Analysis

  • max time kernel
    23s
  • max time network
    17s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    18-06-2024 18:00

General

  • Target

    MasonRansomware.exe

  • Size

    3.1MB

  • MD5

    8063c8a8b55b8dbd2067b2e90710671e

  • SHA1

    a1cec045914096a3c6aa9e66c138f0fb7e4a212b

  • SHA256

    ca6e55ff3b1a7cc0ab11b25d532233fcbabaf5862556e7a37425d5ba76f535da

  • SHA512

    3ed6584d45712d068a5e4189d0fdee14826bb6ce5611e4c6e1fa0663c0eb1f1533ec6bea5bc5143af681cb3e3a2ce79e82299b484c82ed47b3cbe707c9f6efc0

  • SSDEEP

    49152:Kjb7tO0Nd5yWWxVlaroyeH5x7btSze5/v3EffISCFr39+N7UgHVy9FegT9MDQmu2:KjftO0gWWvYrozbP3qfIf+G6AFdeVN

Malware Config

Signatures

  • Detect Neshta payload 44 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Deletes itself 1 IoCs
  • Drops startup file 4 IoCs
  • Executes dropped EXE 9 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe
    "C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3240
    • C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe
      "C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe"
      2⤵
        PID:3716
      • C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe
        "C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe"
        2⤵
          PID:192
        • C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe
          "C:\Users\Admin\AppData\Local\Temp\MasonRansomware.exe"
          2⤵
          • Drops startup file
          • Suspicious use of WriteProcessMemory
          PID:3048
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe"
            3⤵
            • Executes dropped EXE
            • Modifies system executable filetype association
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:4628
            • C:\Users\Admin\AppData\Local\Temp\3582-490\ScreenLockApp.exe
              "C:\Users\Admin\AppData\Local\Temp\3582-490\ScreenLockApp.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3220
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Troll~Virus.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Troll~Virus.exe"
            3⤵
            • Drops startup file
            • Executes dropped EXE
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:4428
            • C:\Windows\svchost.com
              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE"
              4⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • Suspicious use of WriteProcessMemory
              PID:1248
              • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE
                C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.EXE
                5⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Drops file in Windows directory
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:3100
                • C:\Windows\svchost.com
                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\SCREEN~1.EXE"
                  6⤵
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • Suspicious use of WriteProcessMemory
                  PID:3600
                  • C:\Users\Admin\AppData\Local\Temp\3582-490\SCREEN~1.EXE
                    C:\Users\Admin\AppData\Local\Temp\3582-490\SCREEN~1.EXE
                    7⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5092
            • C:\Windows\svchost.com
              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe"
              4⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • Suspicious use of WriteProcessMemory
              PID:2544
              • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe
                C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe
                5⤵
                • Deletes itself
                • Executes dropped EXE
                • Drops desktop.ini file(s)
                • Enumerates connected drives
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:3024
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c wusa C:\Users\Admin\AppData\Local\Temp\64.cab /quiet /extract:C:\Windows\system32\migwiz\ & exit
                  6⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4764
                  • C:\Windows\system32\wusa.exe
                    wusa C:\Users\Admin\AppData\Local\Temp\64.cab /quiet /extract:C:\Windows\system32\migwiz\
                    7⤵
                      PID:2792
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\888.vbs"
                    6⤵
                      PID:5080

          Network

          MITRE ATT&CK Matrix ATT&CK v13

          Persistence

          Event Triggered Execution

          1
          T1546

          Change Default File Association

          1
          T1546.001

          Privilege Escalation

          Event Triggered Execution

          1
          T1546

          Change Default File Association

          1
          T1546.001

          Defense Evasion

          Modify Registry

          1
          T1112

          Credential Access

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Query Registry

          1
          T1012

          Peripheral Device Discovery

          1
          T1120

          System Information Discovery

          2
          T1082

          Collection

          Data from Local System

          1
          T1005

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE
            Filesize

            328KB

            MD5

            39c8a4c2c3984b64b701b85cb724533b

            SHA1

            c911f4c4070dfe9a35d9adcb7de6e6fb1482ce00

            SHA256

            888a1dd0033e5d758a4e731e3e55357de866e80d03b1b194375f714e1fd4351d

            SHA512

            f42ca2962fe60cff1a13dea8b81ff0647b317c785ee4f5159c38487c34d33aecba8478757047d31ab2ee893fbdcb91a21655353456ba6a018fc71b2278db4db2

          • C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
            Filesize

            86KB

            MD5

            3b73078a714bf61d1c19ebc3afc0e454

            SHA1

            9abeabd74613a2f533e2244c9ee6f967188e4e7e

            SHA256

            ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29

            SHA512

            75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4

          • C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE
            Filesize

            5.7MB

            MD5

            09acdc5bbec5a47e8ae47f4a348541e2

            SHA1

            658f64967b2a9372c1c0bdd59c6fb2a18301d891

            SHA256

            1b5c715d71384f043843ea1785a6873a9f39d2daae112ccdeffcd88b10a3a403

            SHA512

            3867bf98e1a0e253114a98b78b047b0d8282b5abf4aaf836f31cc0e26224e2a1b802c65df9d90dc7696a6dbcb9a8e4b900f1d1299e1b11e36f095ebaf8a2e5b8

          • C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe
            Filesize

            175KB

            MD5

            576410de51e63c3b5442540c8fdacbee

            SHA1

            8de673b679e0fee6e460cbf4f21ab728e41e0973

            SHA256

            3f00404dd591c2856e6f71bd78423ed47199902e0b85f228e6c4de72c59ddffe

            SHA512

            f7761f3878775b30cc3d756fa122e74548dfc0a27e38fa4109e34a59a009df333d074bf14a227549ae347605f271be47984c55148685faac479aeb481f7191db

          • C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe
            Filesize

            9.4MB

            MD5

            322302633e36360a24252f6291cdfc91

            SHA1

            238ed62353776c646957efefc0174c545c2afa3d

            SHA256

            31da9632f5d25806b77b617d48da52a14afc574bbe1653120f97705284ea566c

            SHA512

            5a1f7c44ce7f5036bffc18ebac39e2bf70e6f35fa252617d665b26448f4c4473adfa115467b7e2d9b7068823e448f74410cdcdfef1ac1c09021e051921787373

          • C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
            Filesize

            2.4MB

            MD5

            8ffc3bdf4a1903d9e28b99d1643fc9c7

            SHA1

            919ba8594db0ae245a8abd80f9f3698826fc6fe5

            SHA256

            8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6

            SHA512

            0b94ead97374d74eaee87e7614ddd3911d2cf66d4c49abbfd06b02c03e5dd56fd00993b4947e8a4bcd9d891fa39cab18cc6b61efc7d0812e91eb3aea9cd1a427

          • C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE
            Filesize

            183KB

            MD5

            9dfcdd1ab508b26917bb2461488d8605

            SHA1

            4ba6342bcf4942ade05fb12db83da89dc8c56a21

            SHA256

            ecd5e94da88c653e4c34b6ab325e0aca8824247b290336f75c410caa16381bc5

            SHA512

            1afc1b95f160333f1ff2fa14b3f22a28ae33850699c6b5498915a8b6bec1cfc40f33cb69583240aa9206bc2ea7ab14e05e071275b836502a92aa8c529fc1b137

          • C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe
            Filesize

            131KB

            MD5

            5791075058b526842f4601c46abd59f5

            SHA1

            b2748f7542e2eebcd0353c3720d92bbffad8678f

            SHA256

            5c3ef3ec7594c040146e908014791dd15201ba58b4d70032770bb661b6a0e394

            SHA512

            83e303971ed64019fde9e4ba6f6e889f8fb105088490dfa7dcf579a12baff20ef491f563d132d60c7b24a4fd3cac29bd9dc974571cd162000fae8fba4e0e54fb

          • C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE
            Filesize

            254KB

            MD5

            4ddc609ae13a777493f3eeda70a81d40

            SHA1

            8957c390f9b2c136d37190e32bccae3ae671c80a

            SHA256

            16d65f2463658a72dba205dcaa18bc3d0bab4453e726233d68bc176e69db0950

            SHA512

            9d7f90d1529cab20078c2690bf7bffab5a451a41d8993781effe807e619da0e7292f991da2f0c5c131b111d028b3e6084e5648c90816e74dfb664e7f78181bc5

          • C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE
            Filesize

            386KB

            MD5

            8c753d6448183dea5269445738486e01

            SHA1

            ebbbdc0022ca7487cd6294714cd3fbcb70923af9

            SHA256

            473eb551101caeaf2d18f811342e21de323c8dd19ed21011997716871defe997

            SHA512

            4f6fddefc42455540448eac0b693a4847e21b68467486376a4186776bfe137337733d3075b7b87ed7dac532478dc9afc63883607ec8205df3f155fee64c7a9be

          • C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE
            Filesize

            92KB

            MD5

            176436d406fd1aabebae353963b3ebcf

            SHA1

            9ffdfdb8cc832a0c6501c4c0e85b23a0f7eff57a

            SHA256

            2f947e3ca624ce7373080b4a3934e21644fb070a53feeaae442b15b849c2954f

            SHA512

            a2d1a714e0c1e5463260c64048ba8fd5064cfa06d4a43d02fc04a30748102ff5ba86d20a08e611e200dc778e2b7b3ae808da48132a05a61aa09ac424a182a06a

          • C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe
            Filesize

            125KB

            MD5

            cce8964848413b49f18a44da9cb0a79b

            SHA1

            0b7452100d400acebb1c1887542f322a92cbd7ae

            SHA256

            fe44ca8d5050932851aa54c23133277e66db939501af58e5aeb7b67ec1dde7b5

            SHA512

            bf8fc270229d46a083ced30da6637f3ca510b0ce44624a9b21ec6aacac81666dffd41855053a936aa9e8ea6e745a09b820b506ec7bf1173b6f1837828a35103d

          • C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE
            Filesize

            142KB

            MD5

            92dc0a5b61c98ac6ca3c9e09711e0a5d

            SHA1

            f809f50cfdfbc469561bced921d0bad343a0d7b4

            SHA256

            3e9da97a7106122245e77f13f3f3cc96c055d732ab841eb848d03ac25401c1bc

            SHA512

            d9eefb19f82e0786d9be0dbe5e339d25473fb3a09682f40c6d190d4c320cca5556abb72b5d97c6b0da4f8faefdc6d39ac9d0415fdf94ebcc90ecdf2e513c6a31

          • C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE
            Filesize

            278KB

            MD5

            12c29dd57aa69f45ddd2e47620e0a8d9

            SHA1

            ba297aa3fe237ca916257bc46370b360a2db2223

            SHA256

            22a585c183e27b3c732028ff193733c2f9d03700a0e95e65c556b0592c43d880

            SHA512

            255176cd1a88dfa2af3838769cc20dc7ad9d969344801f07b9ebb372c12cee3f47f2dba3559f391deab10650875cad245d9724acfa23a42b336bfa96559a5488

          • C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE
            Filesize

            454KB

            MD5

            bcd0f32f28d3c2ba8f53d1052d05252d

            SHA1

            c29b4591df930dabc1a4bd0fa2c0ad91500eafb2

            SHA256

            bb07d817b8b1b6b4c25e62b6120e51dec10118557d7b6b696ad084a5ba5bfdeb

            SHA512

            79f407735853f82f46870c52058ceee4d91857a89db14868ee1169abd5c0fd2e3fa1ed230ab90b5f479a9581b88998643d69b0df498defea29e73b0d487f3b10

          • C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe
            Filesize

            1.2MB

            MD5

            d47ed8961782d9e27f359447fa86c266

            SHA1

            d37d3f962c8d302b18ec468b4abe94f792f72a3b

            SHA256

            b1ec065f71cc40f400e006586d370997102860504fd643b235e8ed9f5607262a

            SHA512

            3e33f2cdf35024868b183449019de9278035e7966b342ba320a6c601b5629792cbb98a19850d4ca80b906c85d10e8503b0193794d1f1efa849fa33d26cff0669

          • C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe
            Filesize

            1.2MB

            MD5

            d1c48274711d83d4a1a0cfb2abdf8d31

            SHA1

            b4367dd7201ef0cc22d56613e428efda07da57a8

            SHA256

            ade1db79870327538841d5470483c6474083f08d871bb7d56cfc9e76971c8640

            SHA512

            7a3e7927b8be3dc1706e6511bf04475558da076696435f937c4eafa94111c378f3bcaa1ea4e5063e91e3e333c91f086a75baaff6c5cc190d3d314c5eee1687a3

          • C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe
            Filesize

            771KB

            MD5

            028aea45f143a63ba70146a4abe2ceeb

            SHA1

            c616258da4d8a7c9ff7dd5fff089d983d1553e09

            SHA256

            adc7b8fc26491206149496e2bceaf3686424274f444f14e2dd6fbf2ac7423ddf

            SHA512

            a266d0e2fd2676db41317622938cc03ff33c1904129d4ba0ef2d97a88313c882e719c8d4798c18a97ca64bc5ebdb90dd05290f25569e967966e2f5399f1f511d

          • C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe
            Filesize

            325KB

            MD5

            9a8d683f9f884ddd9160a5912ca06995

            SHA1

            98dc8682a0c44727ee039298665f5d95b057c854

            SHA256

            5e2e22ead49ce9cc11141dbeebbe5b93a530c966695d8efc2083f00e6be53423

            SHA512

            6aecf8c5cb5796d6879f8643e20c653f58bad70820896b0019c39623604d5b3c8a4420562ab051c6685edce60aa068d9c2dbb4413a7b16c6d01a9ac10dc22c12

          • C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe
            Filesize

            325KB

            MD5

            892cf4fc5398e07bf652c50ef2aa3b88

            SHA1

            c399e55756b23938057a0ecae597bd9dbe481866

            SHA256

            e2262c798729169f697e6c30e5211cde604fd8b14769311ff4ea81abba8c2781

            SHA512

            f16a9e4b1150098c5936ec6107c36d47246dafd5a43e9f4ad9a31ecab69cc789c768691fa23a1440fae7f6e93e8e62566b5c86f7ed6bb4cfe26368149ea8c167

          • C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe
            Filesize

            505KB

            MD5

            452c3ce70edba3c6e358fad9fb47eb4c

            SHA1

            d24ea3b642f385a666159ef4c39714bec2b08636

            SHA256

            da73b6e071788372702104b9c72b6697e84e7c75e248e964996700b77c6b6f1c

            SHA512

            fe8a0b9b1386d6931dc7b646d0dd99c3d1b44bd40698b33077e7eeba877b53e5cb39ff2aa0f6919ccab62953a674577bc1b2516d9cadc0c051009b2083a08085

          • C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE
            Filesize

            155KB

            MD5

            f7c714dbf8e08ca2ed1a2bfb8ca97668

            SHA1

            cc78bf232157f98b68b8d81327f9f826dabb18ab

            SHA256

            fc379fda348644fef660a3796861c122aa2dd5498e80279d1279a7ddb259e899

            SHA512

            28bc04c4df3f632865e68e83d045b3ecd2a263e62853c922b260d0734026e8a1541988fcbf4ddc9cf3aba6863214d6c6eb51f8bbb2586122a7cb01a70f08d16c

          • C:\PROGRA~2\Google\Update\DISABL~1.EXE
            Filesize

            207KB

            MD5

            3b0e91f9bb6c1f38f7b058c91300e582

            SHA1

            6e2e650941b1a96bb0bb19ff26a5d304bb09df5f

            SHA256

            57c993cadf4bf84810cea23a7112c6e260624beaab48d0e4332d3462900fec1d

            SHA512

            a4fbe28a0135f4632e0a5b6bd775f8d010250b0fbfe223db1fe81d18552a6bc166ebce807853ba02e6a476e9829454805e415ca828a5e043bd1e63dc53599d0f

          • C:\PROGRA~2\MOZILL~1\UNINST~1.EXE
            Filesize

            181KB

            MD5

            a471aeae6a5ecdbdf978d076551228ad

            SHA1

            7ae57187319530e84371cefac2271db349431f4e

            SHA256

            d621284d9f534a8dfb275e2c8d1cd39bb46c025ec687e48e053309e633195944

            SHA512

            f9840c8f6bdadbf1da8ee7f1806902f7ab37b6d0d531fdb922f409e96a407bc2017541848f5cb9645201a252640d97024c57f5b2b3f6a57dc1bff30874b368a5

          • C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe
            Filesize

            534KB

            MD5

            051978153bcd2b1cf032fa1bf5a82020

            SHA1

            ec6d1d42905a1c92ccee5f4980898d7a1d72aa23

            SHA256

            88e90f04db57a472acacf1f4e7616d05a488fc7a1b41a468b357ac4419489940

            SHA512

            68dec8a12b2c10a9ff83907705c68c77284928d9349a8ba93808d09123752b84944505208d7d71540e340dcbb06e74c79fa24748098308eeecab5f80ab4e8d15

          • C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE
            Filesize

            525KB

            MD5

            0d9146d70ac6a41ead1ea2d50d729508

            SHA1

            b9e6ff83a26aaf105640f5d5cdab213c989dc370

            SHA256

            0b876ddeefd88d5e98de7e409c5b6546ba8ffa195c168f9a4b6ba33b44d437ab

            SHA512

            c9394decfd469bfedd883095d604e11208aa290334ff5c0dce852f2ca74fba27c37ba2984dab8b27430e573681e22c9f903e53b01510a4b77d337cbd92c56cb3

          • C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE
            Filesize

            536KB

            MD5

            8e7b72380cc9ee9bf35c0de5fde4ab3a

            SHA1

            c19151c331ab274bbf5f6792ca707eb8a7017dba

            SHA256

            d82ca304cf64be3922b12111c962e09a6ddb2b8477e25b6c3f0400eddc38c80b

            SHA512

            acff1c08f9c8443d0b0589f5a7d7cab532462788406feba64825fdd2addf5b6cc8e773713e93c98991afbc7e364233fe7cf0659574cebe2200f8f7f818bfe927

          • C:\Users\ALLUSE~1\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE
            Filesize

            6.7MB

            MD5

            63dc05e27a0b43bf25f151751b481b8c

            SHA1

            b20321483dac62bce0aa0cef1d193d247747e189

            SHA256

            7d607fb69c69a72a5bf4305599279f46318312ce1082b6a34ac9100b8c7762ce

            SHA512

            374d705704d456cc5f9f79b7f465f6ec7c775dc43001c840e9d6efbbdef20926ed1fa97f8a9b1e73161e17f72520b96c05fa58ac86b3945208b405f9166e7ba3

          • C:\Users\ALLUSE~1\PACKAG~1\{33D1F~1\VCREDI~1.EXE
            Filesize

            485KB

            MD5

            86749cd13537a694795be5d87ef7106d

            SHA1

            538030845680a8be8219618daee29e368dc1e06c

            SHA256

            8c35dcc975a5c7c687686a3970306452476d17a89787bc5bd3bf21b9de0d36a5

            SHA512

            7b6ae20515fb6b13701df422cbb0844d26c8a98087b2758427781f0bf11eb9ec5da029096e42960bf99ddd3d4f817db6e29ac172039110df6ea92547d331db4c

          • C:\Users\ALLUSE~1\PACKAG~1\{4D8DC~1\VC_RED~1.EXE
            Filesize

            674KB

            MD5

            97510a7d9bf0811a6ea89fad85a9f3f3

            SHA1

            2ac0c49b66a92789be65580a38ae9798237711db

            SHA256

            c48abbc29405559e68cc9f8fc6d218aa317a9d0023839c7846ca509c1f563fea

            SHA512

            2a93e2a3bd187fdde160f87ef777ccd1d1c398d547b7c869e6b64469b9418ad04d887cdfe94af7407476377bf2d009f576de3935c025b7aefbab26fbcd8f90fb

          • C:\Users\ALLUSE~1\PACKAG~1\{57A73~1\VC_RED~1.EXE
            Filesize

            715KB

            MD5

            06366e48936df8d5556435c9820e9990

            SHA1

            0e3ed1da26a0c96f549720684e87352f1b58ef45

            SHA256

            cd47cce50016890899413b2c3609b3b49cb1b65a4dfcaa34ece5a16d8e8f6612

            SHA512

            bea7342a6703771cb9b11cd164e9972eb981c33dcfe3e628b139f9e45cf1e24ded1c55fcdfa0697bf48772a3359a9ddd29e4bb33c796c94727afd1c4d5589ea3

          • C:\Users\ALLUSE~1\PACKAG~1\{61087~1\VCREDI~1.EXE
            Filesize

            495KB

            MD5

            9597098cfbc45fae685d9480d135ed13

            SHA1

            84401f03a7942a7e4fcd26e4414b227edd9b0f09

            SHA256

            45966655baaed42df92cd6d8094b4172c0e7a0320528b59cf63fca7c25d66e9c

            SHA512

            16afbdffe4b4b2e54b4cc96fe74e49ca367dea50752321ddf334756519812ba8ce147ef5459e421dc42e103bc3456aab1d185588cc86b35fa2315ac86b2a0164

          • C:\Users\Admin\AppData\Local\Lock.Adobe
            Filesize

            8B

            MD5

            de6fdff1993c731e52e49d52a6e684d9

            SHA1

            120d1ff8a24109eed24ac1a5697383d50bcc0f47

            SHA256

            645c2d0cb9f6edf276f7dead9ab8c72531cdae22f54962d174c1339c30cb1b42

            SHA512

            99d05bf76a3a7466ccf27ac304ba35639716089d8dae388aaa707bfb6feb3f362251a65951663dd86abcac5a5e7358a5f29faedfe4c0b55ae136ba9d8f1209c1

          • C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\181510~1.001\FILESY~1.EXE
            Filesize

            293KB

            MD5

            f3228c24035b3f54f78bb4fd11c36aeb

            SHA1

            2fe73d1f64575bc4abf1d47a9dddfe7e2d9c9cbb

            SHA256

            d2767c9c52835f19f6695c604081bf03cdd772a3731cd2e320d9db5e477d8af7

            SHA512

            b526c63338d9167060bc40ffa1d13a8c2e871f46680cd4a0efc2333d9f15bf21ae75af45f8932de857678c5bf785011a28862ce7879f4bffdb9753c8bc2c19b5

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Troll~Virus.exe.log
            Filesize

            654B

            MD5

            16c5fce5f7230eea11598ec11ed42862

            SHA1

            75392d4824706090f5e8907eee1059349c927600

            SHA256

            87ba77c13905298acbac72be90949c4fe0755b6eff9777615aa37f252515f151

            SHA512

            153edd6da59beea6cc411ed7383c32916425d6ebb65f04c65aab7c1d6b25443d143aa8449aa92149de0ad8a975f6ecaa60f9f7574536eec6b38fe5fd3a6c6adc

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MasonRansomware.exe.log
            Filesize

            617B

            MD5

            4b1382f82cb506f36d30c01d5d515bca

            SHA1

            621aeafd1d115a27c71dd58c6211716c9640aba6

            SHA256

            d01a9a6d2f90166ffccd93ebf12c3ba6dd2ab12a9c047a6449d5968cc92d4200

            SHA512

            8700fd86011f3af3467ccb6c6d6c56f4004aada7a82186047dbba1cb01c3a2344213ecb1f1c67f3e20d269a79b0e61238b043a363047b050eecbd84bba4e65a5

          • C:\Users\Admin\AppData\Local\Temp\3582-490\ScreenLockApp.exe
            Filesize

            1.1MB

            MD5

            ef7a9bd97bec8a6070b2b99053d54ab1

            SHA1

            2ab06b299df7896555220b5fc5f8924a8fc901a5

            SHA256

            50814f4e49e5150e41fc9a3e4bd3145b27043d23f5d72780cdfa956df00ba8da

            SHA512

            1c0b3f06317ca0916a102eb374207d9ff2f9ba2e14f855e9296d104ed4ccaf7f119ab44c43f492ab36269b3e1fa3f81c19cb0f661ca33bf2e1a2a400d4d989d3

          • C:\Users\Admin\AppData\Local\Temp\64.cab
            Filesize

            49KB

            MD5

            8cfa6b4acd035a2651291a2a4623b1c7

            SHA1

            43571537bf2ce9f8e8089fadcbf876eaf4cf3ae9

            SHA256

            6e438201a14a70980048d2377c2195608d5dc2cf915f489c0a59ac0627c98fa9

            SHA512

            e0a73401ce74c8db69964ef5a53f2a1b8caf8c739359785970295dae82619e81c0a21466327a023cf4009e0c15981a20bf1e18c73821083908fce722faa82685

          • C:\Users\Admin\AppData\Local\Temp\888.vbs
            Filesize

            280B

            MD5

            8be57121a3ecae9c90cce4adf00f2454

            SHA1

            aca585c1b6409bc2475f011a436b319e42b356d8

            SHA256

            35d7204f9582b63b47942a4df9a55b8825b6d0af295b641f6257c39f7dda5f5e

            SHA512

            85521f6cd62dd5bb848933a188a9ddb83dd7ae2c5f4a97b65ba7785c3d58dba27694c7df308f4cf0fdaaa8c55251ff14ed1632e315a16d8d0b15217bac381f72

          • C:\Users\Admin\AppData\Local\Temp\aut85CA.tmp
            Filesize

            47KB

            MD5

            9dda4db9e90ff039ad5a58785b9d626d

            SHA1

            507730d87b32541886ec1dd77f3459fa7bf1e973

            SHA256

            fc31b205d5e4f32fa0c71c8f72ee06b92a28bd8690f71ab8f94ff401af2228fe

            SHA512

            4cfecaaccd0f8f9e31690ff80cca83edc962e73861043fffded1a3847201455d5adca7c5ef3866c65e6e516205e67b2f31c8149aad5be1065c1eb586b013f86a

          • C:\Users\Admin\AppData\Local\Temp\tmp5023.tmp
            Filesize

            8B

            MD5

            1edc9dd1160c5231fb708e5af18e982d

            SHA1

            98cefa73fe7c9f8957a73bbad0c760d8167de41c

            SHA256

            6445be188ada983da0b1428538cde668744a6a7e5774b7cdeb1d9ea05e465310

            SHA512

            0b78a4a20b7e27d3607ad12df8daa531061d1ef5628a89f02a5073b421af917d785a9e33ee159ba02a72441a3b61662875543d847bba79bd605ca6c831b132cb

          • C:\Users\Admin\AppData\Local\Temp\wl.jpg
            Filesize

            22KB

            MD5

            bde674be75317ab178ce59d133a4d507

            SHA1

            996b9b0a0f4bf8234ee95df5beb58614e1b85c67

            SHA256

            d0bd2c6f0161d2d45473206777634be8a79907cfd5fc45cf6433edc5280ebe63

            SHA512

            846d133b57254d77b835361ec506a5e99d24ae631f1a0f3ad0c21147629f5c378a2f13e4bbc1f5ca468b9a27f7faf04c055b52edce7bd634a00cc92577e03894

          • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VWYQFE.exe
            Filesize

            741KB

            MD5

            80041f5a17c53028f8603321de845061

            SHA1

            33a25cbd6cabca83c78b6f0e668f64d5a096f29b

            SHA256

            0370fe07f7a6150a7d7acdbd9776a3c0be85620ea00bf625701db6cf02f458df

            SHA512

            9ea6a75518490e6ffee822b69447c9af9beeacc68aec271990cb0561f02766e9c367e12305ada485f4a0359368ec269542c630f52301292c401f114008524dea

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenLockApp.exe
            Filesize

            1.1MB

            MD5

            f70eeb19a96e3ee21b289e86ac97700c

            SHA1

            3b99ffb7ac3dcc18bae898f379f869128d31a03b

            SHA256

            82e0a977f2d2454ddb0fbaa8cc3ffd103eb4be453d2d1a176751e4e3b1ee93ff

            SHA512

            8d4d3efb42901f59d26835f4c903155bd49f7176aa209d7f4a2714fc2f76b1ec2c91ce58a34e46500b757e3fb068cab854557ea88c1b400475b0974bcd6f4915

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Troll~Virus.exe
            Filesize

            1.9MB

            MD5

            0a38ff490ed8cf0cba13acf59f6d054e

            SHA1

            884cf0894711f44556312441f71c508e3f2f7fa1

            SHA256

            2ae2797f7f6543788cc7fd1ca7a89a17a9cddfd28af3f13515c8e521126e93c3

            SHA512

            bdd476f5509d758ac5518d0309e213fb5005ced349e452f4fe185b643264d84771be70d4901eeffc1c335ee584e0329bb7edee162372b8214b2d3d58036d4611

          • C:\Windows\directx.sys
            Filesize

            86B

            MD5

            71ede13495b64d16ac7f8ba80c706649

            SHA1

            7a34d38eb63cdcdc24f895872b88a7187c37f8a2

            SHA256

            a054103a808dfddb9cd8231ff4f57b562ffec811aa412ac6373c221572d87d99

            SHA512

            6cec814a8ab9026783d6a68fa5abd2a9588ea1de9cbf14f684171a6e221b0bb55c3beb3008ebb92cb3eaf4a5a1b705f889dd7bcad7ef6e7eaaa5c18cd6c381e8

          • C:\Windows\directx.sys
            Filesize

            143B

            MD5

            8deccdae5aeaeb8494b8d12cb8281a50

            SHA1

            fdd88ad4ea5451418254bcf09cc72a3f37d5834b

            SHA256

            26ee5649a2999b4e313476e1f5b48932bd8daf3e7869b8324d39c52be28b36a6

            SHA512

            9365b6a06c1e3662eee6a608cd28445cc21a47ee25ed7de761a01d472c079248a174f0bf982af89388b80e37a95cd56663dccf93eb0a5973ff7e171a388affb6

          • C:\Windows\svchost.com
            Filesize

            40KB

            MD5

            8c82da886615880591097012f5c495e1

            SHA1

            e967cbe5bb33fb4ceb302a079e707e12d6ed013c

            SHA256

            6e8e9e3190510366c4f76ce47911d9c91e56741c282ffd897bfb9ca32e4aa9c6

            SHA512

            418c0a2aa43c4001ae913ac225596d6fd6c6e39361d15d602152517805a0e6421ca10d87ad582136e11b290aa3627ddb9032fe00f0041720e8d6105f0b93c54a

          • memory/1248-353-0x0000000000400000-0x000000000041B000-memory.dmp
            Filesize

            108KB

          • memory/1248-246-0x0000000000400000-0x000000000041B000-memory.dmp
            Filesize

            108KB

          • memory/2544-107-0x0000000000400000-0x000000000041B000-memory.dmp
            Filesize

            108KB

          • memory/3048-10-0x0000000073A90000-0x000000007417E000-memory.dmp
            Filesize

            6.9MB

          • memory/3048-6-0x0000000000400000-0x0000000000722000-memory.dmp
            Filesize

            3.1MB

          • memory/3048-22-0x0000000073A90000-0x000000007417E000-memory.dmp
            Filesize

            6.9MB

          • memory/3100-247-0x0000000000400000-0x000000000041B000-memory.dmp
            Filesize

            108KB

          • memory/3100-352-0x0000000000400000-0x000000000041B000-memory.dmp
            Filesize

            108KB

          • memory/3220-29-0x0000000000620000-0x000000000073E000-memory.dmp
            Filesize

            1.1MB

          • memory/3220-30-0x0000000004FC0000-0x0000000005052000-memory.dmp
            Filesize

            584KB

          • memory/3220-31-0x0000000004F90000-0x0000000004F9A000-memory.dmp
            Filesize

            40KB

          • memory/3240-3-0x0000000002DF0000-0x0000000002DFA000-memory.dmp
            Filesize

            40KB

          • memory/3240-0-0x0000000073A9E000-0x0000000073A9F000-memory.dmp
            Filesize

            4KB

          • memory/3240-1-0x00000000008D0000-0x0000000000BFA000-memory.dmp
            Filesize

            3.2MB

          • memory/3240-2-0x0000000005480000-0x000000000551C000-memory.dmp
            Filesize

            624KB

          • memory/3240-4-0x0000000073A90000-0x000000007417E000-memory.dmp
            Filesize

            6.9MB

          • memory/3240-5-0x0000000005AB0000-0x0000000005FAE000-memory.dmp
            Filesize

            5.0MB

          • memory/3240-9-0x0000000073A90000-0x000000007417E000-memory.dmp
            Filesize

            6.9MB

          • memory/3600-106-0x0000000000400000-0x000000000041B000-memory.dmp
            Filesize

            108KB

          • memory/4428-23-0x0000000000400000-0x00000000005F6000-memory.dmp
            Filesize

            2.0MB

          • memory/4628-238-0x0000000000400000-0x000000000041B000-memory.dmp
            Filesize

            108KB

          • memory/4628-340-0x0000000000400000-0x000000000041B000-memory.dmp
            Filesize

            108KB

          • memory/4628-350-0x0000000000400000-0x000000000041B000-memory.dmp
            Filesize

            108KB