donutloader | 772d8cfb62cc8c45f449a459742346ef66c5093dda7abba38252f40b0e58531a

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\Control Panel\International\Geo\Nation	tmp41A3.tmp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\Control Panel\International\Geo\Nation	CREATIVE EAX.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\Control Panel\International\Geo\Nation	MasonClient.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 64 IoCs

pid	Process
2796	CREATIVE EAX.exe
4056	CREATIVE EAX.exe
1068	CREATIVE EAX.exe
3396	MasonClient.exe
1928	MasonClient.exe
4948	MasonClient.exe
3236	CREATIVE EAX.exe
2228	MasonClient.exe
1812	CREATIVE EAX.exe
1112	MasonClient.exe
4836	CREATIVE EAX.exe
2436	MasonClient.exe
4136	CREATIVE EAX.exe
4336	MasonClient.exe
3904	CREATIVE EAX.exe
3996	MasonClient.exe
2448	CREATIVE EAX.exe
3420	MasonClient.exe
4240	CREATIVE EAX.exe
1528	MasonClient.exe
3736	CREATIVE EAX.exe
1920	MasonClient.exe
1416	CREATIVE EAX.exe
3624	MasonClient.exe
1892	CREATIVE EAX.exe
2616	MasonClient.exe
1700	CREATIVE EAX.exe
4964	MasonClient.exe
3644	CREATIVE EAX.exe
2396	MasonClient.exe
2676	CREATIVE EAX.exe
1724	MasonClient.exe
3704	CREATIVE EAX.exe
3548	MasonClient.exe
3220	CREATIVE EAX.exe
568	MasonClient.exe
2996	CREATIVE EAX.exe
564	MasonClient.exe
4668	CREATIVE EAX.exe
472	MasonClient.exe
1316	CREATIVE EAX.exe
416	MasonClient.exe
1920	CREATIVE EAX.exe
2164	MasonClient.exe
4608	CREATIVE EAX.exe
4752	MasonClient.exe
4436	CREATIVE EAX.exe
2056	CREATIVE EAX.exe
968	MasonClient.exe
4260	MasonClient.exe
3308	CREATIVE EAX.exe
3016	MasonClient.exe
712	CREATIVE EAX.exe
2020	MasonClient.exe
1112	CREATIVE EAX.exe
4856	MasonClient.exe
2188	CREATIVE EAX.exe
4536	MasonClient.exe
4144	CREATIVE EAX.exe
2452	MasonClient.exe
4204	CREATIVE EAX.exe
3848	MasonClient.exe
4308	CREATIVE EAX.exe
4476	MasonClient.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\tmp424F.tmp.exe.log	tmp424F.tmp.exe
File created	C:\Windows\SysWOW64\CREATIVE EAX.exe	CREATIVE EAX.exe
File opened for modification	C:\Windows\SysWOW64\CREATIVE EAX.exe	CREATIVE EAX.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\MasonClient.exe	MasonClient.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\CREATIVE EAX.exe.log	CREATIVE EAX.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\MasonClient.exe.log	MasonClient.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\95726	MasonClient.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4108	sc.exe
5020	sc.exe
4792	sc.exe
1052	sc.exe
4732	sc.exe
1064	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wermgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CREATIVE EAX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CREATIVE EAX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TROLL5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TROLL2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TROLL2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CREATIVE EAX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TROLL5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wermgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe

Disables Windows logging functionality 2 TTPs
Changes registry settings to disable Windows Event logging.

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	CREATIVE EAX.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\msacm.imaadpcm\MaxRTEncodeSetting = "6"	TROLL5.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	CREATIVE EAX.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\msacm.imaadpcm	TROLL5.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	CREATIVE EAX.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MasonClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	CREATIVE EAX.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	CREATIVE EAX.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	CREATIVE EAX.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	CREATIVE EAX.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	CREATIVE EAX.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\Windows Error Reporting	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	CREATIVE EAX.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	CREATIVE EAX.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries = 6024b221ea3a6910a2dc08002b30309dac0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	tmp424F.tmp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\msacm.imaadpcm\MaxRTDecodeSetting = "6"	TROLL5.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	CREATIVE EAX.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	CREATIVE EAX.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	CREATIVE EAX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	CREATIVE EAX.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4820	schtasks.exe
4204	schtasks.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3768	CREATIVE EAX.exe
Token: SeDebugPrivilege	2796	CREATIVE EAX.exe
Token: SeDebugPrivilege	4056	CREATIVE EAX.exe
Token: SeDebugPrivilege	3396	MasonClient.exe
Token: SeDebugPrivilege	1928	MasonClient.exe
Token: SeDebugPrivilege	4948	MasonClient.exe
Token: SeDebugPrivilege	2228	MasonClient.exe
Token: SeDebugPrivilege	1112	MasonClient.exe
Token: SeDebugPrivilege	2436	MasonClient.exe
Token: SeDebugPrivilege	4336	MasonClient.exe
Token: SeDebugPrivilege	3996	MasonClient.exe
Token: SeDebugPrivilege	3420	MasonClient.exe
Token: SeDebugPrivilege	1528	MasonClient.exe
Token: SeDebugPrivilege	1920	MasonClient.exe
Token: SeDebugPrivilege	3624	MasonClient.exe
Token: SeDebugPrivilege	2616	MasonClient.exe
Token: SeDebugPrivilege	4964	MasonClient.exe
Token: SeDebugPrivilege	2396	MasonClient.exe
Token: SeDebugPrivilege	1724	MasonClient.exe
Token: SeDebugPrivilege	3548	MasonClient.exe
Token: SeDebugPrivilege	568	MasonClient.exe
Token: SeDebugPrivilege	564	MasonClient.exe
Token: SeDebugPrivilege	472	MasonClient.exe
Token: SeDebugPrivilege	416	MasonClient.exe
Token: SeDebugPrivilege	2164	MasonClient.exe
Token: SeDebugPrivilege	4752	MasonClient.exe
Token: SeDebugPrivilege	968	MasonClient.exe
Token: SeDebugPrivilege	4260	MasonClient.exe
Token: SeDebugPrivilege	3016	MasonClient.exe
Token: SeDebugPrivilege	2020	MasonClient.exe
Token: SeDebugPrivilege	4856	MasonClient.exe
Token: SeDebugPrivilege	4536	MasonClient.exe
Token: SeDebugPrivilege	2452	MasonClient.exe
Token: SeDebugPrivilege	3848	MasonClient.exe
Token: SeDebugPrivilege	4476	MasonClient.exe
Token: SeDebugPrivilege	1000	MasonClient.exe
Token: SeDebugPrivilege	3484	MasonClient.exe
Token: SeDebugPrivilege	4572	MasonClient.exe
Token: SeDebugPrivilege	4624	MasonClient.exe
Token: SeDebugPrivilege	2688	MasonClient.exe
Token: SeDebugPrivilege	2436	MasonClient.exe
Token: SeDebugPrivilege	3708	MasonClient.exe
Token: SeDebugPrivilege	4784	MasonClient.exe
Token: SeDebugPrivilege	3900	MasonClient.exe
Token: SeDebugPrivilege	3892	MasonClient.exe
Token: SeDebugPrivilege	2508	MasonClient.exe
Token: SeDebugPrivilege	4844	MasonClient.exe
Token: SeDebugPrivilege	2516	MasonClient.exe
Token: SeDebugPrivilege	4668	MasonClient.exe
Token: SeDebugPrivilege	4920	MasonClient.exe
Token: SeDebugPrivilege	3404	MasonClient.exe
Token: SeDebugPrivilege	2904	MasonClient.exe
Token: SeDebugPrivilege	2648	MasonClient.exe
Token: SeDebugPrivilege	3920	MasonClient.exe
Token: SeDebugPrivilege	1704	MasonClient.exe
Token: SeDebugPrivilege	2740	MasonClient.exe
Token: SeDebugPrivilege	1824	MasonClient.exe
Token: SeDebugPrivilege	3116	MasonClient.exe
Token: SeDebugPrivilege	564	MasonClient.exe
Token: SeDebugPrivilege	1432	MasonClient.exe
Token: SeDebugPrivilege	1108	MasonClient.exe
Token: SeDebugPrivilege	3684	MasonClient.exe
Token: SeDebugPrivilege	2376	MasonClient.exe
Token: SeDebugPrivilege	1952	MasonClient.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3768 wrote to memory of 2796	3768	CREATIVE EAX.exe	84
PID 2796 wrote to memory of 4108	2796	CREATIVE EAX.exe	85
PID 2796 wrote to memory of 5020	2796	CREATIVE EAX.exe	89
PID 2796 wrote to memory of 4792	2796	CREATIVE EAX.exe	93
PID 2796 wrote to memory of 1052	2796	CREATIVE EAX.exe	95
PID 2796 wrote to memory of 4732	2796	CREATIVE EAX.exe	97
PID 2796 wrote to memory of 1064	2796	CREATIVE EAX.exe	99
PID 4056 wrote to memory of 1068	4056	CREATIVE EAX.exe	103
PID 4056 wrote to memory of 3396	4056	CREATIVE EAX.exe	104
PID 3396 wrote to memory of 4820	3396	MasonClient.exe	105
PID 1928 wrote to memory of 4204	1928	MasonClient.exe	109
PID 1068 wrote to memory of 3236	1068	CREATIVE EAX.exe	114
PID 1068 wrote to memory of 2228	1068	CREATIVE EAX.exe	115
PID 4056 wrote to memory of 1812	4056	CREATIVE EAX.exe	116
PID 4056 wrote to memory of 1112	4056	CREATIVE EAX.exe	117
PID 3236 wrote to memory of 4836	3236	CREATIVE EAX.exe	118
PID 3236 wrote to memory of 2436	3236	CREATIVE EAX.exe	119
PID 1812 wrote to memory of 4136	1812	CREATIVE EAX.exe	121
PID 1812 wrote to memory of 4336	1812	CREATIVE EAX.exe	122
PID 4836 wrote to memory of 3904	4836	CREATIVE EAX.exe	123
PID 4836 wrote to memory of 3996	4836	CREATIVE EAX.exe	124
PID 4056 wrote to memory of 2448	4056	CREATIVE EAX.exe	125
PID 4056 wrote to memory of 3420	4056	CREATIVE EAX.exe	126
PID 4136 wrote to memory of 4240	4136	CREATIVE EAX.exe	127
PID 4136 wrote to memory of 1528	4136	CREATIVE EAX.exe	128
PID 3904 wrote to memory of 3736	3904	CREATIVE EAX.exe	129
PID 3904 wrote to memory of 1920	3904	CREATIVE EAX.exe	130
PID 2448 wrote to memory of 1416	2448	CREATIVE EAX.exe	131
PID 2448 wrote to memory of 3624	2448	CREATIVE EAX.exe	132
PID 3736 wrote to memory of 1892	3736	CREATIVE EAX.exe	133
PID 3736 wrote to memory of 2616	3736	CREATIVE EAX.exe	134
PID 4056 wrote to memory of 1700	4056	CREATIVE EAX.exe	135
PID 4056 wrote to memory of 4964	4056	CREATIVE EAX.exe	136
PID 1416 wrote to memory of 3644	1416	CREATIVE EAX.exe	137
PID 1416 wrote to memory of 2396	1416	CREATIVE EAX.exe	138
PID 1892 wrote to memory of 2676	1892	CREATIVE EAX.exe	139
PID 1892 wrote to memory of 1724	1892	CREATIVE EAX.exe	140
PID 1700 wrote to memory of 3704	1700	CREATIVE EAX.exe	141
PID 1700 wrote to memory of 3548	1700	CREATIVE EAX.exe	142
PID 2676 wrote to memory of 3220	2676	CREATIVE EAX.exe	143
PID 2676 wrote to memory of 568	2676	CREATIVE EAX.exe	144
PID 4056 wrote to memory of 2996	4056	CREATIVE EAX.exe	145
PID 4056 wrote to memory of 564	4056	CREATIVE EAX.exe	146
PID 3704 wrote to memory of 4668	3704	CREATIVE EAX.exe	147
PID 3704 wrote to memory of 472	3704	CREATIVE EAX.exe	148
PID 3220 wrote to memory of 1316	3220	CREATIVE EAX.exe	149
PID 3220 wrote to memory of 416	3220	CREATIVE EAX.exe	150
PID 2996 wrote to memory of 1920	2996	CREATIVE EAX.exe	151
PID 2996 wrote to memory of 2164	2996	CREATIVE EAX.exe	152
PID 1316 wrote to memory of 4608	1316	CREATIVE EAX.exe	153
PID 1316 wrote to memory of 4752	1316	CREATIVE EAX.exe	154
PID 4056 wrote to memory of 4436	4056	CREATIVE EAX.exe	155
PID 1920 wrote to memory of 2056	1920	CREATIVE EAX.exe	156
PID 4056 wrote to memory of 968	4056	CREATIVE EAX.exe	157
PID 1920 wrote to memory of 4260	1920	CREATIVE EAX.exe	158
PID 4608 wrote to memory of 3308	4608	CREATIVE EAX.exe	159
PID 4608 wrote to memory of 3016	4608	CREATIVE EAX.exe	160
PID 4436 wrote to memory of 712	4436	CREATIVE EAX.exe	162
PID 4436 wrote to memory of 2020	4436	CREATIVE EAX.exe	163
PID 3308 wrote to memory of 1112	3308	CREATIVE EAX.exe	164
PID 3308 wrote to memory of 4856	3308	CREATIVE EAX.exe	165
PID 712 wrote to memory of 2188	712	CREATIVE EAX.exe	166
PID 712 wrote to memory of 4536	712	CREATIVE EAX.exe	167
PID 4056 wrote to memory of 4144	4056	CREATIVE EAX.exe	168

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3768
- C:\Windows\SysWOW64\CREATIVE EAX.exe
  "C:\Windows\System32\CREATIVE EAX.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Windows\SysWOW64\sc.exe
    "sc.exe" stop CREATIVEEAX
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4108
- - C:\Windows\SysWOW64\sc.exe
    "sc.exe" delete CREATIVEEAX
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5020
- - C:\Windows\SysWOW64\sc.exe
    "sc.exe" create CREATIVEEAX binPath= "C:\Windows\System32\CREATIVE EAX.exe /service" type= own start= auto
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4792
- - C:\Windows\SysWOW64\sc.exe
    "sc.exe" description CREATIVEEAX "Windows Security Update Service"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1052
- - C:\Windows\SysWOW64\sc.exe
    "sc.exe" failure CREATIVEEAX reset= 3600 actions= restart/10000
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4732
- - C:\Windows\SysWOW64\sc.exe
    "sc.exe" start CREATIVEEAX
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1064

C:\Windows\SysWOW64\CREATIVE EAX.exe
"C:\Windows\SysWOW64\CREATIVE EAX.exe" /service
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Windows\TEMP\CREATIVE EAX.exe
  "C:\Windows\TEMP\CREATIVE EAX.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Windows\TEMP\CREATIVE EAX.exe
    "C:\Windows\TEMP\CREATIVE EAX.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:3236
  - - C:\Windows\TEMP\CREATIVE EAX.exe
      "C:\Windows\TEMP\CREATIVE EAX.exe"
      4⤵
      Executes dropped EXE
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:4836
    - - C:\Windows\TEMP\CREATIVE EAX.exe
        
        "C:\Windows\TEMP\CREATIVE EAX.exe"
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:3904
      - C:\Windows\TEMP\CREATIVE EAX.exe
        
        "C:\Windows\TEMP\CREATIVE EAX.exe"
        6⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:3736
        
        C:\Windows\TEMP\CREATIVE EAX.exe
        
        "C:\Windows\TEMP\CREATIVE EAX.exe"
        7⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:1892
        
        C:\Windows\TEMP\CREATIVE EAX.exe
        
        "C:\Windows\TEMP\CREATIVE EAX.exe"
        8⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:2676
        
        C:\Windows\TEMP\CREATIVE EAX.exe
        
        "C:\Windows\TEMP\CREATIVE EAX.exe"
        9⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:3220
        
        C:\Windows\TEMP\CREATIVE EAX.exe
        
        "C:\Windows\TEMP\CREATIVE EAX.exe"
        10⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:1316
        
        C:\Windows\TEMP\CREATIVE EAX.exe
        
        "C:\Windows\TEMP\CREATIVE EAX.exe"
        11⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:4608
        
        C:\Windows\TEMP\CREATIVE EAX.exe
        
        "C:\Windows\TEMP\CREATIVE EAX.exe"
        12⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:3308
        
        C:\Windows\TEMP\CREATIVE EAX.exe
        
        "C:\Windows\TEMP\CREATIVE EAX.exe"
        13⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:1112
        
        C:\Windows\TEMP\CREATIVE EAX.exe
        
        "C:\Windows\TEMP\CREATIVE EAX.exe"
        14⤵
        Executes dropped EXE
        
        PID:4204
        
        C:\Windows\TEMP\CREATIVE EAX.exe
        
        "C:\Windows\TEMP\CREATIVE EAX.exe"
        15⤵
        
        PID:2952
        
        C:\Windows\TEMP\CREATIVE EAX.exe
        
        "C:\Windows\TEMP\CREATIVE EAX.exe"
        16⤵
        Modifies data under HKEY_USERS
        
        PID:1532
        
        C:\Windows\TEMP\CREATIVE EAX.exe
        
        "C:\Windows\TEMP\CREATIVE EAX.exe"
        17⤵
        
        PID:2012
        
        C:\Windows\TEMP\CREATIVE EAX.exe
        
        "C:\Windows\TEMP\CREATIVE EAX.exe"
        18⤵
        Modifies data under HKEY_USERS
        
        PID:2096
        
        C:\Windows\TEMP\CREATIVE EAX.exe
        
        "C:\Windows\TEMP\CREATIVE EAX.exe"
        19⤵
        
        PID:2208
        
        C:\Windows\TEMP\CREATIVE EAX.exe
        
        "C:\Windows\TEMP\CREATIVE EAX.exe"
        20⤵
        Modifies data under HKEY_USERS
        
        PID:4788
        
        C:\Windows\TEMP\CREATIVE EAX.exe
        
        "C:\Windows\TEMP\CREATIVE EAX.exe"
        21⤵
        Modifies data under HKEY_USERS
        
        PID:3624
        
        C:\Windows\TEMP\CREATIVE EAX.exe
        
        "C:\Windows\TEMP\CREATIVE EAX.exe"
        22⤵
        Modifies data under HKEY_USERS
        
        PID:3064
        
        C:\Windows\TEMP\CREATIVE EAX.exe
        
        "C:\Windows\TEMP\CREATIVE EAX.exe"
        23⤵
        Modifies data under HKEY_USERS
        
        PID:2968
        
        C:\Windows\TEMP\CREATIVE EAX.exe
        
        "C:\Windows\TEMP\CREATIVE EAX.exe"
        24⤵
        
        PID:3836
        
        C:\Windows\TEMP\CREATIVE EAX.exe
        
        "C:\Windows\TEMP\CREATIVE EAX.exe"
        25⤵
        Modifies data under HKEY_USERS
        
        PID:4668
        
        C:\Windows\TEMP\CREATIVE EAX.exe
        
        "C:\Windows\TEMP\CREATIVE EAX.exe"
        26⤵
        Modifies data under HKEY_USERS
        
        PID:3840
        
        C:\Windows\TEMP\CREATIVE EAX.exe
        
        "C:\Windows\TEMP\CREATIVE EAX.exe"
        27⤵
        Modifies data under HKEY_USERS
        
        PID:2064
        
        C:\Windows\TEMP\CREATIVE EAX.exe
        
        "C:\Windows\TEMP\CREATIVE EAX.exe"
        28⤵
        Modifies data under HKEY_USERS
        
        PID:4216
        
        C:\Windows\TEMP\CREATIVE EAX.exe
        
        "C:\Windows\TEMP\CREATIVE EAX.exe"
        29⤵
        
        PID:2068
        
        C:\Windows\TEMP\CREATIVE EAX.exe
        
        "C:\Windows\TEMP\CREATIVE EAX.exe"
        30⤵
        
        PID:4644
        
        C:\Windows\TEMP\CREATIVE EAX.exe
        
        "C:\Windows\TEMP\CREATIVE EAX.exe"
        31⤵
        
        PID:1240
        
        C:\Windows\TEMP\CREATIVE EAX.exe
        
        "C:\Windows\TEMP\CREATIVE EAX.exe"
        32⤵
        Modifies data under HKEY_USERS
        
        PID:5056
        
        C:\Windows\TEMP\CREATIVE EAX.exe
        
        "C:\Windows\TEMP\CREATIVE EAX.exe"
        33⤵
        Modifies data under HKEY_USERS
        
        PID:4260
        
        C:\Windows\TEMP\CREATIVE EAX.exe
        
        "C:\Windows\TEMP\CREATIVE EAX.exe"
        34⤵
        
        PID:3856
        
        C:\Windows\TEMP\CREATIVE EAX.exe
        
        "C:\Windows\TEMP\CREATIVE EAX.exe"
        35⤵
        
        PID:4732
        
        C:\Windows\TEMP\CREATIVE EAX.exe
        
        "C:\Windows\TEMP\CREATIVE EAX.exe"
        36⤵
        
        PID:692
        
        C:\Windows\TEMP\CREATIVE EAX.exe
        
        "C:\Windows\TEMP\CREATIVE EAX.exe"
        37⤵
        
        PID:4068
        
        C:\Windows\TEMP\CREATIVE EAX.exe
        
        "C:\Windows\TEMP\CREATIVE EAX.exe"
        38⤵
        
        PID:852
        
        C:\Windows\TEMP\MasonClient.exe
        
        "C:\Windows\TEMP\MasonClient.exe"
        38⤵
        
        PID:3032
        
        C:\Windows\TEMP\MasonClient.exe
        
        "C:\Windows\TEMP\MasonClient.exe"
        37⤵
        
        PID:4160
        
        C:\Windows\TEMP\MasonClient.exe
        
        "C:\Windows\TEMP\MasonClient.exe"
        36⤵
        
        PID:1832
        
        C:\Windows\TEMP\MasonClient.exe
        
        "C:\Windows\TEMP\MasonClient.exe"
        35⤵
        
        PID:2216
        
        C:\Windows\TEMP\MasonClient.exe
        
        "C:\Windows\TEMP\MasonClient.exe"
        34⤵
        
        PID:2948
        
        C:\Windows\TEMP\MasonClient.exe
        
        "C:\Windows\TEMP\MasonClient.exe"
        33⤵
        
        PID:2388
        
        C:\Windows\TEMP\MasonClient.exe
        
        "C:\Windows\TEMP\MasonClient.exe"
        32⤵
        
        PID:4104
        
        C:\Windows\TEMP\MasonClient.exe
        
        "C:\Windows\TEMP\MasonClient.exe"
        31⤵
        
        PID:3112
        
        C:\Windows\TEMP\MasonClient.exe
        
        "C:\Windows\TEMP\MasonClient.exe"
        30⤵
        
        PID:4992
        
        C:\Windows\TEMP\MasonClient.exe
        
        "C:\Windows\TEMP\MasonClient.exe"
        29⤵
        
        PID:3280
        
        C:\Windows\TEMP\MasonClient.exe
        
        "C:\Windows\TEMP\MasonClient.exe"
        28⤵
        
        PID:5052
        
        C:\Windows\TEMP\MasonClient.exe
        
        "C:\Windows\TEMP\MasonClient.exe"
        27⤵
        
        PID:1500
        
        C:\Windows\TEMP\MasonClient.exe
        
        "C:\Windows\TEMP\MasonClient.exe"
        26⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1952
        
        C:\Windows\TEMP\MasonClient.exe
        
        "C:\Windows\TEMP\MasonClient.exe"
        25⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1108
        
        C:\Windows\TEMP\MasonClient.exe
        
        "C:\Windows\TEMP\MasonClient.exe"
        24⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:564
        
        C:\Windows\TEMP\MasonClient.exe
        
        "C:\Windows\TEMP\MasonClient.exe"
        23⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2740
        
        C:\Windows\TEMP\MasonClient.exe
        
        "C:\Windows\TEMP\MasonClient.exe"
        22⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3920
        
        C:\Windows\TEMP\MasonClient.exe
        
        "C:\Windows\TEMP\MasonClient.exe"
        21⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3404
        
        C:\Windows\TEMP\MasonClient.exe
        
        "C:\Windows\TEMP\MasonClient.exe"
        20⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4668
        
        C:\Windows\TEMP\MasonClient.exe
        
        "C:\Windows\TEMP\MasonClient.exe"
        19⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2508
        
        C:\Windows\TEMP\MasonClient.exe
        
        "C:\Windows\TEMP\MasonClient.exe"
        18⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3900
        
        C:\Windows\TEMP\MasonClient.exe
        
        "C:\Windows\TEMP\MasonClient.exe"
        17⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2436
        
        C:\Windows\TEMP\MasonClient.exe
        
        "C:\Windows\TEMP\MasonClient.exe"
        16⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4624
        
        C:\Windows\TEMP\MasonClient.exe
        
        "C:\Windows\TEMP\MasonClient.exe"
        15⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1000
        
        C:\Windows\TEMP\MasonClient.exe
        
        "C:\Windows\TEMP\MasonClient.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3848
        
        C:\Windows\TEMP\MasonClient.exe
        
        "C:\Windows\TEMP\MasonClient.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4856
        
        C:\Windows\TEMP\MasonClient.exe
        
        "C:\Windows\TEMP\MasonClient.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3016
        
        C:\Windows\TEMP\MasonClient.exe
        
        "C:\Windows\TEMP\MasonClient.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4752
        
        C:\Windows\TEMP\MasonClient.exe
        
        "C:\Windows\TEMP\MasonClient.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:416
        
        C:\Windows\TEMP\MasonClient.exe
        
        "C:\Windows\TEMP\MasonClient.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:568
        
        C:\Windows\TEMP\MasonClient.exe
        
        "C:\Windows\TEMP\MasonClient.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1724
        
        C:\Windows\TEMP\MasonClient.exe
        
        "C:\Windows\TEMP\MasonClient.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2616
      - C:\Windows\TEMP\MasonClient.exe
        
        "C:\Windows\TEMP\MasonClient.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1920
    - - C:\Windows\TEMP\MasonClient.exe
        
        "C:\Windows\TEMP\MasonClient.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3996
  - - C:\Windows\TEMP\MasonClient.exe
      "C:\Windows\TEMP\MasonClient.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2436
- - C:\Windows\TEMP\MasonClient.exe
    "C:\Windows\TEMP\MasonClient.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of AdjustPrivilegeToken
    PID:2228
- C:\Windows\TEMP\MasonClient.exe
  "C:\Windows\TEMP\MasonClient.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3396
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "MasonClient" /tr "C:\Windows\system32\config\systemprofile\AppData\Roaming\MasonClient.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4820
- - C:\Windows\TEMP\tmp424F.tmp.exe
    "C:\Windows\TEMP\tmp424F.tmp.exe"
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:616
  - - C:\Windows\Temp\MBR2.exe
      "C:\Windows\Temp\MBR2.exe"
      4⤵
      PID:2404
    - - C:\Windows\System32\MatrixMBR.exe
        
        "C:\Windows\System32\MatrixMBR.exe"
        5⤵
        
        PID:3620
      - C:\Windows\TEMP\GDI.exe
        
        "C:\Windows\TEMP\GDI.exe"
        6⤵
        
        PID:4336
      - C:\Windows\TEMP\MBR.exe
        
        "C:\Windows\TEMP\MBR.exe"
        6⤵
        
        PID:4944
  - - C:\Windows\Temp\TROLL5.exe
      "C:\Windows\Temp\TROLL5.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      PID:228
  - - C:\Windows\Temp\TROLL2.exe
      "C:\Windows\Temp\TROLL2.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:400
    - - C:\Windows\SysWOW64\wermgr.exe
        
        "C:\Windows\system32\wermgr.exe" "-outproc" "0" "400" "780" "620" "776" "0" "0" "796" "792" "0" "0" "0" "0"
        5⤵
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:3700
    - - C:\Windows\SysWOW64\wermgr.exe
        
        "C:\Windows\system32\wermgr.exe" "-outproc" "0" "400" "824" "364" "820" "0" "0" "816" "812" "0" "0" "0" "0"
        5⤵
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:1152
- C:\Windows\TEMP\CREATIVE EAX.exe
  "C:\Windows\TEMP\CREATIVE EAX.exe"
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:1812
- - C:\Windows\TEMP\CREATIVE EAX.exe
    "C:\Windows\TEMP\CREATIVE EAX.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4136
  - - C:\Windows\TEMP\CREATIVE EAX.exe
      "C:\Windows\TEMP\CREATIVE EAX.exe"
      4⤵
      Executes dropped EXE
      PID:4240
  - - C:\Windows\TEMP\MasonClient.exe
      "C:\Windows\TEMP\MasonClient.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1528
- - C:\Windows\TEMP\MasonClient.exe
    "C:\Windows\TEMP\MasonClient.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4336
- C:\Windows\TEMP\MasonClient.exe
  "C:\Windows\TEMP\MasonClient.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1112
- C:\Windows\TEMP\CREATIVE EAX.exe
  "C:\Windows\TEMP\CREATIVE EAX.exe"
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\TEMP\CREATIVE EAX.exe
    "C:\Windows\TEMP\CREATIVE EAX.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1416
  - - C:\Windows\TEMP\CREATIVE EAX.exe
      "C:\Windows\TEMP\CREATIVE EAX.exe"
      4⤵
      Executes dropped EXE
      PID:3644
  - - C:\Windows\TEMP\MasonClient.exe
      "C:\Windows\TEMP\MasonClient.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2396
- - C:\Windows\TEMP\MasonClient.exe
    "C:\Windows\TEMP\MasonClient.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3624
- C:\Windows\TEMP\MasonClient.exe
  "C:\Windows\TEMP\MasonClient.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3420
- C:\Windows\TEMP\CREATIVE EAX.exe
  "C:\Windows\TEMP\CREATIVE EAX.exe"
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Windows\TEMP\CREATIVE EAX.exe
    "C:\Windows\TEMP\CREATIVE EAX.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3704
  - - C:\Windows\TEMP\CREATIVE EAX.exe
      "C:\Windows\TEMP\CREATIVE EAX.exe"
      4⤵
      Executes dropped EXE
      PID:4668
  - - C:\Windows\TEMP\MasonClient.exe
      "C:\Windows\TEMP\MasonClient.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:472
- - C:\Windows\TEMP\MasonClient.exe
    "C:\Windows\TEMP\MasonClient.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3548
- C:\Windows\TEMP\MasonClient.exe
  "C:\Windows\TEMP\MasonClient.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4964
- C:\Windows\TEMP\CREATIVE EAX.exe
  "C:\Windows\TEMP\CREATIVE EAX.exe"
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Windows\TEMP\CREATIVE EAX.exe
    "C:\Windows\TEMP\CREATIVE EAX.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:1920
  - - C:\Windows\TEMP\CREATIVE EAX.exe
      "C:\Windows\TEMP\CREATIVE EAX.exe"
      4⤵
      Executes dropped EXE
      PID:2056
  - - C:\Windows\TEMP\MasonClient.exe
      "C:\Windows\TEMP\MasonClient.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4260
- - C:\Windows\TEMP\MasonClient.exe
    "C:\Windows\TEMP\MasonClient.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2164
- C:\Windows\TEMP\MasonClient.exe
  "C:\Windows\TEMP\MasonClient.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:564
- C:\Windows\TEMP\CREATIVE EAX.exe
  "C:\Windows\TEMP\CREATIVE EAX.exe"
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:4436
- - C:\Windows\TEMP\CREATIVE EAX.exe
    "C:\Windows\TEMP\CREATIVE EAX.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:712
  - - C:\Windows\TEMP\CREATIVE EAX.exe
      "C:\Windows\TEMP\CREATIVE EAX.exe"
      4⤵
      Executes dropped EXE
      PID:2188
    - - C:\Windows\TEMP\CREATIVE EAX.exe
        
        "C:\Windows\TEMP\CREATIVE EAX.exe"
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:4308
      - C:\Windows\TEMP\CREATIVE EAX.exe
        
        "C:\Windows\TEMP\CREATIVE EAX.exe"
        6⤵
        
        PID:4752
      - C:\Windows\TEMP\MasonClient.exe
        
        "C:\Windows\TEMP\MasonClient.exe"
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4572
    - - C:\Windows\TEMP\MasonClient.exe
        
        "C:\Windows\TEMP\MasonClient.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4476
  - - C:\Windows\TEMP\MasonClient.exe
      "C:\Windows\TEMP\MasonClient.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4536
- - C:\Windows\TEMP\MasonClient.exe
    "C:\Windows\TEMP\MasonClient.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2020
- C:\Windows\TEMP\MasonClient.exe
  "C:\Windows\TEMP\MasonClient.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:968
- C:\Windows\TEMP\CREATIVE EAX.exe
  "C:\Windows\TEMP\CREATIVE EAX.exe"
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\TEMP\MasonClient.exe
  "C:\Windows\TEMP\MasonClient.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2452
- C:\Windows\TEMP\CREATIVE EAX.exe
  "C:\Windows\TEMP\CREATIVE EAX.exe"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1388
- - C:\Windows\TEMP\CREATIVE EAX.exe
    "C:\Windows\TEMP\CREATIVE EAX.exe"
    3⤵
    - Modifies data under HKEY_USERS
    PID:1816
  - - C:\Windows\TEMP\CREATIVE EAX.exe
      "C:\Windows\TEMP\CREATIVE EAX.exe"
      4⤵
      PID:548
    - - C:\Windows\TEMP\CREATIVE EAX.exe
        
        "C:\Windows\TEMP\CREATIVE EAX.exe"
        5⤵
        
        PID:4244
      - C:\Windows\TEMP\CREATIVE EAX.exe
        
        "C:\Windows\TEMP\CREATIVE EAX.exe"
        6⤵
        
        PID:1220
      - C:\Windows\TEMP\MasonClient.exe
        
        "C:\Windows\TEMP\MasonClient.exe"
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4844
    - - C:\Windows\TEMP\MasonClient.exe
        
        "C:\Windows\TEMP\MasonClient.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3892
  - - C:\Windows\TEMP\MasonClient.exe
      "C:\Windows\TEMP\MasonClient.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3708
- - C:\Windows\TEMP\MasonClient.exe
    "C:\Windows\TEMP\MasonClient.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2688
- C:\Windows\TEMP\MasonClient.exe
  "C:\Windows\TEMP\MasonClient.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3484
- C:\Windows\TEMP\CREATIVE EAX.exe
  "C:\Windows\TEMP\CREATIVE EAX.exe"
  2⤵
  PID:4820
- C:\Windows\TEMP\MasonClient.exe
  "C:\Windows\TEMP\MasonClient.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4784
- C:\Windows\TEMP\CREATIVE EAX.exe
  "C:\Windows\TEMP\CREATIVE EAX.exe"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4832
- - C:\Windows\TEMP\CREATIVE EAX.exe
    "C:\Windows\TEMP\CREATIVE EAX.exe"
    3⤵
    PID:968
  - - C:\Windows\TEMP\CREATIVE EAX.exe
      "C:\Windows\TEMP\CREATIVE EAX.exe"
      4⤵
      PID:4500
  - - C:\Windows\TEMP\MasonClient.exe
      "C:\Windows\TEMP\MasonClient.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2648
- - C:\Windows\TEMP\MasonClient.exe
    "C:\Windows\TEMP\MasonClient.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4920
- C:\Windows\TEMP\MasonClient.exe
  "C:\Windows\TEMP\MasonClient.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2516
- C:\Windows\TEMP\CREATIVE EAX.exe
  "C:\Windows\TEMP\CREATIVE EAX.exe"
  2⤵
  PID:3180
- - C:\Windows\TEMP\CREATIVE EAX.exe
    "C:\Windows\TEMP\CREATIVE EAX.exe"
    3⤵
    - Modifies data under HKEY_USERS
    PID:1748
  - - C:\Windows\TEMP\CREATIVE EAX.exe
      "C:\Windows\TEMP\CREATIVE EAX.exe"
      4⤵
      Modifies data under HKEY_USERS
      PID:4556
    - - C:\Windows\TEMP\CREATIVE EAX.exe
        
        "C:\Windows\TEMP\CREATIVE EAX.exe"
        5⤵
        Modifies data under HKEY_USERS
        
        PID:2516
      - C:\Windows\TEMP\CREATIVE EAX.exe
        
        "C:\Windows\TEMP\CREATIVE EAX.exe"
        6⤵
        
        PID:2052
      - C:\Windows\TEMP\MasonClient.exe
        
        "C:\Windows\TEMP\MasonClient.exe"
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2376
    - - C:\Windows\TEMP\MasonClient.exe
        
        "C:\Windows\TEMP\MasonClient.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1432
  - - C:\Windows\TEMP\MasonClient.exe
      "C:\Windows\TEMP\MasonClient.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1824
- - C:\Windows\TEMP\MasonClient.exe
    "C:\Windows\TEMP\MasonClient.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1704
- C:\Windows\TEMP\MasonClient.exe
  "C:\Windows\TEMP\MasonClient.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2904
- C:\Windows\TEMP\CREATIVE EAX.exe
  "C:\Windows\TEMP\CREATIVE EAX.exe"
  2⤵
  PID:3552
- C:\Windows\TEMP\MasonClient.exe
  "C:\Windows\TEMP\MasonClient.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3116
- C:\Windows\TEMP\CREATIVE EAX.exe
  "C:\Windows\TEMP\CREATIVE EAX.exe"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4712
- - C:\Windows\TEMP\CREATIVE EAX.exe
    "C:\Windows\TEMP\CREATIVE EAX.exe"
    3⤵
    PID:1208
  - - C:\Windows\TEMP\CREATIVE EAX.exe
      "C:\Windows\TEMP\CREATIVE EAX.exe"
      4⤵
      PID:952
  - - C:\Windows\TEMP\MasonClient.exe
      "C:\Windows\TEMP\MasonClient.exe"
      4⤵
      PID:3604
- - C:\Windows\TEMP\MasonClient.exe
    "C:\Windows\TEMP\MasonClient.exe"
    3⤵
    PID:4808
- C:\Windows\TEMP\MasonClient.exe
  "C:\Windows\TEMP\MasonClient.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3684
- C:\Windows\TEMP\CREATIVE EAX.exe
  "C:\Windows\TEMP\CREATIVE EAX.exe"
  2⤵
  PID:5060
- - C:\Windows\TEMP\CREATIVE EAX.exe
    "C:\Windows\TEMP\CREATIVE EAX.exe"
    3⤵
    - Modifies data under HKEY_USERS
    PID:3900
  - - C:\Windows\TEMP\CREATIVE EAX.exe
      "C:\Windows\TEMP\CREATIVE EAX.exe"
      4⤵
      PID:4388
  - - C:\Windows\TEMP\MasonClient.exe
      "C:\Windows\TEMP\MasonClient.exe"
      4⤵
      PID:1680
- - C:\Windows\TEMP\MasonClient.exe
    "C:\Windows\TEMP\MasonClient.exe"
    3⤵
    PID:3896
- C:\Windows\TEMP\MasonClient.exe
  "C:\Windows\TEMP\MasonClient.exe"
  2⤵
  PID:3516
- C:\Windows\TEMP\CREATIVE EAX.exe
  "C:\Windows\TEMP\CREATIVE EAX.exe"
  2⤵
  PID:4280
- - C:\Windows\TEMP\CREATIVE EAX.exe
    "C:\Windows\TEMP\CREATIVE EAX.exe"
    3⤵
    PID:4876
  - - C:\Windows\TEMP\CREATIVE EAX.exe
      "C:\Windows\TEMP\CREATIVE EAX.exe"
      4⤵
      PID:1772
  - - C:\Windows\TEMP\MasonClient.exe
      "C:\Windows\TEMP\MasonClient.exe"
      4⤵
      PID:4924
- - C:\Windows\TEMP\MasonClient.exe
    "C:\Windows\TEMP\MasonClient.exe"
    3⤵
    PID:2400
- C:\Windows\TEMP\MasonClient.exe
  "C:\Windows\TEMP\MasonClient.exe"
  2⤵
  PID:4964
- C:\Windows\TEMP\CREATIVE EAX.exe
  "C:\Windows\TEMP\CREATIVE EAX.exe"
  2⤵
  PID:1444
- - C:\Windows\TEMP\CREATIVE EAX.exe
    "C:\Windows\TEMP\CREATIVE EAX.exe"
    3⤵
    PID:3924
- - C:\Windows\TEMP\MasonClient.exe
    "C:\Windows\TEMP\MasonClient.exe"
    3⤵
    PID:4768
- C:\Windows\TEMP\MasonClient.exe
  "C:\Windows\TEMP\MasonClient.exe"
  2⤵
  PID:2436
- C:\Windows\TEMP\CREATIVE EAX.exe
  "C:\Windows\TEMP\CREATIVE EAX.exe"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3448
- - C:\Windows\TEMP\CREATIVE EAX.exe
    "C:\Windows\TEMP\CREATIVE EAX.exe"
    3⤵
    - Modifies data under HKEY_USERS
    PID:3896
  - - C:\Windows\TEMP\CREATIVE EAX.exe
      "C:\Windows\TEMP\CREATIVE EAX.exe"
      4⤵
      PID:4944
  - - C:\Windows\TEMP\MasonClient.exe
      "C:\Windows\TEMP\MasonClient.exe"
      4⤵
      PID:2696
- - C:\Windows\TEMP\MasonClient.exe
    "C:\Windows\TEMP\MasonClient.exe"
    3⤵
    PID:2164
- C:\Windows\TEMP\MasonClient.exe
  "C:\Windows\TEMP\MasonClient.exe"
  2⤵
  PID:1824
- C:\Windows\TEMP\CREATIVE EAX.exe
  "C:\Windows\TEMP\CREATIVE EAX.exe"
  2⤵
  PID:3252
- - C:\Windows\TEMP\CREATIVE EAX.exe
    "C:\Windows\TEMP\CREATIVE EAX.exe"
    3⤵
    PID:3016
  - - C:\Windows\TEMP\CREATIVE EAX.exe
      "C:\Windows\TEMP\CREATIVE EAX.exe"
      4⤵
      PID:2992
  - - C:\Windows\TEMP\MasonClient.exe
      "C:\Windows\TEMP\MasonClient.exe"
      4⤵
      PID:2984
- - C:\Windows\TEMP\MasonClient.exe
    "C:\Windows\TEMP\MasonClient.exe"
    3⤵
    PID:5084
- C:\Windows\TEMP\MasonClient.exe
  "C:\Windows\TEMP\MasonClient.exe"
  2⤵
  PID:3264
- C:\Windows\TEMP\CREATIVE EAX.exe
  "C:\Windows\TEMP\CREATIVE EAX.exe"
  2⤵
  PID:4804
- - C:\Windows\TEMP\CREATIVE EAX.exe
    "C:\Windows\TEMP\CREATIVE EAX.exe"
    3⤵
    PID:4108
- - C:\Windows\TEMP\MasonClient.exe
    "C:\Windows\TEMP\MasonClient.exe"
    3⤵
    PID:2376
- C:\Windows\TEMP\MasonClient.exe
  "C:\Windows\TEMP\MasonClient.exe"
  2⤵
  PID:2616

C:\Windows\system32\config\systemprofile\AppData\Roaming\MasonClient.exe
C:\Windows\system32\config\systemprofile\AppData\Roaming\MasonClient.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "MasonClient" /tr "C:\Users\Admin\AppData\Roaming\MasonClient.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4204
- C:\Users\Admin\AppData\Local\Temp\tmp41A3.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp41A3.tmp.exe"
  2⤵
  - Checks computer location settings
  PID:4948
- - C:\Users\Admin\AppData\Local\Temp\MBR2.exe
    "C:\Users\Admin\AppData\Local\Temp\MBR2.exe"
    3⤵
    PID:3892
  - - C:\Windows\System32\MatrixMBR.exe
      "C:\Windows\System32\MatrixMBR.exe"
      4⤵
      PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\GDI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GDI.exe"
        5⤵
        
        PID:4912
    - - C:\Users\Admin\AppData\Local\Temp\MBR.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MBR.exe"
        5⤵
        
        PID:704
- - C:\Users\Admin\AppData\Local\Temp\TROLL5.exe
    "C:\Users\Admin\AppData\Local\Temp\TROLL5.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4460
- - C:\Users\Admin\AppData\Local\Temp\TROLL2.exe
    "C:\Users\Admin\AppData\Local\Temp\TROLL2.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4920

C:\Users\Admin\AppData\Roaming\MasonClient.exe
C:\Users\Admin\AppData\Roaming\MasonClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4948

C:\Users\Admin\AppData\Roaming\MasonClient.exe
"C:\Users\Admin\AppData\Roaming\MasonClient.exe"
1⤵
PID:2944

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x294 0x3f8
1⤵
PID:1596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

System Information Discovery