ef7127461d0a024cbdb38b1b958a40311cfc95573f77a739a89f9240e64fa522

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-en-20211208
submitted
20/12/2021, 07:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a6bebf44102d4d165a88455d7e236923.exe
Size 59KB
Sample211220-jvd9eaaggj
SHA256 ef7127461d0a024cbdb38b1b958a40311cfc95573f77a739a89f9240e64fa522
MD5 a6bebf44102d4d165a88455d7e236923
SHA1 6058c30ed590c6e659f7cfe6bff4d10d84566012
SHA512 520fe3f27031ccf20181385d6f24bc9604dfde24ff051a5b478c1fdb1e7aeabb3f0667533a277c4869305fab828bd8a9a618b0bc9217753e51410a09ffdd2687
MD5 SHA1 SHA512

Score

10^/10

bootkit discovery evasion persistence spyware stealer trojan

Malware Config

Signatures

Registers COM server for autorun 1 TTPs
persistence

Registry Run Keys / Startup Folder
T1060
Creates new service(s) 1 TTPs
persistence

New Service
T1050
Downloads MZ/PE file

Executes dropped EXE 16 IoCs

pid	Process
556	jiankzs_16.exe
952	MelonInst.exe
1612	MelonTray.exe
1096	pic_soft45181.exe
608	Install.exe
1940	update.exe
1712	MusesMusic-1084.exe
1888	MusesMusicB.exe
1468	MusesMusicT.exe
1560	MusesMusicDesk.exe
1484	MusesMusic.exe
656	installer_31.48.1.exe
432	JiJianGuard.exe
1708	JiJianGuard.exe
1536	MusesMusicB.exe
1968	AutoUpdate.exe

Sets DLL path for service in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Loads dropped DLL 64 IoCs

pid	Process
476	a6bebf44102d4d165a88455d7e236923.exe
476	a6bebf44102d4d165a88455d7e236923.exe
476	a6bebf44102d4d165a88455d7e236923.exe
476	a6bebf44102d4d165a88455d7e236923.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
476	a6bebf44102d4d165a88455d7e236923.exe
476	a6bebf44102d4d165a88455d7e236923.exe
952	MelonInst.exe
952	MelonInst.exe
556	jiankzs_16.exe
952	MelonInst.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
952	MelonInst.exe
1612	MelonTray.exe
1612	MelonTray.exe
952	MelonInst.exe
952	MelonInst.exe
1612	MelonTray.exe
1612	MelonTray.exe
952	MelonInst.exe
952	MelonInst.exe
476	a6bebf44102d4d165a88455d7e236923.exe
476	a6bebf44102d4d165a88455d7e236923.exe
1096	pic_soft45181.exe
1096	pic_soft45181.exe
1096	pic_soft45181.exe
608	Install.exe
608	Install.exe
608	Install.exe
608	Install.exe
608	Install.exe
608	Install.exe
608	Install.exe
608	Install.exe
608	Install.exe
1940	update.exe
1940	update.exe
476	a6bebf44102d4d165a88455d7e236923.exe
476	a6bebf44102d4d165a88455d7e236923.exe
1712	MusesMusic-1084.exe
1712	MusesMusic-1084.exe
1712	MusesMusic-1084.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MusesMusic-1084.exe

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\dknlfmhongfkfakmhhnmgfgnhhcbmldm\3.6.21_0\manifest.json	update.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MelonInst.exe
File opened for modification	\??\PhysicalDrive0	MelonTray.exe

Drops file in Program Files directory 30 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\MusesMusic\MusesMusicB.exe	MusesMusic-1084.exe
File opened for modification	C:\Program Files (x86)\MusesMusic\MusesMusicDesk.exe	MusesMusic-1084.exe
File created	C:\Program Files (x86)\MelonNote\{F8B84F47-EDA1-484c-A382-4699594FF03B}.tf	MelonInst.exe
File created	C:\Program Files (x86)\MusesMusic\MusesMusic64.dll	MusesMusic-1084.exe
File created	C:\Program Files (x86)\JiJianNote\UnInstaller.exe	installer_31.48.1.exe
File created	C:\Program Files (x86)\JiJianNote\AutoUpdate.exe	installer_31.48.1.exe
File created	C:\Program Files (x86)\JiJianNote\JiJianComURL.dll	installer_31.48.1.exe
File created	C:\Program Files (x86)\MusesMusic\MusesMusic32.dll	MusesMusic-1084.exe
File created	C:\Program Files (x86)\JiJianNote\JiJianShellExt.dll	installer_31.48.1.exe
File created	C:\Program Files (x86)\JiJianNote\JJConfig.ini	installer_31.48.1.exe
File created	C:\Program Files (x86)\JiJianNote\JiJianGuard.exe	installer_31.48.1.exe
File opened for modification	C:\Program Files (x86)\MelonNote\updatecore.dat	MelonInst.exe
File opened for modification	C:\Program Files (x86)\MusesMusic\MusesMusic32.dll	MusesMusic-1084.exe
File opened for modification	C:\Program Files (x86)\MusesMusic\MusesMusic64.dll	MusesMusic-1084.exe
File opened for modification	C:\Program Files (x86)\MusesMusic\MusesMusicB.exe	MusesMusic-1084.exe
File created	C:\Program Files (x86)\MusesMusic\MusesMusicDesk.exe	MusesMusic-1084.exe
File opened for modification	C:\Program Files (x86)\MusesMusic\MusesMusicT.exe	MusesMusic-1084.exe
File opened for modification	C:\Program Files (x86)\MusesMusic\Uninstall.exe	MusesMusic-1084.exe
File created	C:\Program Files (x86)\JiJianNote\JiJianShellExtX64.dll	installer_31.48.1.exe
File created	C:\Program Files (x86)\MusesMusic\MusesMusicT.exe	MusesMusic-1084.exe
File created	C:\Program Files (x86)\JiJianNote\JiJianNote.exe	installer_31.48.1.exe
File created	C:\Program Files (x86)\JiJianNote\JiJianTimes.exe	installer_31.48.1.exe
File created	C:\Program Files (x86)\JiJianNote\CrashReport.exe	installer_31.48.1.exe
File opened for modification	C:\Program Files (x86)\MelonNote\config.ini	MelonInst.exe
File created	C:\Program Files (x86)\MusesMusic\Uninstall.exe	MusesMusic-1084.exe
File created	C:\Program Files (x86)\MusesMusic\MusesMusic.exe	MusesMusic-1084.exe
File opened for modification	C:\Program Files (x86)\MusesMusic\MusesMusic.exe	MusesMusic-1084.exe
File created	C:\Program Files (x86)\JiJianNote\JiJianSniper.dll	installer_31.48.1.exe
File created	C:\Program Files (x86)\JiJianNote\JiJianGoose.exe	installer_31.48.1.exe
File created	C:\Program Files (x86)\JiJianNote\JiJianJumps.exe	installer_31.48.1.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 14 IoCs

installer

resource	yara_rule
behavioral1/files/0x0007000000014042-58.dat	nsis_installer_1
behavioral1/files/0x0007000000014042-58.dat	nsis_installer_2
behavioral1/files/0x0007000000014042-61.dat	nsis_installer_1
behavioral1/files/0x0007000000014042-61.dat	nsis_installer_2
behavioral1/files/0x0007000000014042-63.dat	nsis_installer_1
behavioral1/files/0x0007000000014042-63.dat	nsis_installer_2
behavioral1/files/0x0007000000014042-64.dat	nsis_installer_1
behavioral1/files/0x0007000000014042-64.dat	nsis_installer_2
behavioral1/files/0x0007000000014042-65.dat	nsis_installer_1
behavioral1/files/0x0007000000014042-65.dat	nsis_installer_2
behavioral1/files/0x0007000000014042-66.dat	nsis_installer_1
behavioral1/files/0x0007000000014042-66.dat	nsis_installer_2
behavioral1/files/0x00050000000141ce-116.dat	nsis_installer_1
behavioral1/files/0x00050000000141ce-116.dat	nsis_installer_2

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1908	schtasks.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDDD2D5C-ACB5-4AC7-AC16-613D9DBF9BDA}\InprocServer32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDDD2D5C-ACB5-4AC7-AC16-613D9DBF9BDA}\InprocServer32\ = "C:\\Program Files (x86)\\MusesMusic\\MusesMusic64.dll"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDDD2D5C-ACB5-4AC7-AC16-613D9DBF9BDA}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDDD2D5C-ACB5-4AC7-AC16-613D9DBF9BDA}\Implemented Categories	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDDD2D5C-ACB5-4AC7-AC16-613D9DBF9BDA}\Implemented Categories\{00021492-0000-0000-C000-000000000046}	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDDD2D5C-ACB5-4AC7-AC16-613D9DBF9BDA}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDDD2D5C-ACB5-4AC7-AC16-613D9DBF9BDA}\ = "MusesMusic"	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
556	jiankzs_16.exe
952	MelonInst.exe
952	MelonInst.exe
952	MelonInst.exe
952	MelonInst.exe
952	MelonInst.exe
952	MelonInst.exe
608	Install.exe
608	Install.exe
608	Install.exe
1940	update.exe
1940	update.exe
1940	update.exe
1940	update.exe
1940	update.exe
1940	update.exe
1940	update.exe
1940	update.exe
1940	update.exe
1940	update.exe
1940	update.exe
1940	update.exe
1940	update.exe
1940	update.exe
1940	update.exe
1940	update.exe
1940	update.exe
1940	update.exe
1940	update.exe
1940	update.exe
1940	update.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	952	MelonInst.exe
Token: SeDebugPrivilege	952	MelonInst.exe
Token: SeDebugPrivilege	952	MelonInst.exe
Token: SeRestorePrivilege	556	jiankzs_16.exe
Token: SeBackupPrivilege	556	jiankzs_16.exe
Token: SeDebugPrivilege	608	Install.exe
Token: SeDebugPrivilege	608	Install.exe
Token: SeDebugPrivilege	608	Install.exe
Token: SeDebugPrivilege	608	Install.exe
Token: SeTcbPrivilege	608	Install.exe
Token: SeTcbPrivilege	608	Install.exe
Token: SeDebugPrivilege	608	Install.exe
Token: SeDebugPrivilege	608	Install.exe
Token: SeDebugPrivilege	608	Install.exe
Token: SeDebugPrivilege	608	Install.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeTcbPrivilege	1940	update.exe
Token: SeTcbPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe
Token: SeDebugPrivilege	1940	update.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1712	MusesMusic-1084.exe
1712	MusesMusic-1084.exe
1712	MusesMusic-1084.exe
1888	MusesMusicB.exe
1888	MusesMusicB.exe
452	rundll32.exe
1536	MusesMusicB.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 476 wrote to memory of 556	476	a6bebf44102d4d165a88455d7e236923.exe	27
PID 476 wrote to memory of 556	476	a6bebf44102d4d165a88455d7e236923.exe	27
PID 476 wrote to memory of 556	476	a6bebf44102d4d165a88455d7e236923.exe	27
PID 476 wrote to memory of 556	476	a6bebf44102d4d165a88455d7e236923.exe	27
PID 476 wrote to memory of 556	476	a6bebf44102d4d165a88455d7e236923.exe	27
PID 476 wrote to memory of 556	476	a6bebf44102d4d165a88455d7e236923.exe	27
PID 476 wrote to memory of 556	476	a6bebf44102d4d165a88455d7e236923.exe	27
PID 556 wrote to memory of 1348	556	jiankzs_16.exe	28
PID 556 wrote to memory of 1348	556	jiankzs_16.exe	28
PID 556 wrote to memory of 1348	556	jiankzs_16.exe	28
PID 556 wrote to memory of 1348	556	jiankzs_16.exe	28
PID 556 wrote to memory of 1348	556	jiankzs_16.exe	28
PID 556 wrote to memory of 1348	556	jiankzs_16.exe	28
PID 556 wrote to memory of 1348	556	jiankzs_16.exe	28
PID 476 wrote to memory of 952	476	a6bebf44102d4d165a88455d7e236923.exe	30
PID 476 wrote to memory of 952	476	a6bebf44102d4d165a88455d7e236923.exe	30
PID 476 wrote to memory of 952	476	a6bebf44102d4d165a88455d7e236923.exe	30
PID 476 wrote to memory of 952	476	a6bebf44102d4d165a88455d7e236923.exe	30
PID 476 wrote to memory of 952	476	a6bebf44102d4d165a88455d7e236923.exe	30
PID 476 wrote to memory of 952	476	a6bebf44102d4d165a88455d7e236923.exe	30
PID 476 wrote to memory of 952	476	a6bebf44102d4d165a88455d7e236923.exe	30
PID 556 wrote to memory of 452	556	jiankzs_16.exe	31
PID 556 wrote to memory of 452	556	jiankzs_16.exe	31
PID 556 wrote to memory of 452	556	jiankzs_16.exe	31
PID 556 wrote to memory of 452	556	jiankzs_16.exe	31
PID 556 wrote to memory of 452	556	jiankzs_16.exe	31
PID 556 wrote to memory of 452	556	jiankzs_16.exe	31
PID 556 wrote to memory of 452	556	jiankzs_16.exe	31
PID 952 wrote to memory of 1612	952	MelonInst.exe	34
PID 952 wrote to memory of 1612	952	MelonInst.exe	34
PID 952 wrote to memory of 1612	952	MelonInst.exe	34
PID 952 wrote to memory of 1612	952	MelonInst.exe	34
PID 952 wrote to memory of 1612	952	MelonInst.exe	34
PID 952 wrote to memory of 1612	952	MelonInst.exe	34
PID 952 wrote to memory of 1612	952	MelonInst.exe	34
PID 476 wrote to memory of 1096	476	a6bebf44102d4d165a88455d7e236923.exe	36
PID 476 wrote to memory of 1096	476	a6bebf44102d4d165a88455d7e236923.exe	36
PID 476 wrote to memory of 1096	476	a6bebf44102d4d165a88455d7e236923.exe	36
PID 476 wrote to memory of 1096	476	a6bebf44102d4d165a88455d7e236923.exe	36
PID 476 wrote to memory of 1096	476	a6bebf44102d4d165a88455d7e236923.exe	36
PID 476 wrote to memory of 1096	476	a6bebf44102d4d165a88455d7e236923.exe	36
PID 476 wrote to memory of 1096	476	a6bebf44102d4d165a88455d7e236923.exe	36
PID 1096 wrote to memory of 608	1096	pic_soft45181.exe	37
PID 1096 wrote to memory of 608	1096	pic_soft45181.exe	37
PID 1096 wrote to memory of 608	1096	pic_soft45181.exe	37
PID 1096 wrote to memory of 608	1096	pic_soft45181.exe	37
PID 1096 wrote to memory of 608	1096	pic_soft45181.exe	37
PID 1096 wrote to memory of 608	1096	pic_soft45181.exe	37
PID 1096 wrote to memory of 608	1096	pic_soft45181.exe	37
PID 608 wrote to memory of 1940	608	Install.exe	39
PID 608 wrote to memory of 1940	608	Install.exe	39
PID 608 wrote to memory of 1940	608	Install.exe	39
PID 608 wrote to memory of 1940	608	Install.exe	39
PID 608 wrote to memory of 1940	608	Install.exe	39
PID 608 wrote to memory of 1940	608	Install.exe	39
PID 608 wrote to memory of 1940	608	Install.exe	39
PID 476 wrote to memory of 1712	476	a6bebf44102d4d165a88455d7e236923.exe	41
PID 476 wrote to memory of 1712	476	a6bebf44102d4d165a88455d7e236923.exe	41
PID 476 wrote to memory of 1712	476	a6bebf44102d4d165a88455d7e236923.exe	41
PID 476 wrote to memory of 1712	476	a6bebf44102d4d165a88455d7e236923.exe	41
PID 476 wrote to memory of 1712	476	a6bebf44102d4d165a88455d7e236923.exe	41
PID 476 wrote to memory of 1712	476	a6bebf44102d4d165a88455d7e236923.exe	41
PID 476 wrote to memory of 1712	476	a6bebf44102d4d165a88455d7e236923.exe	41
PID 1712 wrote to memory of 1888	1712	MusesMusic-1084.exe	42

C:\Users\Admin\AppData\Local\Temp\a6bebf44102d4d165a88455d7e236923.exe
"C:\Users\Admin\AppData\Local\Temp\a6bebf44102d4d165a88455d7e236923.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:476
- C:\Users\Admin\AppData\Local\Temp\jiankzs_16.exe
  "C:\Users\Admin\AppData\Local\Temp\jiankzs_16.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:556
- - C:\Windows\SysWOW64\sc.exe
    sc create ShntpServer binPath= "C:\Users\Admin\AppData\Local\jiankangzhushou\JnsvServer.exe" start= auto
    3⤵
    PID:1348
- - C:\Windows\SysWOW64\sc.exe
    sc description "ShntpServer Service" "ShntpServer Service"
    3⤵
    PID:452
- C:\Users\Admin\AppData\Local\Temp\MelonInst.exe
  "C:\Users\Admin\AppData\Local\Temp\MelonInst.exe" --silence --channel=sxkj --noautorun --nostart --nodesktop
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:952
- - C:\Program Files (x86)\MelonNote\MelonTray.exe
    "C:\Program Files (x86)\MelonNote\MelonTray.exe" --runhlp
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Writes to the Master Boot Record (MBR)
    PID:1612
- C:\Users\Admin\AppData\Local\Temp\pic_soft45181.exe
  "C:\Users\Admin\AppData\Local\Temp\pic_soft45181.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1096
- - C:\Users\Admin\AppData\Local\Temp\Mtkantu\Install.exe
    "C:\Users\Admin\AppData\Local\Temp\Mtkantu\Install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:608
  - - C:\Users\Admin\AppData\Local\Mtkantu\update.exe
      C:\Users\Admin\AppData\Local\Mtkantu\update.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops Chrome extension
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1940
- C:\Users\Admin\AppData\Local\Temp\MusesMusic-1084.exe
  "C:\Users\Admin\AppData\Local\Temp\MusesMusic-1084.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Program Files (x86)\MusesMusic\MusesMusicB.exe
    "C:\Program Files (x86)\MusesMusic\MusesMusicB.exe" install
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1888
- - C:\Program Files (x86)\MusesMusic\MusesMusicT.exe
    "C:\Program Files (x86)\MusesMusic\MusesMusicT.exe" install
    3⤵
    - Executes dropped EXE
    PID:1468
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /delete /TN _Newdd_dddmkli_cvbgfder_MusesMusic_e3df_TEE /f
      4⤵
      PID:588
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /sc ONLOGON /tn _Newdd_dddmkli_cvbgfder_MusesMusic_e3df_TEE /tr "\"C:\Program Files (x86)\MusesMusic\MusesMusicB.exe\" taskactive" /rl HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:1908
- - C:\Program Files (x86)\MusesMusic\MusesMusicDesk.exe
    "C:\Program Files (x86)\MusesMusic\MusesMusicDesk.exe" install
    3⤵
    - Executes dropped EXE
    PID:1560
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" /s "C:\Program Files (x86)\MusesMusic\MusesMusic64.dll" DllGetClassObjectEx
      4⤵
      PID:1980
    - - C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" /s "C:\Program Files (x86)\MusesMusic\MusesMusic64.dll" DllGetClassObjectEx
        5⤵
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:452
- - C:\Program Files (x86)\MusesMusic\MusesMusic.exe
    "C:\Program Files (x86)\MusesMusic\MusesMusic.exe" install
    3⤵
    - Executes dropped EXE
    PID:1484
- C:\Users\Admin\AppData\Local\Temp\installer_31.48.1.exe
  "C:\Users\Admin\AppData\Local\Temp\installer_31.48.1.exe" @/s/pid=jj09/cls=0
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:656
- - C:\Program Files (x86)\JiJianNote\JiJianGuard.exe
    "C:\Program Files (x86)\JiJianNote\JiJianGuard.exe" /type=install
    3⤵
    - Executes dropped EXE
    PID:432

C:\Program Files (x86)\JiJianNote\JiJianGuard.exe
"C:\Program Files (x86)\JiJianNote\JiJianGuard.exe"
1⤵
- Executes dropped EXE
PID:1708
- C:\Program Files (x86)\JiJianNote\AutoUpdate.exe
  "AutoUpdate.exe" /fm=3 /ui=0
  2⤵
  - Executes dropped EXE
  PID:1968

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k NetworkServiceForSXImp
1⤵
PID:308

C:\Program Files (x86)\MusesMusic\MusesMusicB.exe
deskactive
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1536

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Bootkit

T1067

New Service

T1050

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

New Service

T1050

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/308-177-0x00000000000A0000-0x00000000000A1000-memory.dmp

Download

memory/476-55-0x0000000076371000-0x0000000076373000-memory.dmp

Download

memory/556-69-0x0000000000450000-0x0000000000491000-memory.dmp

Download

memory/952-118-0x00000000001E0000-0x00000000001E1000-memory.dmp

Download

memory/1612-133-0x0000000000150000-0x0000000000151000-memory.dmp

Download

memory/1708-176-0x0000000000230000-0x0000000000231000-memory.dmp

Download

memory/1888-178-0x0000000003E80000-0x000000000413F000-memory.dmp

Download

memory/1968-183-0x00000000100FF000-0x0000000010126000-memory.dmp

Download

memory/1968-182-0x0000000010001000-0x00000000100FF000-memory.dmp

Download

memory/1968-184-0x000000001012B000-0x000000001012D000-memory.dmp

Download