URL:

http://v.jss.com.cn:80/nuoyan/setup/nuoyan_1.6.1.exe

Full analysis: https://app.any.run/tasks/2fcafc33-f826-42dc-bb1b-c93a2b9eb3e1
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: September 11, 2020, 07:20:50
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
adware
Indicators:
MD5:

D5A9E3EB36918E104D97AD21CF5A2D6E

SHA1:

5DBFFBE835041BE5A9553D1524973DD2AEE13E64

SHA256:

AF4B17423467055A2510D39CB1AEF1EB3E3ED706788CB13F81DCC2B4C28B0AB7

SSDEEP:

3:N1KILLdA9LSRAKd/nO4A:CILLdAoRAt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • nuoyan_1.6.1.exe (PID: 2656)
      • nuoyan_1.6.1.exe (PID: 1252)
      • Nuoaabaafded.exe (PID: 2364)
      • update_service.exe (PID: 3064)
      • DatabaseMigration.exe (PID: 2424)
      • nuoyan_1.6.1.exe (PID: 3360)
      • KernelSvc.exe (PID: 2416)
      • AisinoLaunchKit.exe (PID: 3488)
      • AisinoKitDaemonSvc.exe (PID: 1660)
      • resetFirewallRule.exe (PID: 1704)
      • Thumbnails.exe (PID: 3692)
      • mirrorDriverInstWrapper.exe (PID: 3896)
      • MirrInst32.exe (PID: 2576)
      • mirrorDriverInstWrapper.exe (PID: 2676)
      • ZS-nuonuo.exe (PID: 2396)
      • MirrInst32.exe (PID: 1132)
      • ZS-nuonuo.exe (PID: 480)
      • ZS-nuonuo.exe (PID: 672)
      • AisinoKitDaemonSvc.exe (PID: 1500)
      • KernelSvc.exe (PID: 972)
      • KernelSvc.exe (PID: 3496)
      • AisinoKitDaemonSvc.exe (PID: 3116)
      • DatabaseMigration.exe (PID: 4024)
      • Nuoaabaigjgi.exe (PID: 3244)
      • mirrorDriverInstWrapper.exe (PID: 1932)
      • AisinoKitDaemonSvc.exe (PID: 3276)
      • NuoYanLauncher.exe (PID: 3804)
      • KernelSvc.exe (PID: 576)
      • AisinoLaunchKit.exe (PID: 2228)
      • NuoYanLauncher.exe (PID: 2840)
      • nnlf_uploader.exe (PID: 3872)
      • nnHungMonitorUAC.exe (PID: 3392)
      • nnls_recorder.exe (PID: 440)
      • nnAsynLogAgent.exe (PID: 3364)
      • nn_plugin_update.exe (PID: 2508)
      • Thumbnails.exe (PID: 2900)
      • resetFirewallRule.exe (PID: 3916)
      • ReadTaxDisk.exe (PID: 3396)
      • ZS-nuonuo.exe (PID: 1968)
      • ZS-nuonuo.exe (PID: 3800)
      • ZS-nuonuo.exe (PID: 2908)
      • update_service.exe (PID: 2484)
      • ZS-nuonuo.exe (PID: 2208)
      • ZS-nuonuo.exe (PID: 3688)
      • ReadTaxDisk.exe (PID: 2844)
      • DeleteRegAppRestart.exe (PID: 3036)
      • ReadTaxDisk.exe (PID: 3976)
      • ReadTaxDisk.exe (PID: 2140)
      • ReadTaxDisk.exe (PID: 2156)
      • ReadTaxDisk.exe (PID: 2960)
      • ReadTaxDisk.exe (PID: 2460)
      • ReadTaxDisk.exe (PID: 2000)
      • ZS-nuonuo.exe (PID: 1940)
      • NNBrower.exe (PID: 3044)
      • ZS-nuonuo.exe (PID: 340)
      • mirrorDriverInstWrapper.exe (PID: 2112)
      • NNBrower.exe (PID: 2520)
      • NNBrower.exe (PID: 3500)
      • NNBrower.exe (PID: 3040)

    • Downloads executable files from the Internet

      • firefox.exe (PID: 3844)

    • Loads dropped or rewritten executable

      • nuoyan_1.6.1.exe (PID: 3360)
      • nuoyan_1.6.1.exe (PID: 2656)
      • ZS-nuonuo.exe (PID: 480)
      • ZS-nuonuo.exe (PID: 2396)
      • DatabaseMigration.exe (PID: 2424)
      • ZS-nuonuo.exe (PID: 2908)
      • ZS-nuonuo.exe (PID: 672)
      • Thumbnails.exe (PID: 3692)
      • regsvr32.exe (PID: 1876)
      • regsvr32.exe (PID: 3512)
      • nuoyan_1.7.2.11103.exe (PID: 3436)
      • nuoyan_1.7.2.11103.exe (PID: 1700)
      • DatabaseMigration.exe (PID: 4024)
      • ZS-nuonuo.exe (PID: 1968)
      • regsvr32.exe (PID: 3680)
      • ZS-nuonuo.exe (PID: 3688)
      • nn_plugin_update.exe (PID: 2508)
      • Thumbnails.exe (PID: 2900)
      • ZS-nuonuo.exe (PID: 2208)
      • nnAsynLogAgent.exe (PID: 3364)
      • regsvr32.exe (PID: 3824)
      • DeleteRegAppRestart.exe (PID: 3036)
      • nnlf_uploader.exe (PID: 3872)
      • NuoYanLauncher.exe (PID: 3804)
      • NuoYanLauncher.exe (PID: 2840)
      • ReadTaxDisk.exe (PID: 3396)
      • ReadTaxDisk.exe (PID: 2844)
      • nnls_recorder.exe (PID: 440)
      • ReadTaxDisk.exe (PID: 3976)
      • ReadTaxDisk.exe (PID: 2140)
      • ReadTaxDisk.exe (PID: 2156)
      • ReadTaxDisk.exe (PID: 2960)
      • ReadTaxDisk.exe (PID: 2460)
      • NNBrower.exe (PID: 2520)
      • ZS-nuonuo.exe (PID: 340)
      • NNBrower.exe (PID: 3044)
      • ZS-nuonuo.exe (PID: 3800)
      • NNBrower.exe (PID: 3040)
      • NNBrower.exe (PID: 3500)

    • Registers / Runs the DLL via REGSVR32.EXE

      • nuoyan_1.6.1.exe (PID: 3360)
      • nuoyan_1.7.2.11103.exe (PID: 1700)

    • Changes settings of System certificates

      • NNBrower.exe (PID: 3044)

  • SUSPICIOUS

    • Creates files in the program directory

      • firefox.exe (PID: 3844)
      • nuoyan_1.6.1.exe (PID: 2656)
      • nuoyan_1.6.1.exe (PID: 3360)
      • nuoyan_1.7.2.11103.exe (PID: 3436)
      • ZS-nuonuo.exe (PID: 3688)
      • nn_plugin_update.exe (PID: 2508)
      • nuoyan_1.7.2.11103.exe (PID: 1700)
      • NNBrower.exe (PID: 3044)

    • Executable content was dropped or overwritten

      • nuoyan_1.6.1.exe (PID: 2656)
      • firefox.exe (PID: 3844)
      • update_service.exe (PID: 3064)
      • nuoyan_1.6.1.exe (PID: 3360)
      • MirrInst32.exe (PID: 2576)
      • DrvInst.exe (PID: 2512)
      • DrvInst.exe (PID: 3816)
      • nuoyan_1.7.2.11103.exe (PID: 3436)
      • update_service.exe (PID: 2484)
      • nuoyan_1.7.2.11103.exe (PID: 1700)
      • nn_plugin_update.exe (PID: 2508)

    • Starts CMD.EXE for commands execution

      • nuoyan_1.6.1.exe (PID: 3360)
      • nuoyan_1.7.2.11103.exe (PID: 1700)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 3748)
      • cmd.exe (PID: 2844)
      • cmd.exe (PID: 2228)
      • cmd.exe (PID: 3688)
      • cmd.exe (PID: 2304)
      • cmd.exe (PID: 3680)

    • Creates files in the user directory

      • update_service.exe (PID: 3064)
      • update_service.exe (PID: 2484)

    • Loads Python modules

      • nuoyan_1.6.1.exe (PID: 3360)
      • nuoyan_1.7.2.11103.exe (PID: 1700)

    • Executed as Windows Service

      • Nuoaabaafded.exe (PID: 2364)
      • Nuoaabaigjgi.exe (PID: 3244)

    • Modifies the open verb of a shell class

      • nuoyan_1.6.1.exe (PID: 3360)
      • nuoyan_1.7.2.11103.exe (PID: 1700)

    • Creates COM task schedule object

      • regsvr32.exe (PID: 1876)
      • regsvr32.exe (PID: 3512)
      • regsvr32.exe (PID: 3680)
      • regsvr32.exe (PID: 3824)

    • Creates a software uninstall entry

      • nuoyan_1.6.1.exe (PID: 3360)
      • nuoyan_1.7.2.11103.exe (PID: 1700)

    • Executed via COM

      • DrvInst.exe (PID: 2512)
      • DrvInst.exe (PID: 3816)

    • Removes files from Windows directory

      • DrvInst.exe (PID: 2512)
      • DrvInst.exe (PID: 3816)

    • Creates files in the Windows directory

      • MirrInst32.exe (PID: 2576)
      • DrvInst.exe (PID: 2512)
      • DrvInst.exe (PID: 3816)

    • Creates files in the driver directory

      • DrvInst.exe (PID: 2512)
      • DrvInst.exe (PID: 3816)

    • Uses NETSH.EXE for network configuration

      • resetFirewallRule.exe (PID: 1704)
      • resetFirewallRule.exe (PID: 3916)

    • Reads Internet Cache Settings

      • nn_plugin_update.exe (PID: 2508)

    • Application launched itself

      • NNBrower.exe (PID: 3044)
      • NNBrower.exe (PID: 3500)

    • Adds / modifies Windows certificates

      • NNBrower.exe (PID: 3044)

  • INFO

    • Application launched itself

      • firefox.exe (PID: 1008)
      • firefox.exe (PID: 3844)

    • Creates files in the user directory

      • firefox.exe (PID: 3844)

    • Reads CPU info

      • firefox.exe (PID: 3844)

    • Reads Internet Cache Settings

      • firefox.exe (PID: 3844)

    • Reads settings of System Certificates

      • firefox.exe (PID: 3844)
      • NNBrower.exe (PID: 3044)

    • Adds / modifies Windows certificates

      • DrvInst.exe (PID: 2512)

    • Changes settings of System certificates

      • DrvInst.exe (PID: 2512)

    • Dropped object may contain Bitcoin addresses

      • nn_plugin_update.exe (PID: 2508)

    • Manual execution by user

      • ZS-nuonuo.exe (PID: 1940)
      • ZS-nuonuo.exe (PID: 340)

    • Reads the hosts file

      • NNBrower.exe (PID: 3500)
      • NNBrower.exe (PID: 3044)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
183
Monitored processes
105
Malicious processes
24
Suspicious processes
20

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe firefox.exe firefox.exe nuoyan_1.6.1.exe no specs nuoyan_1.6.1.exe nuoyan_1.6.1.exe cmd.exe no specs taskkill.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs taskkill.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs taskkill.exe no specs cmd.exe no specs wmic.exe no specs update_service.exe databasemigration.exe no specs nuoaabaafded.exe mirrordriverinstwrapper.exe zs-nuonuo.exe no specs zs-nuonuo.exe regsvr32.exe no specs regsvr32.exe no specs mirrinst32.exe thumbnails.exe no specs kernelsvc.exe no specs aisinokitdaemonsvc.exe no specs zs-nuonuo.exe no specs mirrordriverinstwrapper.exe drvinst.exe mirrinst32.exe no specs zs-nuonuo.exe resetfirewallrule.exe no specs aisinolaunchkit.exe netsh.exe no specs drvinst.exe netsh.exe no specs netsh.exe no specs netsh.exe no specs nuoyan_1.7.2.11103.exe nuoyan_1.7.2.11103.exe cmd.exe no specs taskkill.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs taskkill.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs taskkill.exe no specs cmd.exe no specs wmic.exe no specs update_service.exe kernelsvc.exe no specs kernelsvc.exe no specs aisinokitdaemonsvc.exe no specs aisinokitdaemonsvc.exe no specs databasemigration.exe no specs nuoaabaigjgi.exe zs-nuonuo.exe no specs mirrordriverinstwrapper.exe zs-nuonuo.exe regsvr32.exe no specs regsvr32.exe no specs thumbnails.exe no specs kernelsvc.exe no specs aisinokitdaemonsvc.exe no specs nuoyanlauncher.exe no specs mirrordriverinstwrapper.exe deleteregapprestart.exe no specs zs-nuonuo.exe no specs nuoyanlauncher.exe no specs zs-nuonuo.exe nnasynlogagent.exe aisinolaunchkit.exe resetfirewallrule.exe no specs nn_plugin_update.exe netsh.exe no specs nnhungmonitoruac.exe no specs nnls_recorder.exe no specs nnlf_uploader.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs readtaxdisk.exe no specs readtaxdisk.exe no specs readtaxdisk.exe no specs readtaxdisk.exe no specs readtaxdisk.exe no specs readtaxdisk.exe no specs readtaxdisk.exe no specs zs-nuonuo.exe no specs zs-nuonuo.exe readtaxdisk.exe no specs nnbrower.exe nnbrower.exe no specs nnbrower.exe nnbrower.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
340"C:\Program Files\NuoYan\bin\ZS-nuonuo.exe" C:\Program Files\NuoYan\bin\ZS-nuonuo.exe
explorer.exe
User:
admin
Company:
Nuonuo Technology Co.,Ltd.
Integrity Level:
HIGH
Description:
诺言
Exit code:
0
Version:
1.7.2.11103
Modules
Images
c:\program files\nuoyan\bin\zs-nuonuo.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\nuoyan\bin\utility.dll
c:\program files\nuoyan\bin\sqlite3.dll
c:\program files\nuoyan\bin\network.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
440"C:\Program Files\NuoYan\bin\nnls_recorder.exe" -check -workspace {5BC87959-F5BD-4543-A855-9CD41BD10714}/C:\Program Files\NuoYan\bin\nnls_recorder.exe—ZS-nuonuo.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
0.0.0.2
Modules
Images
c:\program files\nuoyan\bin\nnls_recorder.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
480"C:\Program Files\NuoYan\bin\ZS-nuonuo.exe" dellnk "C:\ProgramData\xSetup.work"C:\Program Files\NuoYan\bin\ZS-nuonuo.exe—nuoyan_1.6.1.exe
User:
admin
Company:
Nuonuo Technology Co.,Ltd.
Integrity Level:
HIGH
Description:
诺言
Exit code:
0
Version:
1.6.1.8545
Modules
Images
c:\program files\nuoyan\bin\zs-nuonuo.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\nuoyan\bin\utility.dll
c:\program files\nuoyan\bin\sqlite3.dll
c:\program files\nuoyan\bin\network.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
576"C:\Program Files\NuoYan\bin\KernelSvc.exe" install C:\Program Files\NuoYan\bin\KernelSvc.exe—nuoyan_1.7.2.11103.exe
User:
admin
Company:
Nuonuo Technology Co.,Ltd.
Integrity Level:
HIGH
Description:
Aisino Daemon Sevices
Exit code:
0
Version:
1.0.0.8
Modules
Images
c:\program files\nuoyan\bin\kernelsvc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
672"C:\Program Files\NuoYan\bin\ZS-nuonuo.exe" C:\Program Files\NuoYan\bin\ZS-nuonuo.exe
nuoyan_1.6.1.exe
User:
admin
Company:
Nuonuo Technology Co.,Ltd.
Integrity Level:
HIGH
Description:
诺言
Exit code:
0
Version:
1.6.1.8545
Modules
Images
c:\program files\nuoyan\bin\zs-nuonuo.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\nuoyan\bin\utility.dll
c:\program files\nuoyan\bin\sqlite3.dll
c:\program files\nuoyan\bin\network.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
972"C:\Program Files\NuoYan\bin\KernelSvc.exe" stopC:\Program Files\NuoYan\bin\KernelSvc.exe—nuoyan_1.7.2.11103.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\nuoyan\bin\kernelsvc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1000"cmd.exe" /c wmic process where name="zs-nuonuo.exe" call terminateC:\Windows\system32\cmd.exe—nuoyan_1.7.2.11103.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1008"C:\Program Files\Mozilla Firefox\firefox.exe" "http://v.jss.com.cn:80/nuoyan/setup/nuoyan_1.6.1.exe"C:\Program Files\Mozilla Firefox\firefox.exe—explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
1132"C:\Program Files\NuoYan\mirror_driver\m32\MirrInst32.exe" -i "dfmirage" "Mirage Driver" ".\m32\" ".\m32\dfmirage.inf"C:\Program Files\NuoYan\mirror_driver\m32\MirrInst32.exe—mirrorDriverInstWrapper.exe
User:
admin
Company:
DemoForge, LLC.
Integrity Level:
HIGH
Description:
DemoForge Mirror Driver Installer
Exit code:
2147782689
Version:
2.0 (build 113)
Modules
Images
c:\program files\nuoyan\mirror_driver\m32\mirrinst32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1244wmic process where name="CrashReporter.exe" call terminateC:\Windows\System32\Wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
Total events
2 430
Read events
1 754
Write events
665
Delete events
11

Modification events

(PID) Process:(3844) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Browser
Value:
1E32F92F00000000
(PID) Process:(1008) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Launcher
Value:
1032F92F00000000
(PID) Process:(3844) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Telemetry
Value:
1
(PID) Process:(3844) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3844) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000A3000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(3844) firefox.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3844) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3844) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3360) nuoyan_1.6.1.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager
Operation:writeName:PendingFileRenameOperations
Value:
\??\C:\Program Files\NuoYan\bin\ZS-nuonuo.exe.xdel
(PID) Process:(3064) update_service.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\NuoYan
Operation:writeName:update_service
Value:
C:
Executable files
230
Suspicious files
158
Text files
4 242
Unknown types
275

Dropped files

PID
Process
Filename
Type
3844firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
3844firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite-shm —
MD5:—
SHA256:—
3844firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js —
MD5:—
SHA256:—
3844firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.tmp —
MD5:—
SHA256:—
3844firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\search.json.mozlz4.tmp —
MD5:—
SHA256:—
3844firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\allow-flashallow-digest256.pset —
MD5:—
SHA256:—
3844firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\allow-flashallow-digest256.sbstore —
MD5:—
SHA256:—
3844firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\base-track-digest256.pset —
MD5:—
SHA256:—
3844firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\base-track-digest256.sbstore —
MD5:—
SHA256:—
3844firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\block-flash-digest256.pset —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
76
TCP/UDP connections
103
DNS requests
90
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
672
ZS-nuonuo.exe
HEAD
200
113.105.172.41:80
http://v.jss.com.cn/update/nuoyan_1.7.2.11103.exe
CN
—
—
malicious
3688
ZS-nuonuo.exe
GET
200
180.122.78.242:80
http://ms.jss.com.cn/nuoyan/apply/image/20170414105103400.png
CN
image
8.32 Kb
malicious
3244
Nuoaabaigjgi.exe
GET
200
202.91.251.58:80
http://update.jss.com.cn/interfaceCtr/getVersion.do?version=0.0.0.0&i_type=36
CN
text
296 b
suspicious
3688
ZS-nuonuo.exe
GET
200
180.122.78.242:80
http://ms.jss.com.cn/nuoyan/apply/image/f84d13afc9837a0ae247933dedd75771.png
CN
image
5.58 Kb
malicious
2508
nn_plugin_update.exe
GET
200
180.122.78.242:80
http://ms.jss.com.cn/mcef_v79.7z
CN
compressed
73.7 Mb
malicious
3844
firefox.exe
POST
200
172.217.21.195:80
http://ocsp.pki.goog/gts1o1core
US
der
472 b
whitelisted
3844
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3844
firefox.exe
GET
200
113.105.172.41:80
http://v.jss.com.cn/nuoyan/setup/nuoyan_1.6.1.exe
CN
executable
25.6 Mb
malicious
3688
ZS-nuonuo.exe
GET
200
180.122.78.242:80
http://ms.jss.com.cn/nuoyan/apply/image/20170301154452947.png
CN
image
20.2 Kb
malicious
3844
firefox.exe
POST
200
172.217.21.195:80
http://ocsp.pki.goog/gts1o1core
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3844
firefox.exe
143.204.215.53:443
content-signature-2.cdn.mozilla.net
—
US
suspicious
3844
firefox.exe
2.16.186.50:80
detectportal.firefox.com
Akamai International B.V.
—
whitelisted
3844
firefox.exe
113.105.172.41:80
v.jss.com.cn
CHINANET Guangdong province network
CN
suspicious
3844
firefox.exe
143.204.215.89:443
snippets.cdn.mozilla.net
—
US
malicious
3844
firefox.exe
143.204.215.95:443
firefox.settings.services.mozilla.com
—
US
suspicious
3844
firefox.exe
216.58.206.14:443
www.youtube.com
Google Inc.
US
whitelisted
3844
firefox.exe
143.204.215.77:443
tracking-protection.cdn.mozilla.net
—
US
unknown
2364
Nuoaabaafded.exe
202.91.251.58:80
update.jss.com.cn
No.288,Fu-chun Road
CN
suspicious
3844
firefox.exe
2.16.186.112:80
detectportal.firefox.com
Akamai International B.V.
—
whitelisted
2396
ZS-nuonuo.exe
202.91.251.58:443
update.jss.com.cn
No.288,Fu-chun Road
CN
suspicious

DNS requests

Domain
IP
Reputation
v.jss.com.cn
  • 113.105.172.41
malicious
detectportal.firefox.com
  • 2.16.186.50
  • 2.16.186.112
whitelisted
a1089.dscd.akamai.net
  • 2.16.186.112
  • 2.16.186.50
whitelisted
qiniustaticopencdn.jomodns.com
  • 113.105.172.41
suspicious
search.services.mozilla.com
  • 54.148.7.60
  • 35.161.199.137
  • 52.13.211.193
whitelisted
search.r53-2.services.mozilla.com
  • 52.13.211.193
  • 35.161.199.137
  • 54.148.7.60
whitelisted
push.services.mozilla.com
  • 100.20.6.188
whitelisted
autopush.prod.mozaws.net
  • 100.20.6.188
whitelisted
snippets.cdn.mozilla.net
  • 143.204.215.89
  • 143.204.215.65
  • 143.204.215.74
  • 143.204.215.54
whitelisted
d228z91au11ukj.cloudfront.net
  • 143.204.215.54
  • 143.204.215.74
  • 143.204.215.65
  • 143.204.215.89
whitelisted

Threats

PID
Process
Class
Message
3844
firefox.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3844
firefox.exe
Misc activity
ET INFO EXE - Served Inline HTTP
672
ZS-nuonuo.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
672
ZS-nuonuo.exe
Misc activity
ET INFO EXE - Served Inline HTTP
2508
nn_plugin_update.exe
Misc activity
ADWARE [PTsecurity] Funshion
Process
Message
nuoyan_1.6.1.exe
C:\Users\admin\Downloads\7z.dll
nuoyan_1.6.1.exe
C:\ProgramData\xSetup.work
nuoyan_1.6.1.exe
C:\ProgramData\xSetup.work\7z.dll
nuoyan_1.6.1.exe
C:\ProgramData\xSetup.work\xSetup.7z
nuoyan_1.6.1.exe
C:\ProgramData\xSetup.work
nuoyan_1.6.1.exe
scaling : 96.000000,96.000000
nuoyan_1.6.1.exe
set dpi zoom 0 : 1.000000,1.000000
mirrorDriverInstWrapper.exe
Standard VGA Graphics Adapter
mirrorDriverInstWrapper.exe
RDP Reflector Display Driver
mirrorDriverInstWrapper.exe
??1?????
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://v.jss.com.cn:80/nuoyan/setup/nuoyan_1.6.1.exe