Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
02/03/2025, 18:21
Behavioral task
behavioral1
Sample
MasonRootkit.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
MasonRootkit.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
26 signatures
150 seconds
General
-
Target
MasonRootkit.exe
-
Size
231KB
-
MD5
265b52aa4d100784d7cd39258d5e4d21
-
SHA1
5b708da62d55364477ffb77e7feb4193f4635f92
-
SHA256
9d08e5e62b409ef1ccd05c7996eb5432e4a36f55642cb7441d153909e823f144
-
SHA512
4ce9e2c41b65ce3c108765dcd934e0f2a12f6c9640cb2ae547997b26a66da1d515ea7bfeb9cc529a57fbd41f51d61068ca7b9f551119e1403ff0cf1b5684e661
-
SSDEEP
3072:AvNYkHFE9jZOjT4LD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQigS:srE9Z/5bTgVziHzZnSKrCbYMJZbe8tq
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
217.136.29.82:50007
Attributes
-
install_file
Mason.exe
aes.plain
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral2/memory/464-1-0x000001E304170000-0x000001E3041B0000-memory.dmp family_xworm behavioral2/memory/464-437-0x000001E305FF0000-0x000001E305FFE000-memory.dmp family_xworm -
Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
description pid Process procid_target PID 2344 created 616 2344 WerFault.exe 5 PID 3060 created 316 3060 WerFault.exe 13 -
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
description pid Process procid_target PID 4604 created 616 4604 svchost.exe 5 PID 4604 created 316 4604 svchost.exe 13 -
Xworm family
-
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DoSvc\ImagePath = "C:\\Windows\\System32\\svchost.exe -k NetworkService -p" WaaSMedicAgent.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion wmiprvse.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Control Panel\International\Geo\Nation MasonRootkit.exe -
Executes dropped EXE 1 IoCs
pid Process 4064 jg31n4im.3ek.exe -
Indicator Removal: Clear Windows Event Logs 1 TTPs 2 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
description ioc Process File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx svchost.exe File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx svchost.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: svchost.exe File opened (read-only) \??\I: svchost.exe File opened (read-only) \??\T: svchost.exe File opened (read-only) \??\U: svchost.exe File opened (read-only) \??\V: svchost.exe File opened (read-only) \??\W: svchost.exe File opened (read-only) \??\X: svchost.exe File opened (read-only) \??\A: svchost.exe File opened (read-only) \??\E: svchost.exe File opened (read-only) \??\R: svchost.exe File opened (read-only) \??\Q: svchost.exe File opened (read-only) \??\H: svchost.exe File opened (read-only) \??\J: svchost.exe File opened (read-only) \??\K: svchost.exe File opened (read-only) \??\L: svchost.exe File opened (read-only) \??\M: svchost.exe File opened (read-only) \??\N: svchost.exe File opened (read-only) \??\O: svchost.exe File opened (read-only) \??\B: svchost.exe File opened (read-only) \??\G: svchost.exe File opened (read-only) \??\S: svchost.exe File opened (read-only) \??\Y: svchost.exe File opened (read-only) \??\Z: svchost.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PHYSICALDRIVE0 wmiprvse.exe -
Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 svchost.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml OfficeClickToRun.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan svchost.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work svchost.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 svchost.exe -
Drops file in Windows directory 7 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File created C:\Windows\Logs\CBS\CBS.log TrustedInstaller.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TrustedInstaller.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc wmiprvse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs wmiprvse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000\LogConf wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Mfg wmiprvse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000\LogConf wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Mfg wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID wmiprvse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc wmiprvse.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe -
Enumerates system info in registry 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier wmiprvse.exe -
Modifies data under HKEY_USERS 57 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,41484365,17110988,7153487,39965824,17962391,508368333,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1740939760" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,1329 15,1329 100,1329 6" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ExtendedProperties\LID = "001880114E5EAA36" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={63D3B8A5-6753-4C4F-BE50-866852B14068}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Sun, 02 Mar 2025 18:22:40 GMT" OfficeClickToRun.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe OfficeClickToRun.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4372 SCHTASKS.exe 2812 SCHTASKS.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 3512 WerFault.exe 3512 WerFault.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 2264 WerFault.exe 2264 WerFault.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4604 svchost.exe 4604 svchost.exe 4604 svchost.exe 4604 svchost.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe 4064 jg31n4im.3ek.exe -
Suspicious behavior: LoadsDriver 64 IoCs
pid Process 1772 Process not Found 3164 Process not Found 2000 Process not Found 2596 Process not Found 4872 Process not Found 916 Process not Found 1128 Process not Found 1132 Process not Found 1188 Process not Found 1388 Process not Found 2420 Process not Found 1400 Process not Found 3948 Process not Found 684 Process not Found 3480 Process not Found 3044 Process not Found 3176 Process not Found 3840 Process not Found 4892 Process not Found 1536 Process not Found 456 Process not Found 2880 Process not Found 3088 Process not Found 4176 Process not Found 2264 Process not Found 2500 Process not Found 1716 Process not Found 5072 Process not Found 4056 Process not Found 208 Process not Found 4720 Process not Found 1596 Process not Found 2328 Process not Found 4584 Process not Found 4424 Process not Found 1496 Process not Found 4972 Process not Found 3352 Process not Found 4544 Process not Found 3588 Process not Found 4792 Process not Found 4576 Process not Found 2184 Process not Found 3212 Process not Found 1668 Process not Found 1000 Process not Found 1968 Process not Found 1924 Process not Found 3008 Process not Found 4864 Process not Found 3668 Process not Found 4464 Process not Found 4436 Process not Found 4440 Process not Found 1768 Process not Found 2136 Process not Found 2924 Process not Found 4224 Process not Found 4580 Process not Found 4168 Process not Found 2660 Process not Found 2872 Process not Found 4072 Process not Found 4060 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 464 MasonRootkit.exe Token: SeDebugPrivilege 4064 jg31n4im.3ek.exe Token: SeShutdownPrivilege 3384 Explorer.EXE Token: SeCreatePagefilePrivilege 3384 Explorer.EXE Token: SeShutdownPrivilege 3384 Explorer.EXE Token: SeCreatePagefilePrivilege 3384 Explorer.EXE Token: SeAuditPrivilege 2748 svchost.exe Token: SeShutdownPrivilege 3384 Explorer.EXE Token: SeCreatePagefilePrivilege 3384 Explorer.EXE Token: SeShutdownPrivilege 3384 Explorer.EXE Token: SeCreatePagefilePrivilege 3384 Explorer.EXE Token: SeShutdownPrivilege 3384 Explorer.EXE Token: SeCreatePagefilePrivilege 3384 Explorer.EXE Token: SeShutdownPrivilege 3384 Explorer.EXE Token: SeCreatePagefilePrivilege 3384 Explorer.EXE Token: SeShutdownPrivilege 3384 Explorer.EXE Token: SeCreatePagefilePrivilege 3384 Explorer.EXE Token: SeShutdownPrivilege 4428 svchost.exe Token: SeCreatePagefilePrivilege 4428 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1580 svchost.exe Token: SeIncreaseQuotaPrivilege 1580 svchost.exe Token: SeSecurityPrivilege 1580 svchost.exe Token: SeTakeOwnershipPrivilege 1580 svchost.exe Token: SeLoadDriverPrivilege 1580 svchost.exe Token: SeBackupPrivilege 1580 svchost.exe Token: SeRestorePrivilege 1580 svchost.exe Token: SeShutdownPrivilege 1580 svchost.exe Token: SeSystemEnvironmentPrivilege 1580 svchost.exe Token: SeManageVolumePrivilege 1580 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1580 svchost.exe Token: SeIncreaseQuotaPrivilege 1580 svchost.exe Token: SeSecurityPrivilege 1580 svchost.exe Token: SeTakeOwnershipPrivilege 1580 svchost.exe Token: SeLoadDriverPrivilege 1580 svchost.exe Token: SeSystemtimePrivilege 1580 svchost.exe Token: SeBackupPrivilege 1580 svchost.exe Token: SeRestorePrivilege 1580 svchost.exe Token: SeShutdownPrivilege 1580 svchost.exe Token: SeSystemEnvironmentPrivilege 1580 svchost.exe Token: SeUndockPrivilege 1580 svchost.exe Token: SeManageVolumePrivilege 1580 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1580 svchost.exe Token: SeIncreaseQuotaPrivilege 1580 svchost.exe Token: SeSecurityPrivilege 1580 svchost.exe Token: SeTakeOwnershipPrivilege 1580 svchost.exe Token: SeLoadDriverPrivilege 1580 svchost.exe Token: SeSystemtimePrivilege 1580 svchost.exe Token: SeBackupPrivilege 1580 svchost.exe Token: SeRestorePrivilege 1580 svchost.exe Token: SeShutdownPrivilege 1580 svchost.exe Token: SeSystemEnvironmentPrivilege 1580 svchost.exe Token: SeUndockPrivilege 1580 svchost.exe Token: SeManageVolumePrivilege 1580 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1580 svchost.exe Token: SeIncreaseQuotaPrivilege 1580 svchost.exe Token: SeSecurityPrivilege 1580 svchost.exe Token: SeTakeOwnershipPrivilege 1580 svchost.exe Token: SeLoadDriverPrivilege 1580 svchost.exe Token: SeSystemtimePrivilege 1580 svchost.exe Token: SeBackupPrivilege 1580 svchost.exe Token: SeRestorePrivilege 1580 svchost.exe Token: SeShutdownPrivilege 1580 svchost.exe Token: SeSystemEnvironmentPrivilege 1580 svchost.exe Token: SeUndockPrivilege 1580 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3384 Explorer.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 464 wrote to memory of 4064 464 MasonRootkit.exe 89 PID 464 wrote to memory of 4064 464 MasonRootkit.exe 89 PID 464 wrote to memory of 4372 464 MasonRootkit.exe 90 PID 464 wrote to memory of 4372 464 MasonRootkit.exe 90 PID 4064 wrote to memory of 616 4064 jg31n4im.3ek.exe 5 PID 4064 wrote to memory of 668 4064 jg31n4im.3ek.exe 7 PID 4064 wrote to memory of 952 4064 jg31n4im.3ek.exe 12 PID 4064 wrote to memory of 316 4064 jg31n4im.3ek.exe 13 PID 668 wrote to memory of 2740 668 lsass.exe 46 PID 4064 wrote to memory of 408 4064 jg31n4im.3ek.exe 14 PID 4064 wrote to memory of 1040 4064 jg31n4im.3ek.exe 16 PID 4064 wrote to memory of 1120 4064 jg31n4im.3ek.exe 17 PID 4064 wrote to memory of 1140 4064 jg31n4im.3ek.exe 18 PID 4064 wrote to memory of 1148 4064 jg31n4im.3ek.exe 19 PID 4064 wrote to memory of 1156 4064 jg31n4im.3ek.exe 20 PID 4064 wrote to memory of 1224 4064 jg31n4im.3ek.exe 21 PID 4064 wrote to memory of 1308 4064 jg31n4im.3ek.exe 22 PID 4064 wrote to memory of 1344 4064 jg31n4im.3ek.exe 23 PID 4064 wrote to memory of 1408 4064 jg31n4im.3ek.exe 24 PID 4064 wrote to memory of 1416 4064 jg31n4im.3ek.exe 25 PID 4064 wrote to memory of 1588 4064 jg31n4im.3ek.exe 26 PID 4064 wrote to memory of 1608 4064 jg31n4im.3ek.exe 27 PID 4064 wrote to memory of 1616 4064 jg31n4im.3ek.exe 28 PID 4064 wrote to memory of 1728 4064 jg31n4im.3ek.exe 29 PID 4064 wrote to memory of 1752 4064 jg31n4im.3ek.exe 30 PID 4064 wrote to memory of 1776 4064 jg31n4im.3ek.exe 31 PID 4064 wrote to memory of 1852 4064 jg31n4im.3ek.exe 32 PID 4064 wrote to memory of 1976 4064 jg31n4im.3ek.exe 33 PID 4064 wrote to memory of 1988 4064 jg31n4im.3ek.exe 34 PID 4064 wrote to memory of 1492 4064 jg31n4im.3ek.exe 35 PID 4064 wrote to memory of 1580 4064 jg31n4im.3ek.exe 36 PID 4064 wrote to memory of 1948 4064 jg31n4im.3ek.exe 37 PID 4064 wrote to memory of 2124 4064 jg31n4im.3ek.exe 38 PID 4064 wrote to memory of 2192 4064 jg31n4im.3ek.exe 40 PID 4064 wrote to memory of 2364 4064 jg31n4im.3ek.exe 41 PID 4064 wrote to memory of 2528 4064 jg31n4im.3ek.exe 42 PID 4064 wrote to memory of 2536 4064 jg31n4im.3ek.exe 43 PID 4064 wrote to memory of 2696 4064 jg31n4im.3ek.exe 45 PID 4064 wrote to memory of 2740 4064 jg31n4im.3ek.exe 46 PID 4064 wrote to memory of 2748 4064 jg31n4im.3ek.exe 47 PID 4064 wrote to memory of 2756 4064 jg31n4im.3ek.exe 48 PID 4064 wrote to memory of 2768 4064 jg31n4im.3ek.exe 49 PID 4064 wrote to memory of 2824 4064 jg31n4im.3ek.exe 50 PID 4064 wrote to memory of 2856 4064 jg31n4im.3ek.exe 51 PID 4064 wrote to memory of 2024 4064 jg31n4im.3ek.exe 52 PID 4064 wrote to memory of 2544 4064 jg31n4im.3ek.exe 53 PID 4064 wrote to memory of 2704 4064 jg31n4im.3ek.exe 54 PID 4064 wrote to memory of 3384 4064 jg31n4im.3ek.exe 55 PID 4064 wrote to memory of 3392 4064 jg31n4im.3ek.exe 56 PID 4064 wrote to memory of 3568 4064 jg31n4im.3ek.exe 57 PID 4064 wrote to memory of 3756 4064 jg31n4im.3ek.exe 58 PID 4064 wrote to memory of 3920 4064 jg31n4im.3ek.exe 60 PID 4064 wrote to memory of 4116 4064 jg31n4im.3ek.exe 62 PID 4064 wrote to memory of 404 4064 jg31n4im.3ek.exe 65 PID 4064 wrote to memory of 4500 4064 jg31n4im.3ek.exe 66 PID 4064 wrote to memory of 1544 4064 jg31n4im.3ek.exe 68 PID 4064 wrote to memory of 4988 4064 jg31n4im.3ek.exe 69 PID 4064 wrote to memory of 2056 4064 jg31n4im.3ek.exe 70 PID 4064 wrote to memory of 1216 4064 jg31n4im.3ek.exe 71 PID 4064 wrote to memory of 4252 4064 jg31n4im.3ek.exe 72 PID 4064 wrote to memory of 1008 4064 jg31n4im.3ek.exe 73 PID 4064 wrote to memory of 2064 4064 jg31n4im.3ek.exe 74 PID 4064 wrote to memory of 704 4064 jg31n4im.3ek.exe 75 PID 4064 wrote to memory of 4896 4064 jg31n4im.3ek.exe 77 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:616
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:316
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 316 -s 40323⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:2264
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 616 -s 8162⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:3512
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
- Suspicious use of WriteProcessMemory
PID:668
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:952
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:408
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:1040
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
- Drops file in System32 directory
PID:1120 -
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵PID:2024
-
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe2⤵PID:924
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1140
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1148
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1156
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1224
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1308
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1344
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1408
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:2824
-
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:4424
-
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:3184
-
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:1924
-
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:4440
-
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:4224
-
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:2440
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1416
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1588
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1608
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1616
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1728
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1752
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1776
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1852
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1976
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:1988
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:1492
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1580
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:1948
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:2124
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2192
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2364
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2528
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2536
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
- Drops file in System32 directory
PID:2696
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵PID:2740
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:2748
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2756
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2768
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2856
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:2544
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵PID:2704
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"2⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\jg31n4im.3ek.exe"C:\Users\Admin\AppData\Local\Temp\jg31n4im.3ek.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4064
-
-
C:\Windows\SYSTEM32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "MasonMasonRootkit.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe'" /sc onlogon /rl HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:4372
-
-
C:\Windows\SYSTEM32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "MasonMasonRootkit.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe'" /sc onlogon /rl HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2812 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:3468
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:3392
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3568
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3756
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3920
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4116
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵PID:404
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:4500
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:1544
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
PID:4988
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2056
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵PID:1216
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:4252
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1008
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:2064
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵PID:704
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4896
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵PID:4512
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵PID:3064
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4628
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2108
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4916
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
PID:4604 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 500 -p 316 -ip 3162⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3060
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 548 -p 616 -ip 6162⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2344
-
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe c5bc2515cd2b3b4f4a1d48849d8b9ec6 D8p7ztaggUCawg6fMeVzbQ.0.1.0.0.01⤵
- Sets service image path in registry
- Modifies data under HKEY_USERS
PID:2820 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵PID:5100
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4428
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
- Checks BIOS information in registry
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Enumerates system info in registry
PID:4548
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵
- Drops file in Windows directory
PID:5088
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵PID:4320
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Indicator Removal
1Clear Windows Event Logs
1Modify Registry
1Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD5b5ca0de38ff6d0659caadf769d59de44
SHA17f3754484161b6f45a041c127b222256122f7070
SHA25675d3218475f50e2c2d21ac870fd24c3618cfdd4730021394bdda637f707b8872
SHA5127abf9a347b8393ad32d0c21091b0b6e69b20d20abd69b1b6e4087165587177ca7f5173c46df7f3440766c8d350709a3c47d5e2ad944214a06411652a6c771f90
-
Filesize
13KB
MD5f6b18d8becbbdd5e0c336e86125a45f0
SHA148c398c148f8646d7b9b89ecbc875ceed502102b
SHA256aafdef227cd9952de3088f66917f621bb08243e5d5868428f9342337ce526d52
SHA512fcf285732d4ddb68d9a67e6fe9dcb5c0cc35e738dd9beb6ad3e56ccf37092eb245f0503010f00868ad5fe7007f2df54f48df6ca2180a83db3905456704c54eed
-
Filesize
40KB
MD5a2d817d7fcfbe3659f7307916d537eb2
SHA16d2f358dc0a125b8f28d8feb5c6af8348b066dae
SHA256f9717e1b365cb065027b73c63894062894eb63d0b481e567a1cdfff1287634ad
SHA5120b86c0694e4077bac2ff42dd45053835ecadf34e836aae7091eba313e9626d6ed5f41be04e00d7e04f3c3b7fe75cc6bb8957dc66e64ee6885d9f6d661cc000c5
-
Filesize
13KB
MD51d3ac71e5667411905c8794c6bfa632e
SHA1773f976d9d31368edf228a3322bf79fac9efcd3e
SHA256c9e0a6afb23c039fb9e3ad12c55887cc299085884ab32b6f095356a47a090364
SHA51264d1d30efeb3b7c5372eae46fd8a4fc676cadf7a70a83b79c7733b345fcfb397333429d0ccf37d54919ed6bcc070e017c5bbad2212eef78c9b30ddc3acc62013
-
Filesize
161KB
MD594f1ab3a068f83b32639579ec9c5d025
SHA138f3d5bc5de46feb8de093d11329766b8e2054ae
SHA256879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
SHA51244d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
-
Filesize
2KB
MD50b990e24f1e839462c0ac35fef1d119e
SHA19e17905f8f68f9ce0a2024d57b537aa8b39c6708
SHA256a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a
SHA512c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4
-
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD53b3e912da95d88124030e4fa5e61a0d2
SHA176255f1bc41b2ebd1a468c9669cb4530d9c94b47
SHA256bfb91c536fd70ae95301a7411fd69582ec60b2ab376954e8b5878f2ef7793dc5
SHA512cc83fc2157443419e2ef34802bd07eadb9eb729ba7f6c025fdd517861f7a8c4d20835f587bb74efd656e9ca18936939cbd9691d3e9dfd4c3103a2ded9b7a5a95