9be0c047cea06ab24bdb1711ca7d4608e179826d079206ed36a1aea830cc5149

Resubmissions

01/06/2026, 03:37

260601-d6wpyaes2l7

01/06/2026, 02:34

260601-c2sl2sbx617

01/06/2026, 02:31

260601-czq1fabx5x7

Analysis

user interaction
yes
max time kernel
159s
max time network
156s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
01/06/2026, 03:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
MasonChess.exe
Size 1.3MB
Sample260601-d6wpyaes2l
SHA256 9be0c047cea06ab24bdb1711ca7d4608e179826d079206ed36a1aea830cc5149
MD5 10956f1eceb4c919805661a5bf59bbe9
SHA1 51bda4e573711789db96a1755563246e39623af3
SHA512 001b6eb588a6ac9d41abfe1a7fe001734fc9edb9db0502564532e029f1c30bf317261f63634527deb37ea9e1bb064818c57ec0a94194b23e4a6159039b02514d
SSDEEP 24576:gfCzYx3PgYWwocek/r2+AAYNh3tBULAkS7LeS:gfCkoA/qhlL3rmzS7
TLSH
T1A455C622A687D993C40E1270DDD7D32977B2E0B46B368B87BA4C9BEF7D213A11CC5146
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\Control Panel\International\Geo\Nation	MasonChess.exe

Executes dropped EXE 2 IoCs

pid	Process
1724	nasm.exe
2912	nasm.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MasonChess.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MasonChess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nasm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.iso	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.jxr\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mp4v	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.oft\OpenWithProgIDs	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mp4v\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ogx\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.orf\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.symlink\shellex\ContextMenuHandlers	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.theme	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.drf	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.library-ms	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.m4b\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mak	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.vsdm\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.wlt\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.cdx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.eyb	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.js	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpa	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.nrw\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.potx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.vcs\OpenWithProgIDs	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.asf	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.chk	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.crw	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.docm\ShellEx\PropertyHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.docx\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mk	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pl	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.prf	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.hol	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.acrobatsecuritysettings\OpenWithList	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.arw	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.jpg\OpenWithProgids	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpe\OpenWithProgIds	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.msp	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.rtf\ShellEx\{8895b1c6-b41f-4c1c-a562-0d564250836f}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.cat	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.dng\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.hxa	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.lnk	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.svg	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.symlink\shellex\{000214F9-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.trg	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.tta	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.3gp\OpenWithProgIds	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.idl\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pfx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.sct	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.shtml\OpenWithProgids	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.sr2\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.weba	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.acl	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ani	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.gif	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.jar	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.lnk\ShellEx\{000214F9-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.rct	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.usr\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.wma\OpenWithProgIds	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\.all	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpg\OpenWithProgIds	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.vstx\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}	reg.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4560	MasonChess.exe
Token: SeDebugPrivilege	4560	MasonChess.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4560	MasonChess.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4560	MasonChess.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 1724	4560	MasonChess.exe	82
PID 4560 wrote to memory of 2912	4560	MasonChess.exe	93
PID 4560 wrote to memory of 4944	4560	MasonChess.exe	95
PID 4944 wrote to memory of 3336	4944	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\MasonChess.exe
"C:\Users\Admin\AppData\Local\Temp\MasonChess.exe"
1⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Users\Admin\AppData\Local\Temp\nasm.exe
  "nasm.exe" -f bin mbr_temp.asm -o mbr_temp.bin
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1724
- C:\Users\Admin\AppData\Local\Temp\nasm.exe
  "nasm.exe" -f bin mbr_temp.asm -o mbr_temp.bin
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k reg delete HKCR /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Windows\SysWOW64\reg.exe
    reg delete HKCR /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3336

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4a8 0x4a4
1⤵
PID:2112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mbr_temp.asm

Path C:\Users\Admin\AppData\Local\Temp\mbr_temp.asm
Size 790B
SHA256 45a342877c16247c906eedf06e88f3e17b565c2f29902f065913abb12d324654
MD5 0ba14b566b784a32eb73837dda3e2100
SHA1 fdc1d73407d5e6d61a835db4f2270a246f84c2df
SHA512 0ebcd3c800f83d4a5bffea29989797ee5f04ab6621a65e33274375862b1a8881e000a5d57cb7ccc2706bccdd1d4e5b6f418f4cfbe678c4e581939e11ba69b285
TLSH
T1DA01F26A185257CA14FB454DE8C17F0BE2ED965F81C62C2AB30C03378FB69615A7066C
MD5 SHA1 SHA512 TLSH

Submit Download

mbr_temp.asm

Path C:\Users\Admin\AppData\Local\Temp\mbr_temp.asm
Size 789B
SHA256 4b878639dc0f71ebcf7279dc54342528363a818cc7af559ab1093ff0b3d6022d
MD5 0e7c962de4d6fb3649c4ac4eef7702cc
SHA1 8317b5831057b4da8243fba866f4a85f96a6bc57
SHA512 33915bbebf8479d1b0e15408d4529ada0018ae52d3ce5e97c1f64931d9ebefa829fe75f818b52529d26421fcd1fe0ba81e69f73d0c920d6b6ea5d348ea128c40
TLSH
T1E80176690C4217CA00FF454CE8C27F0BE2DC961F81C62C2AB30C03378FB69611A7066C
MD5 SHA1 SHA512 TLSH

Submit Download

mbr_temp.bin

Path C:\Users\Admin\AppData\Local\Temp\mbr_temp.bin
Size 512B
SHA256 74cc853be8142f1bb27c3e1b232197d07755cd5d53075e44b64dd7cd3a6ae084
MD5 dd106e1b4e7aee484a17de61211fc678
SHA1 2143528ab7e524a16ab84b9829a41c1af35f8b89
SHA512 91fe9f2cd2785e0eea9e2784128e173d7368ba23458df55624986e602ecea58080a28353d0ca25de1cac96953bdceb648fa53c159d70ebc89bfa9f3eb519fbef
TLSH
T1F6F09297908AE286E8060A74B41445685628A6E81105E89294518A1A22A8AB05E0975A
MD5 SHA1 SHA512 TLSH

Submit Download

mbr_temp.bin

Path C:\Users\Admin\AppData\Local\Temp\mbr_temp.bin
Size 512B
SHA256 d8ee48365b57e29fee8895ac549ca58730e9c14bc5eafb3d11c144b71d3d7009
MD5 33514ec146920d24820f6eda87b9f7ef
SHA1 ef33db724db199fea78555be2008cf27d376f131
SHA512 d9b24aa67e2395c4c6c61a2446aa389e6ead53409681d6a0a20a9077d0c3cd6554fbcd406523ce0dd437152dbfebb90477e540e1aefb5424593f740081223356
TLSH
T1B0F012D7908ED383E80A0AB4711559B82424A7F9150AEC92C452CD1733D8FE11F5575F
MD5 SHA1 SHA512 TLSH

Submit Download

nasm.exe

Path C:\Users\Admin\AppData\Local\Temp\nasm.exe
Size 1.2MB
SHA256 a4735165141570d966b577d594c0541c29baed4978078c1c7237b855f8592a87
MD5 2f17bab79b9e5caa79c4f493a18fb06c
SHA1 f3eb8a09529b82fc08e919517e098644ddc01004
SHA512 37c62999e11f3a44c02bad2ad9941213c0264312f228de32466818ec84d745312f941f4adf6e4bf3f49d5d91e8df56dbf39b7966ed8d4b214b484c93635ca154
SSDEEP 24576:2zYx3PgYWwocek/r2+AAYNh3tBULAkS7Le:2koA/qhlL3rmzS7
TLSH
T1A4459422A687D9A3C40E1270DDC7D32977B2E0F46B368B87BA4C97AF7D213A11CC5546
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1724-13-0x0000000000400000-0x0000000000539000-memory.dmp

Download

memory/2912-22-0x0000000000400000-0x0000000000539000-memory.dmp

Download

memory/4560-3-0x00000000058D0000-0x00000000058E0000-memory.dmp

Download

memory/4560-4-0x00000000059F0000-0x00000000059FA000-memory.dmp

Download

memory/4560-15-0x00000000058D0000-0x00000000058E0000-memory.dmp

Download

memory/4560-0-0x0000000000E10000-0x0000000000F62000-memory.dmp

Download

memory/4560-2-0x0000000005930000-0x00000000059C2000-memory.dmp

Download

memory/4560-1-0x0000000005FE0000-0x0000000006586000-memory.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads