Analysis
-
max time kernel
129s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-es -
resource tags
arch:x64arch:x86image:win10v2004-20240709-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
25/07/2024, 15:23
Static task
static1
Behavioral task
behavioral1
Sample
Muse_Hub.exe
Resource
win10v2004-20240709-es
General
-
Target
Muse_Hub.exe
-
Size
42.8MB
-
MD5
a4d3d914f636b91a8d294b987d1a5744
-
SHA1
d24ff799cc50d14c1127be31767686cb961fab00
-
SHA256
e56195502109842efd9985eb42292d6aaadfe71df8a7b73d16fdfb2cf7f52341
-
SHA512
579fb12b0fe45aa6531d8bddf10ad96f0dcbc6c85fb769c192a965d269d6e0ec3ad2887b7271fb634393a5b65471b90929465869f781df13c75b775eccd312ae
-
SSDEEP
786432:++fDPC5XltbCdLM9Tp+AfOM0OxwkygPHyNmGpM+c+8SmYvLYpaDA8j0Z4HReO3uV:++fD6PYoYAfsOGkHKNmGpMem+0qA8j0F
Malware Config
Signatures
-
Suspicious use of NtCreateThreadExHideFromDebugger 12 IoCs
pid Process 2160 Muse.exe 2160 Muse.exe 2160 Muse.exe 4212 Muse.exe 4212 Muse.exe 4212 Muse.exe 1084 Muse.exe 1084 Muse.exe 1084 Muse.exe 4036 Muse.exe 4036 Muse.exe 4036 Muse.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 20 IoCs
pid Process 2160 Muse.exe 2160 Muse.exe 2160 Muse.exe 2160 Muse.exe 2160 Muse.exe 4212 Muse.exe 4212 Muse.exe 4212 Muse.exe 4212 Muse.exe 4212 Muse.exe 1084 Muse.exe 1084 Muse.exe 1084 Muse.exe 1084 Muse.exe 1084 Muse.exe 4036 Muse.exe 4036 Muse.exe 4036 Muse.exe 4036 Muse.exe 4036 Muse.exe -
Executes dropped EXE 4 IoCs
pid Process 3524 EXE_NETCORECHECK.EXE 2512 EXE_NETCORECHECK.EXE 3852 EXE_NETCORECHECK.EXE 2092 EXE_NETCORECHECK.EXE -
Modifies registry class 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\muse.musehub_rb9pth70m6nz6\ResourcesConfig\OverrideLanguagesList = "en-US" Muse.exe Set value (str) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\muse.musehub_rb9pth70m6nz6\ResourcesConfig\OverrideLanguagesList = "en-US" Muse.exe Set value (str) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\muse.musehub_rb9pth70m6nz6\ResourcesConfig\OverrideLanguagesList = "en-US" Muse.exe Set value (str) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\muse.musehub_rb9pth70m6nz6\ResourcesConfig\OverrideLanguagesList = "en-US" Muse.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2160 Muse.exe Token: SeDebugPrivilege 4212 Muse.exe Token: SeDebugPrivilege 1084 Muse.exe Token: SeDebugPrivilege 4036 Muse.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2640 Muse_Hub.exe 3352 Muse_Hub.exe 2372 Muse_Hub.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1716 wrote to memory of 3524 1716 Muse_Hub.exe 87 PID 1716 wrote to memory of 3524 1716 Muse_Hub.exe 87 PID 2640 wrote to memory of 2512 2640 Muse_Hub.exe 119 PID 2640 wrote to memory of 2512 2640 Muse_Hub.exe 119 PID 3352 wrote to memory of 3852 3352 Muse_Hub.exe 127 PID 3352 wrote to memory of 3852 3352 Muse_Hub.exe 127 PID 2372 wrote to memory of 2092 2372 Muse_Hub.exe 133 PID 2372 wrote to memory of 2092 2372 Muse_Hub.exe 133
Processes
-
C:\Users\Admin\AppData\Local\Temp\Muse_Hub.exe"C:\Users\Admin\AppData\Local\Temp\Muse_Hub.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\Muse Installer Temp\EXE_NETCORECHECK.EXE-N Microsoft.WindowsDesktop.App -v 8.0.02⤵
- Executes dropped EXE
PID:3524
-
-
C:\Program Files\WindowsApps\Muse.MuseHub_2.0.14.1287_x64__rb9pth70m6nz6\Muse.exe"C:\Program Files\WindowsApps\Muse.MuseHub_2.0.14.1287_x64__rb9pth70m6nz6\Muse.exe"1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2160
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\Muse_Hub.exe"C:\Users\Admin\AppData\Local\Temp\Muse_Hub.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\Muse Installer Temp\EXE_NETCORECHECK.EXE-N Microsoft.WindowsDesktop.App -v 8.0.02⤵
- Executes dropped EXE
PID:2512
-
-
C:\Program Files\WindowsApps\Muse.MuseHub_2.0.14.1287_x64__rb9pth70m6nz6\Muse.exe"C:\Program Files\WindowsApps\Muse.MuseHub_2.0.14.1287_x64__rb9pth70m6nz6\Muse.exe"1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4212
-
C:\Users\Admin\AppData\Local\Temp\Muse_Hub.exe"C:\Users\Admin\AppData\Local\Temp\Muse_Hub.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\Muse Installer Temp\EXE_NETCORECHECK.EXE-N Microsoft.WindowsDesktop.App -v 8.0.02⤵
- Executes dropped EXE
PID:3852
-
-
C:\Program Files\WindowsApps\Muse.MuseHub_2.0.14.1287_x64__rb9pth70m6nz6\Muse.exe"C:\Program Files\WindowsApps\Muse.MuseHub_2.0.14.1287_x64__rb9pth70m6nz6\Muse.exe"1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1084
-
C:\Users\Admin\Desktop\Muse_Hub.exe"C:\Users\Admin\Desktop\Muse_Hub.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\Muse Installer Temp\EXE_NETCORECHECK.EXE-N Microsoft.WindowsDesktop.App -v 8.0.02⤵
- Executes dropped EXE
PID:2092
-
-
C:\Program Files\WindowsApps\Muse.MuseHub_2.0.14.1287_x64__rb9pth70m6nz6\Muse.exe"C:\Program Files\WindowsApps\Muse.MuseHub_2.0.14.1287_x64__rb9pth70m6nz6\Muse.exe"1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4036
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24.4MB
MD529d0c76884819333b487a0dc29f66804
SHA13d4a98b03ef96df4e55019a8569f217e8862970b
SHA256f805984db1c8ac60997e617bd954116495329c162b982e50edeef18fc4b2573a
SHA5123514292560876ec846d205d77d31b40468c04def4ea2b7e35d826914e7277247a5df5db8f2949480fd9fb5f122d235ad0b4f8c7277a6d3193b890adc215a82e7
-
Filesize
32B
MD5a13fc84dd90a3536e7b310677bd49ea1
SHA1ea0ab149b850d5a670bfcd4a27c5f4369f08c082
SHA2564cbe25464dcb332005b6ad7a37f467bf5e94295e27298b22d7b52938649a2dda
SHA51298ce16485a770931f99d219b2c1f94cd5c5322a8374c319f41b6fe40b0c1210fe1c10ad109644a0e2a53d0babf2d1a36ec0ae3164989c5b979aa2ec9912b53dc
-
Filesize
32B
MD5d9947ef83ca9e552c08ff1f28821a5f4
SHA1816d2122162993dee38b98e5795849262033eb3f
SHA25667c507e9378f051589ed909e2e2fe19dfdab9ee9ef687739c6527031b04b8d9c
SHA512f135271d6f27f3947b6e56cf545e2355cfe3ef0d5ac5d2421f855b784970aa24c8501cca96f1765bf553257748fecfab87f0cae5a69152d7f36d48d50c4ccaeb
-
Filesize
32B
MD5337805622da36af9bb52a6c2e01553de
SHA13714552650fa8f6c8dd7a2c5c61ae1cb83c34f68
SHA2568224a87434f05a9b068708b672d607d86712256eb25228150af150bedffe7dfc
SHA512e32f2bfb019fe46816c53ebf3fb394179980155b431bfe0461f925b468b025e4681d503ec9e65679d1e5b3ee1358545cef71988117cf026dbe662caf8753fb7b
-
Filesize
134B
MD5985ed7a23af302b542807914f75fce31
SHA1555d9b3a6bc2d22108ed973cc8d8ad96eb5b6d77
SHA25600a1f8a6ac01e0409bbd8e07290ea94220d2e3f037df7a9254272998e07ea40f
SHA512746172c0ef662184fc0831500844ec49d091b3129e3a01ce0377377b8ad144608c89bee105e8cbee93a51c39a3a4ce8a500de7448321c4906642234b3fc000ac
-
Filesize
66B
MD57a3b6acbda9554cbd80aa4b53e92f417
SHA1f90e4b589b5678a6cffdda32de1b59dcdaea0755
SHA256bf3279596d34a7be3fd10ac0acb0a67ac61bb562256d039a7768cb20ad5dbf37
SHA512d67bc6ffae64c9b496589a3bd270d4c62e2bbe42282aec53bae737590c0e22b3f5c2651a642f701a744ba10da4af934219acf4ae0aecc641d6058b86239e6c40
-
Filesize
101B
MD52350ddb8507dd22c1be1ad9ee7137e64
SHA148dc60a57e717817f474d94d0e4e670ad437d404
SHA2565ce7a0952e0694c069f670d06ecf5550d394cc491c880660b8d74cea39f88162
SHA512278e9de95db2efc021ebea6d93573ca620541a4df93c958184e2f0516a46687e0a78c727b3ba55600aaef34c2c957adbeded022c6a19c126c78fdfb2e684ca9b
-
Filesize
52B
MD5b3c84da99182bb86ab8d52ccfbbcb4ac
SHA17595bdee797dde2b1798016dfb800920245632c9
SHA256dbe42e619f36cedfc6280fb8b00ac99ebb3c5e2b08639f9d4ed251787e68337b
SHA5125d54343999fd906556fea41ebbf3909c37bb63c81f8f14317113852a630d653a319d940f298e2858aec80e70fc509cdecb8783abf3094bf8a254150130f1afac
-
Filesize
2KB
MD5c39be2bfe924267899218a2ee0f96d37
SHA1d2976fa7ec080d36da7e59719834680be6b8d5d0
SHA2569b7952c0ae1a6027a384982c48d55978492ef208d1738b4d16a12ced8fff4d61
SHA512181c46ec4ca7b2ceff2b23333824f9cad2501c788022c80971358695f0cfb655dc40273f4148a4b073ea09b968795955a410ef767992b3e3e3599b595a53bdf7
-
Filesize
2KB
MD58ea307edc3b3d10a60619a16b3f51ff9
SHA162bc2ffdfec66601d4ef8bbeccd707687162ff43
SHA2563a616869df8fe4df0a1406d9184c4ea693ad832966ad42b50c2fcfa239ac8021
SHA512f817d0008de7504629ccfbcb4ace0ceceebb4d943f7dece93fad28c6b46a984962d66b00c577158e2dabd686aaa7eb64ab65c6b238944a14e350d73b54798b6a
-
Filesize
2KB
MD52a5d7094aad14bc39b87157a7ced9b37
SHA169371c674cab7a693660a60f0143b7cbd23ba1d6
SHA256a05eabb8fe1553cc39368487d948d919b86cb53236e5ea90be97ae01788b3437
SHA51225cbbf1cd83040df00543a9286e7028123c3f59eb649b7d58bc42ba1d12f190aa1b09ce5637379d423a4a49d4b0aaf6dfecd41ae355d5224fb2a98ecf3328565
-
Filesize
462B
MD58c90bb2073e82b25b3b157fce8a5cabe
SHA12401b6a0ae112dea321d631e0a50a79823c42b8a
SHA2561fcce94c15972ca6af1ef587879590fdbc6e0c98b48fb838b8bd6d32b2366ff9
SHA5121f22f4b5b86c8355cc42ea1bd4ae697dbceba06d5b96e4d1dd4b75e6f87151cab5a34f58fc3bfc56f1a7ddb414fc34ccc6bcc9b5b8dc702544e456479671f687
-
Filesize
35B
MD53a2f7c4f56ff17afa6b88965d61169eb
SHA16c25715b0481d789266a3b7dacaf78ae917b1ce1
SHA2567cc62f3543aea904e1b5798dc42745391d9d51aebb1a0821cc1c6ee6c9e61a76
SHA5129976f34de68e2b81edc0cd4831115aff441b68eb5fbfff2d4b9ac8a265a24baace687dffd932a1f69805dd2de9e26c2dfa54e7cb7cb0ccb3d45b769e43e88c79
-
Filesize
4KB
MD5a66562e953c06a8777517d6ff4fada93
SHA108e3ba985d6baedd0b3e9e15ef6559ef3f4dc30e
SHA256fa2e8b853ba245242a26ec095641c4111933c93558320cfc4a6f1d9707bf5bc5
SHA5127fab56eab5b86e5c5eb2639c3f5fb6e320d8f42cd43cd2da2d2476b632a9653e8fe69ecbf7e36dc835c144c8cfbd79f9dc1276b6d25603023c9c93f65eb724c7
-
Filesize
6KB
MD55c5d0412ab6caa77579d8893a612e1e5
SHA11728ba67983165b422dc148d2c21ee480830a9fb
SHA256f21136994be2a8f85d62182903dffa8589983107f340a0b169b1c0776f122298
SHA512e331437be434736a1b199e117637cd71bd80dfcf07627936fcdb21bf9ba1aaf1cad85ce87adba226cddca81832635049b2d3dc62ce346f390d2ef772f6152b26
-
Filesize
2KB
MD5a72c6e099291cdc14504ee0a5cb6b2b6
SHA18e6aef74ed133fa39ff0ea0035c6b3afa838c28b
SHA2566297dc41200d2b4f559aa1198bc5de693e4d928b2a138ee12f3d8f345a975628
SHA5125ff55f504953e359738482530bd595ce507ac92d1edaf11f91b5d33a062402a8990f6beb36b6acda741afc7450372a481e4e14476d6f313d595eabcf1ac7e3f1
-
Filesize
36B
MD50835522ae5b24bda57fc665081bc9fd2
SHA187f1ab4b2673cf3261e1b923acb6d389655e3a33
SHA2564a6ab85df8649b70f7254fb0a80125eba0943d52832fd4dfa273be6989c62a07
SHA5121d7905e189616f80442ce73c5a1470d2ba990d10dcb23d2f2bd175a30528e067923918e4cdf91726021533746ba5ef3d92675ae0d5a63d8fac58d1123c1c102b
-
Filesize
142KB
MD55f6469960e0016d44be090160b889077
SHA1114b94c1401d039903e5e8b11cacbb737230365a
SHA256cb5714eb1f8b3938233823f465173c45ccef73e5b0ee122391853a3f2a305294
SHA512a3cacbab7a8a2b0a914b2eb6043f20e60761dbedfefa12fa5353d326370c087845a9eed2024675284449bbcbb8510da72b8832114f003dd2473b45357cf5c670
-
Filesize
559B
MD5ef6114626dc37e45d376e84d82f4a10f
SHA1c90dfa53fe4c4cd4a4ef4f13fba8db4b330bd29d
SHA2561d4971b4641db0d83c87a52f0cdab93ea443380cd24993bd73717552727c4060
SHA5125beb5dd2cd6dca82d512f05997519490ed0dccde0b7f23e3111658222e6c41d497dfe44d6fc05bfd4af22b29f250b58ee434f6ddfab1d30a9a92e6f8b97b5626
-
Filesize
1KB
MD5f5a203dcc96b8f54bbb2152cf3302a46
SHA1a575099fc4f6b3716cf593a360f41c5174c84c5c
SHA256b98c03139ec2b15b4b42635aa4c038740131fc66c7b37e7d46ebe5d738ed9082
SHA51269f43378cda722115da595c20b4999c9f730d00cd0244b8f7191376c6f65273f8f2e92f22e39a8563e934fcc928a7e9eb1cfcbbc073f02306e603d5f64eb46f7
-
Filesize
1KB
MD5f4fe8639c8ba4ce5133d5dca0479d4ea
SHA127e8449e36aa0c40d5c129533519cbecad6b4eab
SHA256439f388c886b143f0b7243a711f06cc37b25d73fb49b79485f2ab9306b7f67ac
SHA512631b86df39575be08a37d77cb0e6c6928e76d55887b6a67e8020bb0f0166d398af7e053e1c57044c7f2346c9d3d5cc14222a4542b05f1020beb16fa40f2af68d
-
Filesize
257B
MD5ed00d9c804daa3237e368f34fa5b3154
SHA11bde666b05f9bacf83fe015a448c21fbbbe21b3a
SHA256656b96d4a217452006ce05eacc7924cdb85e5c02cc6f477c7f61ee6f54f11c0f
SHA5121f438121e64faebaf53c284eb196c32406af3b3042f1994e62d55aa4d196a1299e136b71e71a83f37c6b958725db0995887a67f26ab46ee72b01948ed67f5d92
-
Filesize
968B
MD512de328038248fe4930f2a2e20f1dcb0
SHA17c68c2c87874f6cfc052da66db2b57c68837e9c1
SHA2565a3846a56740fae544f84fa3a04d653e6199e3cdef207a7b9ba1ac7e7a23d1e7
SHA512fff01b460080484244a1d78fe9f58898253cce68d95723102531e7dcb7dea1f7eb33ede8e425fc82b0ed824810242e0aee0e22c34f7e719e5cdfe0e65cf8ca5f
-
Filesize
1KB
MD5655881baa9dc494085bf0a0310f5482f
SHA19cb90bb7e36c711fc4e518fa637e2665c501dc48
SHA2561db368621ad32b96feff64e74849b828b5b428ec575e2492163aa9de347ca387
SHA5124bf8ad60f61af3f4d0fd883f554c21ddfd02741611bea5a41c3063dddfca8703933c88d24d704aa2001ec088f17d182a4f255f3ccdb693bf74a24d021fb66235
-
Filesize
1KB
MD56f1222308160bb4fc14d5fc9b858fb1e
SHA1997c5b4f692b89aef97ca3c6f834952a5d4ee108
SHA2564d2999a67e6fc88fcb30e450d6387b2e461a1c5c8114dfb361ce143a630b1837
SHA51248d8ec99189e310c93f2d2a8de16ef934b79257b61bfb07cf2f4f88e9e1e6d914c62c624c84e92422a90995fb9ad1d31036be5ad486361e32be5c251c1df8c05
-
Filesize
103B
MD5380991dee5e299f9e92f52bef5f51bcc
SHA1559087a08eaa6675266556fae8dce7a584a5e147
SHA2569b16a2c1976c523435cd9898e2305019fa13abdd9924e4f99d82ad30beab56c2
SHA51240c5064c99c6f8b6e8f6646fc25c8cd732ab09f65b96290392e029a76a629d0cf03d2d0e40d104727e7cc183c72279324b3d454e18c005df8ac69573a630c4ff
-
Filesize
24KB
MD5af2be5f2c3711886c60bb8d82d963f55
SHA1e841688b000f0ecc68067420af6670c75be46dac
SHA256c1238dcec12886072b71ccdb38aaeb04746c5e0664fbe79a7e520b29b65e27b0
SHA512334d6c6ccaa0b3820bcc7d301c2505215e059accee994aef7bf9d3143724212db9d23753b36d5321bca4be12a91616b7242391c3e9348bbdff924401510425ee
-
Filesize
24KB
MD5add0560f93a4060a5557c3056a320de3
SHA12bf5f0f2cb20837ebdc4469e8a12bc6f96affc82
SHA2561284b4ec2579e8e61f4a0c444db33ab1692e57644155c9066da88be370687d41
SHA512e9f723ed466e0b6c8b5c0698957e105bf449fdee19b38291c2f574618ee2fb1da59a199bdb9f9189f6e3b9f8ecca3e3987cfd496cbb0bb00680917ab478e7f99
-
Filesize
24KB
MD51ca041c15d5ca53a7513d3d284006b79
SHA1d355bf9bcc7d56f33ba10a5cf0c569ad83bb4247
SHA256fd898d51113de30fe5352cce009679e87e51d5a8213f85162f32a3cb7c423f58
SHA51206c860457df4fb60991cb1f7761500cb8e7389895036c434b180073532427f565610cf65614d77fa4e49316a8076c0577451a5d30495f343b40db1bcb9c23ad7