0f9765f58fc4389dcd7541172a4454c0f646dbec174e828a64abc9aa19de4990

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-08-2024 16:15

Target

Muse_Hub.exe
Size

38.2MB
MD5

113b0b7cfcaf7b11d541d6860534ce2c
SHA1

443a0f24974652fd2d081b952061a5e0f386e71a
SHA256

0f9765f58fc4389dcd7541172a4454c0f646dbec174e828a64abc9aa19de4990
SHA512

78f09c46d202d73194f7c648effd03c250a20dc280e07bddb9380128c6077ce86d78da1ce22be1fcc14024a09aa35bd23f9288f1a650d66233b21ddaaa93c9e4
SSDEEP

786432:mt+ooIxXSZFxfPfRLtX630iml6R/YwsNnoPv7pAMVUZ4HG04Rgrk:mt+ooIJsxn1tq30iu6R/vsNnCVUZ4Hl4

Score

5^/10

Drops file in System32 directory 4 IoCs

Processes:

Muse.Service.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Muse.Service\Muse.Service_Url_zmbqaeottvmi12bkaynsf5cuhyatvbia\dly5qnil.tmp	Muse.Service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Muse.Service\Muse.Service_Url_zmbqaeottvmi12bkaynsf5cuhyatvbia\dly5qnil.newcfg	Muse.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\AppCenter\e6d4ff11-b338-417e-838f-aafad956034c\Logs.db	Muse.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\AppCenter\e6d4ff11-b338-417e-838f-aafad956034c\Logs.db-journal	Muse.Service.exe

Executes dropped EXE 1 IoCs

Processes:

EXE_NETCORECHECK.EXE

pid process

2076 EXE_NETCORECHECK.EXE

pid	process
2076	EXE_NETCORECHECK.EXE

Modifies data under HKEY_USERS 5 IoCs

Processes:

Muse.Service.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	Muse.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	Muse.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	Muse.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	Muse.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Muse.Service.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

Muse.Service.exe

pid process

4004 Muse.Service.exe
4004 Muse.Service.exe
4004 Muse.Service.exe
4004 Muse.Service.exe
4004 Muse.Service.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Muse.Service.exe

description pid process

Token: SeDebugPrivilege 4004 Muse.Service.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

Muse.exe

pid process

3376 Muse.exe
3376 Muse.exe
3376 Muse.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Muse.exe

pid process

3376 Muse.exe
3376 Muse.exe

description	pid	process
Token: SeDebugPrivilege	4004	Muse.Service.exe

pid	process
3376	Muse.exe
3376	Muse.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

Muse_Hub.exe

description	pid	process	target process
PID 4428 wrote to memory of 2076	4428	Muse_Hub.exe	EXE_NETCORECHECK.EXE
PID 4428 wrote to memory of 2076	4428	Muse_Hub.exe	EXE_NETCORECHECK.EXE

C:\Users\Admin\AppData\Local\Temp\Muse_Hub.exe
"C:\Users\Admin\AppData\Local\Temp\Muse_Hub.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4428
- C:\Users\Admin\AppData\Local\Temp\Muse Installer Temp\EXE_NETCORECHECK.EXE
  -N Microsoft.WindowsDesktop.App -v 6.0.9
  2⤵
  - Executes dropped EXE
  PID:2076

C:\Users\Admin\AppData\Local\Temp\Muse Installer Temp\EXE_NETCORECHECK.EXE

Filesize
142KB

MD5
3dd50757e38eed3ac598debec6936915

SHA1
ac54862b4de18850d111fe7e08a075f0e812cc89

SHA256
8d8f90ca3adc53d7862e82c72522674d4fee14d2b08566d378e46371d5db7f2a

SHA512
ff84fddf871f660b2b25e7f3b93ab01140d787a1fb167454cadad4e0eec25fd0789afee6bec3dea09de34343de7d3c4030e1282acddcda02e9f40784eb8aea88

Download Submit