Analysis
- max time kernel
152s - max time network
150s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
20/12/2021, 07:59
Static task
static1
Behavioral task
behavioral1
Sample
a6bebf44102d4d165a88455d7e236923.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target a6bebf44102d4d165a88455d7e236923.exe
- Size 59KB
- Sample211220-jvd9eaaggj
- SHA256 ef7127461d0a024cbdb38b1b958a40311cfc95573f77a739a89f9240e64fa522
- MD5 a6bebf44102d4d165a88455d7e236923
- SHA1 6058c30ed590c6e659f7cfe6bff4d10d84566012
- SHA512 520fe3f27031ccf20181385d6f24bc9604dfde24ff051a5b478c1fdb1e7aeabb3f0667533a277c4869305fab828bd8a9a618b0bc9217753e51410a09ffdd2687
- MD5 SHA1 SHA512
Malware Config
Signatures
- Registers COM server for autorun 1 TTPs
- Creates new service(s) 1 TTPs
- Downloads MZ/PE file
- Executes dropped EXE 18 IoCs
pid Process 3608 jiankzs_16.exe 3364 MelonInst.exe 3924 MelonTray.exe 2596 pic_soft45181.exe 3248 Install.exe 1216 MusesMusic-1084.exe 3176 update.exe 2352 MusesMusicB.exe 1196 MusesMusicT.exe 3780 MusesMusicDesk.exe 2844 MusesMusic.exe 2728 Process not Found 1716 installer_31.48.1.exe 3424 JiJianGuard.exe 3492 JiJianGuard.exe 3476 MusesMusicB.exe 3532 AutoUpdate.exe 2592 JiJianJumps.exe - Sets DLL path for service in the registry 2 TTPs
- Loads dropped DLL 56 IoCs
pid Process 2688 a6bebf44102d4d165a88455d7e236923.exe 2688 a6bebf44102d4d165a88455d7e236923.exe 2688 a6bebf44102d4d165a88455d7e236923.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 2688 a6bebf44102d4d165a88455d7e236923.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3364 MelonInst.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 2688 a6bebf44102d4d165a88455d7e236923.exe 3248 Install.exe 3248 Install.exe 3248 Install.exe 2688 a6bebf44102d4d165a88455d7e236923.exe 2176 rundll32.exe 2928 rundll32.exe 3056 Process not Found 3056 Process not Found 1716 installer_31.48.1.exe 936 svchost.exe 3532 AutoUpdate.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA MusesMusic-1084.exe - Drops Chrome extension 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\dknlfmhongfkfakmhhnmgfgnhhcbmldm\3.6.21_0\manifest.json update.exe - Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 MelonInst.exe File opened for modification \??\PhysicalDrive0 MelonTray.exe - Drops file in Program Files directory 30 IoCs
description ioc Process File created C:\Program Files (x86)\MelonNote\{B976AECA-607D-41f6-A0F6-990A976154D0}.tf MelonInst.exe File created C:\Program Files (x86)\JiJianNote\JiJianTimes.exe installer_31.48.1.exe File created C:\Program Files (x86)\JiJianNote\JiJianGuard.exe installer_31.48.1.exe File created C:\Program Files (x86)\JiJianNote\JiJianJumps.exe installer_31.48.1.exe File created C:\Program Files (x86)\MusesMusic\MusesMusic.exe MusesMusic-1084.exe File created C:\Program Files (x86)\MusesMusic\MusesMusic32.dll MusesMusic-1084.exe File created C:\Program Files (x86)\MusesMusic\MusesMusicT.exe MusesMusic-1084.exe File created C:\Program Files (x86)\MusesMusic\Uninstall.exe MusesMusic-1084.exe File created C:\Program Files (x86)\JiJianNote\JiJianSniper.dll installer_31.48.1.exe File opened for modification C:\Program Files (x86)\MelonNote\config.ini MelonInst.exe File created C:\Program Files (x86)\MusesMusic\MusesMusic64.dll MusesMusic-1084.exe File opened for modification C:\Program Files (x86)\MusesMusic\MusesMusic64.dll MusesMusic-1084.exe File opened for modification C:\Program Files (x86)\MusesMusic\MusesMusicB.exe MusesMusic-1084.exe File created C:\Program Files (x86)\JiJianNote\JiJianShellExt.dll installer_31.48.1.exe File created C:\Program Files (x86)\JiJianNote\JiJianShellExtX64.dll installer_31.48.1.exe File created C:\Program Files (x86)\JiJianNote\JJConfig.ini installer_31.48.1.exe File created C:\Program Files (x86)\JiJianNote\CrashReport.exe installer_31.48.1.exe File opened for modification C:\Program Files (x86)\MelonNote\updatecore.dat MelonInst.exe File opened for modification C:\Program Files (x86)\MusesMusic\MusesMusic32.dll MusesMusic-1084.exe File created C:\Program Files (x86)\MusesMusic\MusesMusicB.exe MusesMusic-1084.exe File opened for modification C:\Program Files (x86)\MusesMusic\Uninstall.exe MusesMusic-1084.exe File opened for modification C:\Program Files (x86)\MusesMusic\MusesMusicT.exe MusesMusic-1084.exe File created C:\Program Files (x86)\JiJianNote\UnInstaller.exe installer_31.48.1.exe File created C:\Program Files (x86)\JiJianNote\AutoUpdate.exe installer_31.48.1.exe File created C:\Program Files (x86)\JiJianNote\JiJianGoose.exe installer_31.48.1.exe File opened for modification C:\Program Files (x86)\MusesMusic\MusesMusic.exe MusesMusic-1084.exe File created C:\Program Files (x86)\MusesMusic\MusesMusicDesk.exe MusesMusic-1084.exe File opened for modification C:\Program Files (x86)\MusesMusic\MusesMusicDesk.exe MusesMusic-1084.exe File created C:\Program Files (x86)\JiJianNote\JiJianNote.exe installer_31.48.1.exe File created C:\Program Files (x86)\JiJianNote\JiJianComURL.dll installer_31.48.1.exe - Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- NSIS installer 4 IoCs
resource yara_rule behavioral2/files/0x000700000001ab3b-121.dat nsis_installer_1 behavioral2/files/0x000700000001ab3b-121.dat nsis_installer_2 behavioral2/files/0x000700000001ab3b-123.dat nsis_installer_1 behavioral2/files/0x000700000001ab3b-123.dat nsis_installer_2 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 installer_31.48.1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 installer_31.48.1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName installer_31.48.1.exe - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 900 schtasks.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\SuiXinFlash.exe = "11000" installer_31.48.1.exe - Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDDD2D5C-ACB5-4AC7-AC16-613D9DBF9BDA}\Implemented Categories\{00021492-0000-0000-C000-000000000046} rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDDD2D5C-ACB5-4AC7-AC16-613D9DBF9BDA} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDDD2D5C-ACB5-4AC7-AC16-613D9DBF9BDA}\ = "MusesMusic" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDDD2D5C-ACB5-4AC7-AC16-613D9DBF9BDA}\InprocServer32 rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDDD2D5C-ACB5-4AC7-AC16-613D9DBF9BDA}\InprocServer32\ = "C:\\Program Files (x86)\\MusesMusic\\MusesMusic64.dll" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDDD2D5C-ACB5-4AC7-AC16-613D9DBF9BDA}\InprocServer32\ThreadingModel = "Apartment" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDDD2D5C-ACB5-4AC7-AC16-613D9DBF9BDA}\Implemented Categories rundll32.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3608 jiankzs_16.exe 3364 MelonInst.exe 3364 MelonInst.exe 3364 MelonInst.exe 3364 MelonInst.exe 3364 MelonInst.exe 3364 MelonInst.exe 3248 Install.exe 3248 Install.exe 3248 Install.exe 3248 Install.exe 3248 Install.exe 3248 Install.exe 3176 update.exe 3176 update.exe 3176 update.exe 3176 update.exe 3176 update.exe 3176 update.exe 3176 update.exe 3176 update.exe 3176 update.exe 3176 update.exe 3176 update.exe 3176 update.exe 3176 update.exe 3176 update.exe 3176 update.exe 3176 update.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3364 MelonInst.exe Token: SeDebugPrivilege 3364 MelonInst.exe Token: SeDebugPrivilege 3364 MelonInst.exe Token: SeDebugPrivilege 3248 Install.exe Token: SeDebugPrivilege 3248 Install.exe Token: SeDebugPrivilege 3248 Install.exe Token: SeDebugPrivilege 3248 Install.exe Token: SeTcbPrivilege 3248 Install.exe Token: SeTcbPrivilege 3248 Install.exe Token: SeDebugPrivilege 3248 Install.exe Token: SeDebugPrivilege 3248 Install.exe Token: SeDebugPrivilege 3248 Install.exe Token: SeDebugPrivilege 3248 Install.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeTcbPrivilege 3176 update.exe Token: SeTcbPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe Token: SeDebugPrivilege 3176 update.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe 2592 JiJianJumps.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1216 MusesMusic-1084.exe 1216 MusesMusic-1084.exe 1216 MusesMusic-1084.exe 2352 MusesMusicB.exe 2352 MusesMusicB.exe 2928 rundll32.exe 3476 MusesMusicB.exe - Suspicious use of WriteProcessMemory 62 IoCs
description pid Process procid_target PID 2688 wrote to memory of 3608 2688 a6bebf44102d4d165a88455d7e236923.exe 68 PID 2688 wrote to memory of 3608 2688 a6bebf44102d4d165a88455d7e236923.exe 68 PID 2688 wrote to memory of 3608 2688 a6bebf44102d4d165a88455d7e236923.exe 68 PID 2688 wrote to memory of 3364 2688 a6bebf44102d4d165a88455d7e236923.exe 69 PID 2688 wrote to memory of 3364 2688 a6bebf44102d4d165a88455d7e236923.exe 69 PID 2688 wrote to memory of 3364 2688 a6bebf44102d4d165a88455d7e236923.exe 69 PID 3608 wrote to memory of 1060 3608 jiankzs_16.exe 70 PID 3608 wrote to memory of 1060 3608 jiankzs_16.exe 70 PID 3608 wrote to memory of 1060 3608 jiankzs_16.exe 70 PID 3608 wrote to memory of 2256 3608 jiankzs_16.exe 72 PID 3608 wrote to memory of 2256 3608 jiankzs_16.exe 72 PID 3608 wrote to memory of 2256 3608 jiankzs_16.exe 72 PID 3364 wrote to memory of 3924 3364 MelonInst.exe 74 PID 3364 wrote to memory of 3924 3364 MelonInst.exe 74 PID 3364 wrote to memory of 3924 3364 MelonInst.exe 74 PID 2688 wrote to memory of 2596 2688 a6bebf44102d4d165a88455d7e236923.exe 76 PID 2688 wrote to memory of 2596 2688 a6bebf44102d4d165a88455d7e236923.exe 76 PID 2688 wrote to memory of 2596 2688 a6bebf44102d4d165a88455d7e236923.exe 76 PID 2596 wrote to memory of 3248 2596 pic_soft45181.exe 77 PID 2596 wrote to memory of 3248 2596 pic_soft45181.exe 77 PID 2596 wrote to memory of 3248 2596 pic_soft45181.exe 77 PID 2688 wrote to memory of 1216 2688 a6bebf44102d4d165a88455d7e236923.exe 79 PID 2688 wrote to memory of 1216 2688 a6bebf44102d4d165a88455d7e236923.exe 79 PID 2688 wrote to memory of 1216 2688 a6bebf44102d4d165a88455d7e236923.exe 79 PID 3248 wrote to memory of 3176 3248 Install.exe 80 PID 3248 wrote to memory of 3176 3248 Install.exe 80 PID 3248 wrote to memory of 3176 3248 Install.exe 80 PID 1216 wrote to memory of 2352 1216 MusesMusic-1084.exe 81 PID 1216 wrote to memory of 2352 1216 MusesMusic-1084.exe 81 PID 1216 wrote to memory of 2352 1216 MusesMusic-1084.exe 81 PID 1216 wrote to memory of 1196 1216 MusesMusic-1084.exe 82 PID 1216 wrote to memory of 1196 1216 MusesMusic-1084.exe 82 PID 1216 wrote to memory of 1196 1216 MusesMusic-1084.exe 82 PID 1216 wrote to memory of 3780 1216 MusesMusic-1084.exe 83 PID 1216 wrote to memory of 3780 1216 MusesMusic-1084.exe 83 PID 1216 wrote to memory of 3780 1216 MusesMusic-1084.exe 83 PID 1196 wrote to memory of 3152 1196 MusesMusicT.exe 84 PID 1196 wrote to memory of 3152 1196 MusesMusicT.exe 84 PID 1196 wrote to memory of 3152 1196 MusesMusicT.exe 84 PID 1216 wrote to memory of 2844 1216 MusesMusic-1084.exe 86 PID 1216 wrote to memory of 2844 1216 MusesMusic-1084.exe 86 PID 1216 wrote to memory of 2844 1216 MusesMusic-1084.exe 86 PID 1196 wrote to memory of 900 1196 MusesMusicT.exe 88 PID 1196 wrote to memory of 900 1196 MusesMusicT.exe 88 PID 1196 wrote to memory of 900 1196 MusesMusicT.exe 88 PID 3780 wrote to memory of 2176 3780 MusesMusicDesk.exe 90 PID 3780 wrote to memory of 2176 3780 MusesMusicDesk.exe 90 PID 3780 wrote to memory of 2176 3780 MusesMusicDesk.exe 90 PID 2176 wrote to memory of 2928 2176 rundll32.exe 91 PID 2176 wrote to memory of 2928 2176 rundll32.exe 91 PID 2688 wrote to memory of 1716 2688 a6bebf44102d4d165a88455d7e236923.exe 92 PID 2688 wrote to memory of 1716 2688 a6bebf44102d4d165a88455d7e236923.exe 92 PID 2688 wrote to memory of 1716 2688 a6bebf44102d4d165a88455d7e236923.exe 92 PID 1716 wrote to memory of 3424 1716 installer_31.48.1.exe 93 PID 1716 wrote to memory of 3424 1716 installer_31.48.1.exe 93 PID 1716 wrote to memory of 3424 1716 installer_31.48.1.exe 93 PID 3492 wrote to memory of 3532 3492 JiJianGuard.exe 99 PID 3492 wrote to memory of 3532 3492 JiJianGuard.exe 99 PID 3492 wrote to memory of 3532 3492 JiJianGuard.exe 99 PID 3532 wrote to memory of 2592 3532 AutoUpdate.exe 100 PID 3532 wrote to memory of 2592 3532 AutoUpdate.exe 100 PID 3532 wrote to memory of 2592 3532 AutoUpdate.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6bebf44102d4d165a88455d7e236923.exe"C:\Users\Admin\AppData\Local\Temp\a6bebf44102d4d165a88455d7e236923.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\jiankzs_16.exe"C:\Users\Admin\AppData\Local\Temp\jiankzs_16.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Windows\SysWOW64\sc.exesc create ShntpServer binPath= "C:\Users\Admin\AppData\Local\jiankangzhushou\JnsvServer.exe" start= auto3⤵PID:1060
-
-
C:\Windows\SysWOW64\sc.exesc description "ShntpServer Service" "ShntpServer Service"3⤵PID:2256
-
-
-
C:\Users\Admin\AppData\Local\Temp\MelonInst.exe"C:\Users\Admin\AppData\Local\Temp\MelonInst.exe" --silence --channel=sxkj --noautorun --nostart --nodesktop2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Program Files (x86)\MelonNote\MelonTray.exe"C:\Program Files (x86)\MelonNote\MelonTray.exe" --runhlp3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:3924
-
-
-
C:\Users\Admin\AppData\Local\Temp\pic_soft45181.exe"C:\Users\Admin\AppData\Local\Temp\pic_soft45181.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\Mtkantu\Install.exe"C:\Users\Admin\AppData\Local\Temp\Mtkantu\Install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Mtkantu\update.exeC:\Users\Admin\AppData\Local\Mtkantu\update.exe4⤵
- Executes dropped EXE
- Drops Chrome extension
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3176
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\MusesMusic-1084.exe"C:\Users\Admin\AppData\Local\Temp\MusesMusic-1084.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Program Files (x86)\MusesMusic\MusesMusicB.exe"C:\Program Files (x86)\MusesMusic\MusesMusicB.exe" install3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2352
-
-
C:\Program Files (x86)\MusesMusic\MusesMusicT.exe"C:\Program Files (x86)\MusesMusic\MusesMusicT.exe" install3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /TN _Newdd_dddmkli_cvbgfder_MusesMusic_e3df_TEE /f4⤵PID:3152
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc ONLOGON /tn _Newdd_dddmkli_cvbgfder_MusesMusic_e3df_TEE /tr "\"C:\Program Files (x86)\MusesMusic\MusesMusicB.exe\" taskactive" /rl HIGHEST4⤵
- Creates scheduled task(s)
PID:900
-
-
-
C:\Program Files (x86)\MusesMusic\MusesMusicDesk.exe"C:\Program Files (x86)\MusesMusic\MusesMusicDesk.exe" install3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" /s "C:\Program Files (x86)\MusesMusic\MusesMusic64.dll" DllGetClassObjectEx4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" /s "C:\Program Files (x86)\MusesMusic\MusesMusic64.dll" DllGetClassObjectEx5⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2928
-
-
-
-
C:\Program Files (x86)\MusesMusic\MusesMusic.exe"C:\Program Files (x86)\MusesMusic\MusesMusic.exe" install3⤵
- Executes dropped EXE
PID:2844
-
-
-
C:\Users\Admin\AppData\Local\Temp\installer_31.48.1.exe"C:\Users\Admin\AppData\Local\Temp\installer_31.48.1.exe" @/s/pid=jj09/cls=02⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Program Files (x86)\JiJianNote\JiJianGuard.exe"C:\Program Files (x86)\JiJianNote\JiJianGuard.exe" /type=install3⤵
- Executes dropped EXE
PID:3424
-
-
-
C:\Program Files (x86)\JiJianNote\JiJianGuard.exe"C:\Program Files (x86)\JiJianNote\JiJianGuard.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Program Files (x86)\JiJianNote\AutoUpdate.exe"AutoUpdate.exe" /fm=3 /ui=02⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Program Files (x86)\JiJianNote\JiJianJumps.exe"C:\Program Files (x86)\JiJianNote\JiJianJumps.exe"3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2592
-
-
-
\??\c:\windows\syswow64\svchost.exec:\windows\syswow64\svchost.exe -k networkserviceforsximp -s SXSecurityCenter1⤵
- Loads dropped DLL
PID:936
-
C:\Program Files (x86)\MusesMusic\MusesMusicB.exedeskactive1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3476