mmc.exe

  • File Path: C:\Windows\SysWOW64\mmc.exe
  • Description: Microsoft Management Console

Screenshot

mmc.exe mmc.exe

Hashes

Type Hash
MD5 258D0788201374F240CD4A7D97968217
SHA1 BECBDEEF5D9E9A52B0BAACE184521D1F06195942
SHA256 38B20E000EE8A8675881CA126FA85DAF9CE6A55EB7D990D8BB805D3AFE48D342
SHA384 D230103D099A910DC3DC415E74802132955C877EA6C9BAF46CFE3FD67BB227C338D2C0C97B400D4AC9D2FA4D3BF4F1F6
SHA512 0B5076F62BBF4EDDE874D143255CC9F277385DA5E11E21D49039B8A0F5107AA0FACF7B214CAE800CEDF656CD9DBB7EDFB5C66060A2CBCF301672D809F538BDDE
SSDEEP 24576:wthBrJrd+oG2TH2tVfoV5hmpbh0XOBIYplgGMo7wMo7DHDAOLiE:wtNrdSqWtVfoVTmpms7e7DH0OLiE

Runtime Data

Child Processes:

mmc.exe

Signature

  • Status: Signature verified.
  • Serial: 3300000266BD1580EFA75CD6D3000000000266
  • Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: mmc.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.14393.0 (rs1_release.160715-1616)
  • Product Version: 10.0.14393.0
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.

File Similarity (ssdeep match)

File Score
C:\WINDOWS\system32\mmc.exe 35
C:\windows\system32\mmc.exe 32
C:\Windows\system32\mmc.exe 33
C:\Windows\system32\mmc.exe 32
C:\Windows\system32\mmc.exe 33
C:\Windows\system32\mmc.exe 35
C:\Windows\SysWOW64\mmc.exe 35
C:\Windows\SysWOW64\mmc.exe 32
C:\windows\SysWOW64\mmc.exe 29
C:\Windows\SysWOW64\mmc.exe 30
C:\Windows\SysWOW64\mmc.exe 30
C:\WINDOWS\SysWOW64\mmc.exe 30
C:\WINDOWS\SysWOW64\mmc.exe 29

Possible Misuse

The following table contains possible examples of mmc.exe being misused. While mmc.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma win_user_driver_loaded.yml - '\Windows\System32\mmc.exe' DRL 1.0
sigma file_event_win_susp_adsi_cache_usage.yml - 'C:\windows\system32\mmc.exe' DRL 1.0
sigma file_event_win_uac_bypass_dotnet_profiler.yml description: Detects the pattern of UAC Bypass using .NET Code Profiler and mmc.exe DLL hijacking (UACMe 39) DRL 1.0
sigma pipe_created_susp_adfs_namedpipe_connection.yml - '\mmc.exe' DRL 1.0
sigma proc_creation_win_impacket_lateralization.yml # parent is mmc.exe DRL 1.0
sigma proc_creation_win_impacket_lateralization.yml - '\mmc.exe' # dcomexec MMC DRL 1.0
sigma proc_creation_win_mmc20_lateral_movement.yml description: Detects MMC20.Application Lateral Movement; specifically looks for the spawning of the parent MMC.exe with a command line of "-Embedding" as a child of svchost.exe DRL 1.0
sigma proc_creation_win_mmc20_lateral_movement.yml Image\|endswith: '\mmc.exe' DRL 1.0
sigma proc_creation_win_mmc_spawn_shell.yml ParentImage\|endswith: '\mmc.exe' DRL 1.0
sigma proc_creation_win_susp_taskmgr_parent.yml - '\mmc.exe' DRL 1.0
sigma proc_creation_win_sysmon_uac_bypass_eventvwr.yml Image\|endswith: '\mmc.exe' DRL 1.0
sigma proc_creation_win_uac_bypass_wmp.yml ParentCommandLine: '"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc" /s' DRL 1.0
sigma registry_event_bypass_uac_using_eventviewer.yml Details: '%SystemRoot%\system32\mmc.exe "%1" %*' DRL 1.0
LOLBAS Eventvwr.yml Description: During startup, eventvwr.exe checks the registry value HKCU\Software\Classes\mscfile\shell\open\command for the location of mmc.exe, which is used to open the eventvwr.msc saved console file. If the location of another binary or script is added to this registry value, it will be executed as a high-integrity process without a UAC prompt being displayed to the user.  
LOLBAS Eventvwr.yml - IOC: eventvwr.exe launching child process other than mmc.exe  
LOLBAS Mmc.yml Name: Mmc.exe  
LOLBAS Mmc.yml - Command: mmc.exe -Embedding c:\path\to\test.msc  
LOLBAS Mmc.yml - Command: mmc.exe gpedit.msc  
LOLBAS Mmc.yml - Path: C:\Windows\System32\mmc.exe  
LOLBAS Mmc.yml - Path: C:\Windows\SysWOW64\mmc.exe  
LOLBAS Wsreset.yml - IOC: wsreset.exe launching child process other than mmc.exe  
malware-ioc nukesped_lazarus .mmc.exe``{:.highlight .language-cmhg} © ESET 2014-2018
atomic-red-team T1548.002.md copy “#{executable_binary}” “\?\C:\Windows \System32\mmc.exe” MIT License. © 2018 Red Canary
atomic-red-team T1548.002.md mklink c:\testbypass.exe “\?\C:\Windows \System32\mmc.exe” MIT License. © 2018 Red Canary
atomic-red-team T1548.002.md Target: \system32\mmc.exe MIT License. © 2018 Red Canary
atomic-red-team T1574.012.md START MMC.EXE EVENTVWR.MSC MIT License. © 2018 Red Canary
signature-base crime_cn_campaign_njrat.yar $a5 = “taskkill /f /im mmc.exe” fullword ascii CC BY-NC 4.0

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.

mmc

Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012

Using mmc command-line options, you can open a specific mmc console, open mmc in author mode, or specify that the 32-bit or 64-bit version of mmc is opened.

Syntax

mmc <path>\<filename>.msc [/a] [/64] [/32]

Parameters

Parameter Description
<path>\<filename>.msc starts mmc and opens a saved console. You need to specify the complete path and file name for the saved console file. If you do not specify a console file, mmc opens a new console.
/a Opens a saved console in author mode. Used to make changes to saved consoles.
/64 Opens the 64-bit version of mmc (mmc64). Use this option only if you are running a Microsoft 64-bit operating system and want to use a 64-bit snap-in.
/32 Opens the 32-bit version of mmc (mmc32). When running a Microsoft 64-bit operating system, you can run 32-bit snap-ins by opening mmc with this command-line option when you have 32-bit only snap-ins.

Remarks

  • You can use environment variables to create command lines or shortcuts that don’t depend on the explicit location of console files. For instance, if the path to a console file is in the system folder (for example, mmc c:\winnt\system32\console_name.msc), you can use the expandable data string %systemroot% to specify the location (mmc%systemroot%\system32\console_name.msc). This may be useful if you’re delegating tasks to people in your organization who are working on different computers.

  • When consoles are opened using the /a option, they’re opened in author mode, regardless of their default mode. This doesn’t permanently change the default mode setting for files; when you omit this option, mmc opens console files according to their default mode settings.

  • After you open mmc or a console file in author mode, you can open any existing console by clicking Open on the Console menu.

  • You can use the command line to create shortcuts for opening mmc and saved consoles. A command-line command works with the Run command on the Start menu, in any command-prompt window, in shortcuts, or in any batch file or program that calls the command.

Additional References

MIT License. Copyright (c) 2020-2021 Strontic.