Analysis

  • max time kernel
    129s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-es
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-eslocale:es-esos:windows10-2004-x64systemwindows
  • submitted
    25/07/2024, 15:23

General

  • Target

    Muse_Hub.exe

  • Size

    42.8MB

  • MD5

    a4d3d914f636b91a8d294b987d1a5744

  • SHA1

    d24ff799cc50d14c1127be31767686cb961fab00

  • SHA256

    e56195502109842efd9985eb42292d6aaadfe71df8a7b73d16fdfb2cf7f52341

  • SHA512

    579fb12b0fe45aa6531d8bddf10ad96f0dcbc6c85fb769c192a965d269d6e0ec3ad2887b7271fb634393a5b65471b90929465869f781df13c75b775eccd312ae

  • SSDEEP

    786432:++fDPC5XltbCdLM9Tp+AfOM0OxwkygPHyNmGpM+c+8SmYvLYpaDA8j0Z4HReO3uV:++fD6PYoYAfsOGkHKNmGpMem+0qA8j0F

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtCreateThreadExHideFromDebugger 12 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 20 IoCs
  • Executes dropped EXE 4 IoCs
  • Modifies registry class 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Muse_Hub.exe
    "C:\Users\Admin\AppData\Local\Temp\Muse_Hub.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1716
    • C:\Users\Admin\AppData\Local\Temp\Muse Installer Temp\EXE_NETCORECHECK.EXE
      -N Microsoft.WindowsDesktop.App -v 8.0.0
      2⤵
      • Executes dropped EXE
      PID:3524
  • C:\Program Files\WindowsApps\Muse.MuseHub_2.0.14.1287_x64__rb9pth70m6nz6\Muse.exe
    "C:\Program Files\WindowsApps\Muse.MuseHub_2.0.14.1287_x64__rb9pth70m6nz6\Muse.exe"
    1⤵
    • Suspicious use of NtCreateThreadExHideFromDebugger
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:2160
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:1684
    • C:\Users\Admin\AppData\Local\Temp\Muse_Hub.exe
      "C:\Users\Admin\AppData\Local\Temp\Muse_Hub.exe"
      1⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2640
      • C:\Users\Admin\AppData\Local\Temp\Muse Installer Temp\EXE_NETCORECHECK.EXE
        -N Microsoft.WindowsDesktop.App -v 8.0.0
        2⤵
        • Executes dropped EXE
        PID:2512
    • C:\Program Files\WindowsApps\Muse.MuseHub_2.0.14.1287_x64__rb9pth70m6nz6\Muse.exe
      "C:\Program Files\WindowsApps\Muse.MuseHub_2.0.14.1287_x64__rb9pth70m6nz6\Muse.exe"
      1⤵
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:4212
    • C:\Users\Admin\AppData\Local\Temp\Muse_Hub.exe
      "C:\Users\Admin\AppData\Local\Temp\Muse_Hub.exe"
      1⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3352
      • C:\Users\Admin\AppData\Local\Temp\Muse Installer Temp\EXE_NETCORECHECK.EXE
        -N Microsoft.WindowsDesktop.App -v 8.0.0
        2⤵
        • Executes dropped EXE
        PID:3852
    • C:\Program Files\WindowsApps\Muse.MuseHub_2.0.14.1287_x64__rb9pth70m6nz6\Muse.exe
      "C:\Program Files\WindowsApps\Muse.MuseHub_2.0.14.1287_x64__rb9pth70m6nz6\Muse.exe"
      1⤵
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:1084
    • C:\Users\Admin\Desktop\Muse_Hub.exe
      "C:\Users\Admin\Desktop\Muse_Hub.exe"
      1⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2372
      • C:\Users\Admin\AppData\Local\Temp\Muse Installer Temp\EXE_NETCORECHECK.EXE
        -N Microsoft.WindowsDesktop.App -v 8.0.0
        2⤵
        • Executes dropped EXE
        PID:2092
    • C:\Program Files\WindowsApps\Muse.MuseHub_2.0.14.1287_x64__rb9pth70m6nz6\Muse.exe
      "C:\Program Files\WindowsApps\Muse.MuseHub_2.0.14.1287_x64__rb9pth70m6nz6\Muse.exe"
      1⤵
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:4036

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\boost_interprocess\14000000\MuseHub

            Filesize

            24.4MB

            MD5

            29d0c76884819333b487a0dc29f66804

            SHA1

            3d4a98b03ef96df4e55019a8569f217e8862970b

            SHA256

            f805984db1c8ac60997e617bd954116495329c162b982e50edeef18fc4b2573a

            SHA512

            3514292560876ec846d205d77d31b40468c04def4ea2b7e35d826914e7277247a5df5db8f2949480fd9fb5f122d235ad0b4f8c7277a6d3193b890adc215a82e7

          • C:\Users\Admin\AppData\Local\Muse Hub\.bdconfig

            Filesize

            32B

            MD5

            a13fc84dd90a3536e7b310677bd49ea1

            SHA1

            ea0ab149b850d5a670bfcd4a27c5f4369f08c082

            SHA256

            4cbe25464dcb332005b6ad7a37f467bf5e94295e27298b22d7b52938649a2dda

            SHA512

            98ce16485a770931f99d219b2c1f94cd5c5322a8374c319f41b6fe40b0c1210fe1c10ad109644a0e2a53d0babf2d1a36ec0ae3164989c5b979aa2ec9912b53dc

          • C:\Users\Admin\AppData\Local\Muse Hub\.bdconfig

            Filesize

            32B

            MD5

            d9947ef83ca9e552c08ff1f28821a5f4

            SHA1

            816d2122162993dee38b98e5795849262033eb3f

            SHA256

            67c507e9378f051589ed909e2e2fe19dfdab9ee9ef687739c6527031b04b8d9c

            SHA512

            f135271d6f27f3947b6e56cf545e2355cfe3ef0d5ac5d2421f855b784970aa24c8501cca96f1765bf553257748fecfab87f0cae5a69152d7f36d48d50c4ccaeb

          • C:\Users\Admin\AppData\Local\Muse Hub\.bdconfig

            Filesize

            32B

            MD5

            337805622da36af9bb52a6c2e01553de

            SHA1

            3714552650fa8f6c8dd7a2c5c61ae1cb83c34f68

            SHA256

            8224a87434f05a9b068708b672d607d86712256eb25228150af150bedffe7dfc

            SHA512

            e32f2bfb019fe46816c53ebf3fb394179980155b431bfe0461f925b468b025e4681d503ec9e65679d1e5b3ee1358545cef71988117cf026dbe662caf8753fb7b

          • C:\Users\Admin\AppData\Local\Muse Hub\.dlcache

            Filesize

            134B

            MD5

            985ed7a23af302b542807914f75fce31

            SHA1

            555d9b3a6bc2d22108ed973cc8d8ad96eb5b6d77

            SHA256

            00a1f8a6ac01e0409bbd8e07290ea94220d2e3f037df7a9254272998e07ea40f

            SHA512

            746172c0ef662184fc0831500844ec49d091b3129e3a01ce0377377b8ad144608c89bee105e8cbee93a51c39a3a4ce8a500de7448321c4906642234b3fc000ac

          • C:\Users\Admin\AppData\Local\Muse Hub\.dlcache

            Filesize

            66B

            MD5

            7a3b6acbda9554cbd80aa4b53e92f417

            SHA1

            f90e4b589b5678a6cffdda32de1b59dcdaea0755

            SHA256

            bf3279596d34a7be3fd10ac0acb0a67ac61bb562256d039a7768cb20ad5dbf37

            SHA512

            d67bc6ffae64c9b496589a3bd270d4c62e2bbe42282aec53bae737590c0e22b3f5c2651a642f701a744ba10da4af934219acf4ae0aecc641d6058b86239e6c40

          • C:\Users\Admin\AppData\Local\Muse Hub\.rccache

            Filesize

            101B

            MD5

            2350ddb8507dd22c1be1ad9ee7137e64

            SHA1

            48dc60a57e717817f474d94d0e4e670ad437d404

            SHA256

            5ce7a0952e0694c069f670d06ecf5550d394cc491c880660b8d74cea39f88162

            SHA512

            278e9de95db2efc021ebea6d93573ca620541a4df93c958184e2f0516a46687e0a78c727b3ba55600aaef34c2c957adbeded022c6a19c126c78fdfb2e684ca9b

          • C:\Users\Admin\AppData\Local\Muse Hub\.rccache

            Filesize

            52B

            MD5

            b3c84da99182bb86ab8d52ccfbbcb4ac

            SHA1

            7595bdee797dde2b1798016dfb800920245632c9

            SHA256

            dbe42e619f36cedfc6280fb8b00ac99ebb3c5e2b08639f9d4ed251787e68337b

            SHA512

            5d54343999fd906556fea41ebbf3909c37bb63c81f8f14317113852a630d653a319d940f298e2858aec80e70fc509cdecb8783abf3094bf8a254150130f1afac

          • C:\Users\Admin\AppData\Local\Muse Hub\.receipt

            Filesize

            2KB

            MD5

            c39be2bfe924267899218a2ee0f96d37

            SHA1

            d2976fa7ec080d36da7e59719834680be6b8d5d0

            SHA256

            9b7952c0ae1a6027a384982c48d55978492ef208d1738b4d16a12ced8fff4d61

            SHA512

            181c46ec4ca7b2ceff2b23333824f9cad2501c788022c80971358695f0cfb655dc40273f4148a4b073ea09b968795955a410ef767992b3e3e3599b595a53bdf7

          • C:\Users\Admin\AppData\Local\Muse Hub\.receipt

            Filesize

            2KB

            MD5

            8ea307edc3b3d10a60619a16b3f51ff9

            SHA1

            62bc2ffdfec66601d4ef8bbeccd707687162ff43

            SHA256

            3a616869df8fe4df0a1406d9184c4ea693ad832966ad42b50c2fcfa239ac8021

            SHA512

            f817d0008de7504629ccfbcb4ace0ceceebb4d943f7dece93fad28c6b46a984962d66b00c577158e2dabd686aaa7eb64ab65c6b238944a14e350d73b54798b6a

          • C:\Users\Admin\AppData\Local\Muse Hub\.receipt

            Filesize

            2KB

            MD5

            2a5d7094aad14bc39b87157a7ced9b37

            SHA1

            69371c674cab7a693660a60f0143b7cbd23ba1d6

            SHA256

            a05eabb8fe1553cc39368487d948d919b86cb53236e5ea90be97ae01788b3437

            SHA512

            25cbbf1cd83040df00543a9286e7028123c3f59eb649b7d58bc42ba1d12f190aa1b09ce5637379d423a4a49d4b0aaf6dfecd41ae355d5224fb2a98ecf3328565

          • C:\Users\Admin\AppData\Local\Muse Hub\settings.json

            Filesize

            462B

            MD5

            8c90bb2073e82b25b3b157fce8a5cabe

            SHA1

            2401b6a0ae112dea321d631e0a50a79823c42b8a

            SHA256

            1fcce94c15972ca6af1ef587879590fdbc6e0c98b48fb838b8bd6d32b2366ff9

            SHA512

            1f22f4b5b86c8355cc42ea1bd4ae697dbceba06d5b96e4d1dd4b75e6f87151cab5a34f58fc3bfc56f1a7ddb414fc34ccc6bcc9b5b8dc702544e456479671f687

          • C:\Users\Admin\AppData\Local\MuseSampler\.config

            Filesize

            35B

            MD5

            3a2f7c4f56ff17afa6b88965d61169eb

            SHA1

            6c25715b0481d789266a3b7dacaf78ae917b1ce1

            SHA256

            7cc62f3543aea904e1b5798dc42745391d9d51aebb1a0821cc1c6ee6c9e61a76

            SHA512

            9976f34de68e2b81edc0cd4831115aff441b68eb5fbfff2d4b9ac8a265a24baace687dffd932a1f69805dd2de9e26c2dfa54e7cb7cb0ccb3d45b769e43e88c79

          • C:\Users\Admin\AppData\Local\Packages\Muse.MuseHub_rb9pth70m6nz6\LocalCache\Logs\current.txt

            Filesize

            4KB

            MD5

            a66562e953c06a8777517d6ff4fada93

            SHA1

            08e3ba985d6baedd0b3e9e15ef6559ef3f4dc30e

            SHA256

            fa2e8b853ba245242a26ec095641c4111933c93558320cfc4a6f1d9707bf5bc5

            SHA512

            7fab56eab5b86e5c5eb2639c3f5fb6e320d8f42cd43cd2da2d2476b632a9653e8fe69ecbf7e36dc835c144c8cfbd79f9dc1276b6d25603023c9c93f65eb724c7

          • C:\Users\Admin\AppData\Local\Packages\Muse.MuseHub_rb9pth70m6nz6\LocalCache\Logs\current.txt

            Filesize

            6KB

            MD5

            5c5d0412ab6caa77579d8893a612e1e5

            SHA1

            1728ba67983165b422dc148d2c21ee480830a9fb

            SHA256

            f21136994be2a8f85d62182903dffa8589983107f340a0b169b1c0776f122298

            SHA512

            e331437be434736a1b199e117637cd71bd80dfcf07627936fcdb21bf9ba1aaf1cad85ce87adba226cddca81832635049b2d3dc62ce346f390d2ef772f6152b26

          • C:\Users\Admin\AppData\Local\Packages\Muse.MuseHub_rb9pth70m6nz6\LocalCache\Logs\current.txt

            Filesize

            2KB

            MD5

            a72c6e099291cdc14504ee0a5cb6b2b6

            SHA1

            8e6aef74ed133fa39ff0ea0035c6b3afa838c28b

            SHA256

            6297dc41200d2b4f559aa1198bc5de693e4d928b2a138ee12f3d8f345a975628

            SHA512

            5ff55f504953e359738482530bd595ce507ac92d1edaf11f91b5d33a062402a8990f6beb36b6acda741afc7450372a481e4e14476d6f313d595eabcf1ac7e3f1

          • C:\Users\Admin\AppData\Local\Sentry\F06DF1C1F1EB87BFA0B2D8AF308E3E6076F8B9E5\.installation

            Filesize

            36B

            MD5

            0835522ae5b24bda57fc665081bc9fd2

            SHA1

            87f1ab4b2673cf3261e1b923acb6d389655e3a33

            SHA256

            4a6ab85df8649b70f7254fb0a80125eba0943d52832fd4dfa273be6989c62a07

            SHA512

            1d7905e189616f80442ce73c5a1470d2ba990d10dcb23d2f2bd175a30528e067923918e4cdf91726021533746ba5ef3d92675ae0d5a63d8fac58d1123c1c102b

          • C:\Users\Admin\AppData\Local\Temp\Muse Installer Temp\EXE_NETCORECHECK.EXE

            Filesize

            142KB

            MD5

            5f6469960e0016d44be090160b889077

            SHA1

            114b94c1401d039903e5e8b11cacbb737230365a

            SHA256

            cb5714eb1f8b3938233823f465173c45ccef73e5b0ee122391853a3f2a305294

            SHA512

            a3cacbab7a8a2b0a914b2eb6043f20e60761dbedfefa12fa5353d326370c087845a9eed2024675284449bbcbb8510da72b8832114f003dd2473b45357cf5c670

          • C:\Users\Admin\AppData\Local\Temp\Muse Installer Temp\Installer.log

            Filesize

            559B

            MD5

            ef6114626dc37e45d376e84d82f4a10f

            SHA1

            c90dfa53fe4c4cd4a4ef4f13fba8db4b330bd29d

            SHA256

            1d4971b4641db0d83c87a52f0cdab93ea443380cd24993bd73717552727c4060

            SHA512

            5beb5dd2cd6dca82d512f05997519490ed0dccde0b7f23e3111658222e6c41d497dfe44d6fc05bfd4af22b29f250b58ee434f6ddfab1d30a9a92e6f8b97b5626

          • C:\Users\Admin\AppData\Local\Temp\Muse Installer Temp\Installer.log

            Filesize

            1KB

            MD5

            f5a203dcc96b8f54bbb2152cf3302a46

            SHA1

            a575099fc4f6b3716cf593a360f41c5174c84c5c

            SHA256

            b98c03139ec2b15b4b42635aa4c038740131fc66c7b37e7d46ebe5d738ed9082

            SHA512

            69f43378cda722115da595c20b4999c9f730d00cd0244b8f7191376c6f65273f8f2e92f22e39a8563e934fcc928a7e9eb1cfcbbc073f02306e603d5f64eb46f7

          • C:\Users\Admin\AppData\Local\Temp\Muse Installer Temp\Installer.log

            Filesize

            1KB

            MD5

            f4fe8639c8ba4ce5133d5dca0479d4ea

            SHA1

            27e8449e36aa0c40d5c129533519cbecad6b4eab

            SHA256

            439f388c886b143f0b7243a711f06cc37b25d73fb49b79485f2ab9306b7f67ac

            SHA512

            631b86df39575be08a37d77cb0e6c6928e76d55887b6a67e8020bb0f0166d398af7e053e1c57044c7f2346c9d3d5cc14222a4542b05f1020beb16fa40f2af68d

          • C:\Users\Admin\AppData\Local\Temp\Muse Installer Temp\Installer.log

            Filesize

            257B

            MD5

            ed00d9c804daa3237e368f34fa5b3154

            SHA1

            1bde666b05f9bacf83fe015a448c21fbbbe21b3a

            SHA256

            656b96d4a217452006ce05eacc7924cdb85e5c02cc6f477c7f61ee6f54f11c0f

            SHA512

            1f438121e64faebaf53c284eb196c32406af3b3042f1994e62d55aa4d196a1299e136b71e71a83f37c6b958725db0995887a67f26ab46ee72b01948ed67f5d92

          • C:\Users\Admin\AppData\Local\Temp\Muse Installer Temp\Installer.log

            Filesize

            968B

            MD5

            12de328038248fe4930f2a2e20f1dcb0

            SHA1

            7c68c2c87874f6cfc052da66db2b57c68837e9c1

            SHA256

            5a3846a56740fae544f84fa3a04d653e6199e3cdef207a7b9ba1ac7e7a23d1e7

            SHA512

            fff01b460080484244a1d78fe9f58898253cce68d95723102531e7dcb7dea1f7eb33ede8e425fc82b0ed824810242e0aee0e22c34f7e719e5cdfe0e65cf8ca5f

          • C:\Users\Admin\AppData\Local\Temp\Muse Installer Temp\Installer.log

            Filesize

            1KB

            MD5

            655881baa9dc494085bf0a0310f5482f

            SHA1

            9cb90bb7e36c711fc4e518fa637e2665c501dc48

            SHA256

            1db368621ad32b96feff64e74849b828b5b428ec575e2492163aa9de347ca387

            SHA512

            4bf8ad60f61af3f4d0fd883f554c21ddfd02741611bea5a41c3063dddfca8703933c88d24d704aa2001ec088f17d182a4f255f3ccdb693bf74a24d021fb66235

          • C:\Users\Admin\AppData\Local\Temp\Muse Installer Temp\Installer.log

            Filesize

            1KB

            MD5

            6f1222308160bb4fc14d5fc9b858fb1e

            SHA1

            997c5b4f692b89aef97ca3c6f834952a5d4ee108

            SHA256

            4d2999a67e6fc88fcb30e450d6387b2e461a1c5c8114dfb361ce143a630b1837

            SHA512

            48d8ec99189e310c93f2d2a8de16ef934b79257b61bfb07cf2f4f88e9e1e6d914c62c624c84e92422a90995fb9ad1d31036be5ad486361e32be5c251c1df8c05

          • C:\Users\Admin\AppData\Local\Temp\Muse Installer Temp\Test240723109.runtimeconfig.json

            Filesize

            103B

            MD5

            380991dee5e299f9e92f52bef5f51bcc

            SHA1

            559087a08eaa6675266556fae8dce7a584a5e147

            SHA256

            9b16a2c1976c523435cd9898e2305019fa13abdd9924e4f99d82ad30beab56c2

            SHA512

            40c5064c99c6f8b6e8f6646fc25c8cd732ab09f65b96290392e029a76a629d0cf03d2d0e40d104727e7cc183c72279324b3d454e18c005df8ac69573a630c4ff

          • C:\Users\Admin\Muse Hub\Instruments\.instruments

            Filesize

            24KB

            MD5

            af2be5f2c3711886c60bb8d82d963f55

            SHA1

            e841688b000f0ecc68067420af6670c75be46dac

            SHA256

            c1238dcec12886072b71ccdb38aaeb04746c5e0664fbe79a7e520b29b65e27b0

            SHA512

            334d6c6ccaa0b3820bcc7d301c2505215e059accee994aef7bf9d3143724212db9d23753b36d5321bca4be12a91616b7242391c3e9348bbdff924401510425ee

          • C:\Users\Admin\Muse Hub\Instruments\.instruments

            Filesize

            24KB

            MD5

            add0560f93a4060a5557c3056a320de3

            SHA1

            2bf5f0f2cb20837ebdc4469e8a12bc6f96affc82

            SHA256

            1284b4ec2579e8e61f4a0c444db33ab1692e57644155c9066da88be370687d41

            SHA512

            e9f723ed466e0b6c8b5c0698957e105bf449fdee19b38291c2f574618ee2fb1da59a199bdb9f9189f6e3b9f8ecca3e3987cfd496cbb0bb00680917ab478e7f99

          • C:\Users\Admin\Muse Hub\Instruments\.instruments

            Filesize

            24KB

            MD5

            1ca041c15d5ca53a7513d3d284006b79

            SHA1

            d355bf9bcc7d56f33ba10a5cf0c569ad83bb4247

            SHA256

            fd898d51113de30fe5352cce009679e87e51d5a8213f85162f32a3cb7c423f58

            SHA512

            06c860457df4fb60991cb1f7761500cb8e7389895036c434b180073532427f565610cf65614d77fa4e49316a8076c0577451a5d30495f343b40db1bcb9c23ad7