccn32.exe
(PID) Process:(2284) Email-Worm.Win32.Sobig.b.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:System Tray
Value:
C:\Windows\msccn32.exe
(PID) Process:(2276) msccn32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:delete valueName:ProxyBypass
Value:
(PID) Process:(2276) msccn32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:delete valueName:IntranetName
Value:
(PID) Process:(2276) msccn32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2276) msccn32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2276) msccn32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:delete valueName:ProxyBypass
Value:
(PID) Process:(2276) msccn32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:delete valueName:IntranetName
Value:
(PID) Process:(2276) msccn32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\msccn32_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2276) msccn32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\msccn32_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
1
Suspicious files
4
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
2276msccn32.exeC:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
2284Email-Worm.Win32.Sobig.b.exeC:\Windows\msccn32.exeexecutable
MD5:4EBF94FB8AFF892D6CF99A651348FF5A
SHA256:32C2857AD572CD2390DEA8CFA12E02D62F4D759C34DFA87994E0F7E5A4E71604
2276msccn32.exeC:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5ABbinary
MD5:543684C925ECFFC0939806A0D4CC8B8E
SHA256:55F057013DAFCB7470BCB8621158324CC7C6685170B249119E0C9A7F50F399C4
2276msccn32.exeC:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BFG3Q0C8\0EWM90WT.htmhtml
MD5:81D41C08354E19D0B1BA31C1EFB29D0F
SHA256:9A7C9E9C7C313E8EF6F2C56BD0884A6D0E3FC892E4D53936C4E915B9E6FAE085
2276msccn32.exeC:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5ABbinary
MD5:8E6CE0832C9606D41C77700DA2F97350
SHA256:18CB7F7AB85EE4458021654D459890D4110B8FD7A1A7381822454FF6D029E69B
2276msccn32.exeC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\KMNUJZKP.txttext
MD5:C5A32321F715A0C63C15911E67CE0719
SHA256:D1F16DDBF54E13C113DEEF639159E4DAD29DF98773949D3A8C3CB21E3A6E43D4
2276msccn32.exeC:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:81D0A416C5A65FDAEC9C302A7F672AAD
SHA256:707D4E2E2B1BDA88F1479A0949A9CBD9DE59D1F90154A9C31D9AC69CBDF4CF0E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
10
DNS requests
11
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2276
msccn32.exe
GET
301
74.6.143.25:80
http://yahoo.com/
unknown
—
—
whitelisted
2276
msccn32.exe
GET
301
13.248.158.7:80
http://www.geocities.com/fjgoplsnjs/jane.txt
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D
unknown
—
—
whitelisted
2276
msccn32.exe
GET
200
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e054d4eeea0b07ab
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1108
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
2276
msccn32.exe
13.248.158.7:80
www.geocities.com
AMAZON-02
US
whitelisted
2276
msccn32.exe
74.6.143.25:80
yahoo.com
YAHOO-BF1
US
whitelisted
2276
msccn32.exe
74.6.143.25:443
yahoo.com
YAHOO-BF1
US
whitelisted
2276
msccn32.exe
199.232.214.172:80
ctldl.windowsupdate.com
FASTLY
US
whitelisted
2276
msccn32.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2276
msccn32.exe
87.248.119.252:443
www.yahoo.com
Yahoo! UK Services Limited
GB
whitelisted
2276
msccn32.exe
87.248.119.251:443
www.yahoo.com
Yahoo! UK Services Limited
GB
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.184.238
whitelisted
A.ROOT-SERVERS.NET
  • 198.41.0.4
unknown
B.ROOT-SERVERS.NET
  • 170.247.170.2
unknown
www.geocities.com
  • 13.248.158.7
  • 76.223.84.192
whitelisted
yahoo.com
  • 74.6.143.25
  • 74.6.231.20
  • 74.6.231.21
  • 98.137.11.164
  • 98.137.11.163
  • 74.6.143.26
whitelisted
ctldl.windowsupdate.com
  • 199.232.214.172
  • 199.232.210.172
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
www.yahoo.com
  • 87.248.119.252
  • 87.248.119.251
whitelisted
de.yahoo.com
  • 87.248.119.251
  • 87.248.119.252
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/vir/Email-Worm.Win32.Sobig.b