d6769672dc09ad17d83e20da0c8d0f939ee8eaaa984dcbf5cb4e04a235ae208f

Analysis

max time kernel
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 00:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
MasonChess.exe
Size 1.3MB
Sample260720-a131aacy8z
SHA256 d6769672dc09ad17d83e20da0c8d0f939ee8eaaa984dcbf5cb4e04a235ae208f
MD5 f84c1d239d67924c4e70e0b7f9926373
SHA1 10362e850fffade1c56813c76f68f1f440b14a57
SHA512 e1e767b5b2581378963b86276aa0c0964e492f17948d804c3e5789a340f6bee8bce7ea278751daa4cadb2582be0b6e023d9a8eca6725ab2d995fbe81e0f70650
SSDEEP 24576:C/wtzYx3PgYWwocek/r2+AAYNh3tBULAkS7Le8:YwtkoA/qhlL3rmzS7
TLSH
T11955C622A687D9A3C40E1270DDD7D32977B2E0B46B368787BA4C9BEF7D213A11CC5146
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2320	nasm.exe
2564	nasm.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MasonChess.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4928	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MasonChess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nasm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2376	MasonChess.exe
Token: 33	6112	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	6112	AUDIODG.EXE
Token: SeDebugPrivilege	2376	MasonChess.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2376	MasonChess.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2376	MasonChess.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2320	2376	MasonChess.exe	89
PID 2376 wrote to memory of 2564	2376	MasonChess.exe	92
PID 2376 wrote to memory of 4928	2376	MasonChess.exe	94
PID 4928 wrote to memory of 2464	4928	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\MasonChess.exe
"C:\Users\Admin\AppData\Local\Temp\MasonChess.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Users\Admin\AppData\Local\Temp\nasm.exe
  "nasm.exe" -f bin mbr_temp.asm -o mbr_temp.bin
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2320
- C:\Users\Admin\AppData\Local\Temp\nasm.exe
  "nasm.exe" -f bin mbr_temp.asm -o mbr_temp.bin
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k reg delete HKCR /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\Windows\SysWOW64\reg.exe
    reg delete HKCR /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2464

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F4 0x00000000000004F8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mbr_temp.asm

Path C:\Users\Admin\AppData\Local\Temp\mbr_temp.asm
Size 790B
SHA256 45a342877c16247c906eedf06e88f3e17b565c2f29902f065913abb12d324654
MD5 0ba14b566b784a32eb73837dda3e2100
SHA1 fdc1d73407d5e6d61a835db4f2270a246f84c2df
SHA512 0ebcd3c800f83d4a5bffea29989797ee5f04ab6621a65e33274375862b1a8881e000a5d57cb7ccc2706bccdd1d4e5b6f418f4cfbe678c4e581939e11ba69b285
TLSH
T1DA01F26A185257CA14FB454DE8C17F0BE2ED965F81C62C2AB30C03378FB69615A7066C
MD5 SHA1 SHA512 TLSH

Submit Download

mbr_temp.asm

Path C:\Users\Admin\AppData\Local\Temp\mbr_temp.asm
Size 789B
SHA256 4b878639dc0f71ebcf7279dc54342528363a818cc7af559ab1093ff0b3d6022d
MD5 0e7c962de4d6fb3649c4ac4eef7702cc
SHA1 8317b5831057b4da8243fba866f4a85f96a6bc57
SHA512 33915bbebf8479d1b0e15408d4529ada0018ae52d3ce5e97c1f64931d9ebefa829fe75f818b52529d26421fcd1fe0ba81e69f73d0c920d6b6ea5d348ea128c40
TLSH
T1E80176690C4217CA00FF454CE8C27F0BE2DC961F81C62C2AB30C03378FB69611A7066C
MD5 SHA1 SHA512 TLSH

Submit Download

mbr_temp.bin

Path C:\Users\Admin\AppData\Local\Temp\mbr_temp.bin
Size 512B
SHA256 74cc853be8142f1bb27c3e1b232197d07755cd5d53075e44b64dd7cd3a6ae084
MD5 dd106e1b4e7aee484a17de61211fc678
SHA1 2143528ab7e524a16ab84b9829a41c1af35f8b89
SHA512 91fe9f2cd2785e0eea9e2784128e173d7368ba23458df55624986e602ecea58080a28353d0ca25de1cac96953bdceb648fa53c159d70ebc89bfa9f3eb519fbef
TLSH
T1F6F09297908AE286E8060A74B41445685628A6E81105E89294518A1A22A8AB05E0975A
MD5 SHA1 SHA512 TLSH

Submit Download

mbr_temp.bin

Path C:\Users\Admin\AppData\Local\Temp\mbr_temp.bin
Size 512B
SHA256 d8ee48365b57e29fee8895ac549ca58730e9c14bc5eafb3d11c144b71d3d7009
MD5 33514ec146920d24820f6eda87b9f7ef
SHA1 ef33db724db199fea78555be2008cf27d376f131
SHA512 d9b24aa67e2395c4c6c61a2446aa389e6ead53409681d6a0a20a9077d0c3cd6554fbcd406523ce0dd437152dbfebb90477e540e1aefb5424593f740081223356
TLSH
T1B0F012D7908ED383E80A0AB4711559B82424A7F9150AEC92C452CD1733D8FE11F5575F
MD5 SHA1 SHA512 TLSH

Submit Download

nasm.exe

Path C:\Users\Admin\AppData\Local\Temp\nasm.exe
Size 1.2MB
SHA256 a4735165141570d966b577d594c0541c29baed4978078c1c7237b855f8592a87
MD5 2f17bab79b9e5caa79c4f493a18fb06c
SHA1 f3eb8a09529b82fc08e919517e098644ddc01004
SHA512 37c62999e11f3a44c02bad2ad9941213c0264312f228de32466818ec84d745312f941f4adf6e4bf3f49d5d91e8df56dbf39b7966ed8d4b214b484c93635ca154
SSDEEP 24576:2zYx3PgYWwocek/r2+AAYNh3tBULAkS7Le:2koA/qhlL3rmzS7
TLSH
T1A4459422A687D9A3C40E1270DDC7D32977B2E0F46B368B87BA4C97AF7D213A11CC5546
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2320-15-0x0000000000400000-0x0000000000539000-memory.dmp

Download

memory/2376-5-0x0000000074540000-0x0000000074CFC000-memory.dmp

Download

memory/2376-4-0x00000000054A0000-0x00000000054AA000-memory.dmp

Download

memory/2376-3-0x00000000054E0000-0x0000000005572000-memory.dmp

Download

memory/2376-0-0x0000000074552000-0x0000000074553000-memory.dmp

Download

memory/2376-17-0x0000000074552000-0x0000000074553000-memory.dmp

Download

memory/2376-18-0x0000000074540000-0x0000000074CFC000-memory.dmp

Download

memory/2376-2-0x0000000005B60000-0x000000000611A000-memory.dmp

Download

memory/2376-1-0x0000000000960000-0x0000000000AB4000-memory.dmp

Download

memory/2564-26-0x0000000000400000-0x0000000000539000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads