File name:

MM.exe

Full analysis: https://app.any.run/tasks/646873dd-cca1-483c-8328-01a430af80d2
Verdict: Malicious activity
Analysis date: November 11, 2023, 23:10:15
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
mydoom
worm
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

E88FF8F8F200F948BDB40E3FEC7A7787

SHA1:

D692AC4ABCB5BA6FB5ECF223414629EC8A0B3906

SHA256:

47F0245970ECE06D3CAC88886273F310F586B317131C50285530A38AC4FCC005

SSDEEP:

1536:iqu5CERccfeD5U6erC/+tjmGoI8qNncv7QsWjcdn8PtQrM9ub7qoE9:nuMERcICW6erwmCG38qN+8lQrM9u3qz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual connection from system programs

      • rundll32.exe (PID: 3644)

    • MYDOOM has been detected (SURICATA)

      • MM.exe (PID: 3652)

    • Actions looks like stealing of personal data

      • MM.exe (PID: 3652)

  • SUSPICIOUS

    • Reads the Internet Settings

      • rundll32.exe (PID: 3644)

    • Connects to SMTP port

      • MM.exe (PID: 3652)

  • INFO

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 3544)

    • Reads the computer name

      • wmpnscfg.exe (PID: 3544)
      • MM.exe (PID: 3652)

    • Checks supported languages

      • wmpnscfg.exe (PID: 3544)
      • MM.exe (PID: 3652)

    • Manual execution by a user

      • MM.exe (PID: 3652)
      • wmpnscfg.exe (PID: 3544)

    • Creates files or folders in the user directory

      • rundll32.exe (PID: 3644)

    • Create files in a temporary directory

      • MM.exe (PID: 3652)

    • Checks proxy server information

      • rundll32.exe (PID: 3644)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:10:23 18:50:21+02:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 45568
InitializedDataSize: 77824
UninitializedDataSize: -
EntryPoint: 0x60af
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start runas.exe no specs wmpnscfg.exe no specs #MYDOOM mm.exe rundll32.exe

Process information

PID
CMD
Path
Indicators
Parent process
3460"C:\Windows\System32\runas.exe" /user:administrator C:\Users\admin\Desktop\MM.exeC:\Windows\System32\runas.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Run As Utility
Exit code:
3221225786
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\runas.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
3544"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
3644C:\Windows\system32\rundll32.exe C:\Windows\system32\gameux.dll,GameUXShim {29dfdaf6-2655-4d7d-9dae-112ce811cf33};C:\Users\admin\Desktop\MM.exe;3652C:\Windows\System32\rundll32.exe
MM.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
3652"C:\Users\admin\Desktop\MM.exe" C:\Users\admin\Desktop\MM.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
3221225477
Modules
Images
c:\users\admin\desktop\mm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
820
Read events
817
Write events
0
Delete events
3

Modification events

(PID) Process:(3544) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{98D828C8-2FF2-446A-A254-F21B073A458A}\{E019CE60-936C-4908-8068-8C7E29EEB8A8}
Operation:delete keyName:(default)
Value:
(PID) Process:(3544) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{98D828C8-2FF2-446A-A254-F21B073A458A}
Operation:delete keyName:(default)
Value:
(PID) Process:(3544) wmpnscfg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Health\{B5087EC2-7F34-4BE9-9A4E-EA4982A942F8}
Operation:delete keyName:(default)
Value:
Executable files
0
Suspicious files
18
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3644rundll32.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games\Steam Dark Messiah Might and Magic Single Player™.lnkbinary
MD5:797902F867589E70D3B739EED95B8606
SHA256:205AA055327AC97B6216AFC1409C50F8946692BDB655F4C3BF5743406FE367B5
3652MM.exeC:\Users\admin\AppData\Local\Temp\tmp667D.tmpcompressed
MD5:0597EAEF5104546848DB3742F3DC0295
SHA256:3DEABAAF486412D844E4F24C2530F8EF040122CA5EA7F200A5B747169959CF5F
3652MM.exeC:\Users\admin\AppData\Local\Temp\tmp6256.tmpcompressed
MD5:49ED213F2D9E81BEA7A5481982D4488E
SHA256:2757E8BF85069155327E44B6DE71A1F6365482A0D41904EC198D725B87132B5E
3652MM.exeC:\Users\admin\AppData\Local\Temp\tmp71FD.tmpcompressed
MD5:E2ABE2FE744BE439EFCDD9C8EA885524
SHA256:E8501B984BE7F7FB17BC6917188906CA836F32AA635CA7FC5B1061A972E7BBE1
3652MM.exeC:\Users\admin\AppData\Local\Temp\tmp7121.tmpcompressed
MD5:575B5AF7564CECB05194E214733C2F38
SHA256:E37AE1B34333868DF8F360BE46C5FE0D7EC00AFF703B8277D68D021701922DD9
3644rundll32.exeC:\Users\admin\AppData\Local\Microsoft\Windows\GameExplorer\{F40DFE5F-E6A0-4182-B741-FDC3936D2F33}\PlayTasks\0\Play.lnkbinary
MD5:54FC5E99B4CF47E780FAB4A6708CBBF0
SHA256:6AE8FB8CC8488AC0ECD1155A340632D1B23E8C4F797E00A27D3E867DF0A469A6
3652MM.exeC:\Users\admin\AppData\Local\Temp\tmp6080.tmpcompressed
MD5:F4A0E75EA70E2A990FF4FDC3242EF4A5
SHA256:0C28D858FF8C7F1CA26D3680C06CDAFF7AF760A4D595C470B592FC5735B8A9EE
3652MM.exeC:\Users\admin\AppData\Local\Temp\tmp7054.tmpcompressed
MD5:B4370129AEC2BC7342348EEA9D5B8047
SHA256:2FB7AB7A73FB9B8DF91268CF7763B7D283EAA8D40B046E95D01B4F2FDBB53FC6
3652MM.exeC:\Users\admin\AppData\Local\Temp\tmp7607.tmpcompressed
MD5:B3155C4DF9166B606069DDD8B372CA3A
SHA256:531101977499E84E9D380E38154556183A7ECB66537EC6ABCA05334962C4D5CC
3652MM.exeC:\Users\admin\AppData\Local\Temp\tmpABEF.tmpcompressed
MD5:619C0EBEA4D2C5F3F1308712DE3669FD
SHA256:8F13FB4F1ADAC29DF8A38513D1636C8F52BD6B6D535688E340AB095CAA7E7129
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
69
DNS requests
59
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3644
rundll32.exe
GET
302
2.18.97.227:80
http://go.microsoft.com/fwlink?linkid=30219&locale=en-US&clientType=VISTA_GAMES&clientVersion=6.1.2
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3644
rundll32.exe
2.18.97.227:80
go.microsoft.com
Akamai International B.V.
FR
unknown
3644
rundll32.exe
65.55.186.115:80
movie.metaservices.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3652
MM.exe
192.254.190.168:25
onlineconnections.com.au
UNIFIEDLAYER-AS-1
US
unknown
3652
MM.exe
64.233.166.26:25
gmail-smtp-in.l.google.com
GOOGLE
US
whitelisted
3652
MM.exe
67.195.228.94:25
mta6.am0.yahoodns.net
YAHOO-GQ1
US
unknown
3652
MM.exe
74.125.200.26:25
alt4.gmail-smtp-in.l.google.com
GOOGLE
US
whitelisted
3652
MM.exe
212.27.48.6:25
mx1.free.fr
Free SAS
FR
unknown

DNS requests

Domain
IP
Reputation
go.microsoft.com
  • 2.18.97.227
whitelisted
movie.metaservices.microsoft.com
  • 65.55.186.115
whitelisted
onlineconnections.com.au
  • 192.254.190.168
unknown
openoffice.org
  • —
unknown
mx1-lw-eu.apache.org
  • —
unknown
bryson.demon.co.uk
  • —
unknown
mx1-lw-us.apache.org
  • —
unknown
mx2-lw-eu.apache.org
  • —
unknown
mx2-lw-us.apache.org
  • —
unknown
gmail.com
  • —
unknown

Threats

PID
Process
Class
Message
3652
MM.exe
Not Suspicious Traffic
ET SMTP Sorbs.net Block Message
3652
MM.exe
Not Suspicious Traffic
ET SMTP Sorbs.net Block Message
3652
MM.exe
Generic Protocol Command Decode
SURICATA SMTP duplicate fields
3652
MM.exe
Generic Protocol Command Decode
SURICATA SMTP duplicate fields
3652
MM.exe
Generic Protocol Command Decode
SURICATA SMTP duplicate fields
6 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
MM.exe