donutloader | c836f1e0b97cc0dc3d8942ba1858590df48f227d75ab955ddea3b2921abe4b2f

Analysis

max time kernel
137s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 02:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mns.exe
Size 1.1MB
Sample260721-c2sl2ses7v
SHA256 c836f1e0b97cc0dc3d8942ba1858590df48f227d75ab955ddea3b2921abe4b2f
MD5 3f1a6a648115ad71bd6e5adfb7d746a2
SHA1 2f1a9d7cf05e4646c2dc6381a09e5086e1bf6215
SHA512 453d8e4a00ddb903b06932321c64fe4ae791188598b8edf8fdc38d6235c75732d9472c8f85eae01372433225ef01db4ddbc46c3bc5f831437ddd58d455256eee
SSDEEP 12288:seCGDdog0ttPLmXGn3s78CSTGZPtAsA1cif/qYs82xl6kmp34duCDTX73L:XUBUTAqiHqYdpkmFCvLL
TLSH
T1FF458D46F75391BDD52BC1758AAB1633F632B80C4135BB7F5A5487BA3F92B000628B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware defense_evasion execution donutloader neptunerat loader persistence spyware trojan

Malware Config

Extracted

Family

neptunerat

russn-48812.portmap.host:48812

Attributes

filename
USB.exe
group
MasonGroup
key
FMyLVvjBTyADMJTG
rat_name
MasonRAT

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
trojan neptunerat

Detects DonutLoader 3 IoCs

loader

resource	yara_rule
behavioral2/memory/4224-35-0x00000000027A0000-0x00000000027EC000-memory.dmp	family_donutloader
behavioral2/memory/2832-46-0x0000000002F00000-0x0000000002F14000-memory.dmp	family_donutloader
behavioral2/memory/4224-45-0x000000001B250000-0x000000001B26C000-memory.dmp	family_donutloader

Detects NeptuneRAT stealer 1 IoCs

resource	yara_rule
behavioral2/memory/2832-48-0x0000000003460000-0x0000000003472000-memory.dmp	family_neptunerat

Executes dropped EXE 12 IoCs

pid	Process
2384	injection.exe
3136	msnrt.exe
4620	DiagServiceMonitor.exe
4116	DiagServiceMonitor.exe
4940	WUDFHost.exe
3596	DiagServiceMonitor.exe
4224	WUDFHost.exe
2488	40jnjfzg.4au.exe
4668	explorer.exe
4984	explorer.exe
6048	explorer.exe
4592	explorer.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\MyApplication	WUDFHost.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	explorer.exe

Checks system information in the registry 2 TTPs 8 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	DiagServiceMonitor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	DiagServiceMonitor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	DiagServiceMonitor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	msnrt.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	msnrt.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	DiagServiceMonitor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	DiagServiceMonitor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	DiagServiceMonitor.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4276	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6040	cmd.exe
4112	cmd.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies data under HKEY_USERS 54 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "17110992,504928405,41816131,507286179,7202265,17110988,7153487,504928410,577889346,5804129,17962391,508368333,17962392,41484365,24262478,9179409,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262477,25036127,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079,7202269"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,940 10,941 10,942 10,943 10,940 15,1329 15,940 6,944 50,944 10,941 15,942 15,940 50,943 15,944 6,944 15,943 6,1329 50,1329 100,1329 6,941 6,942 6,944 100,940 100"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1784601314"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Mon, 20 Jul 2026 14:03:16 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={057FD109-768C-4771-9426-9204C3D31808}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe

Modifies registry class 21 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\NotificationData	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6084	schtasks.exe
2240	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 4 IoCs

pid	Process
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3136	msnrt.exe
3136	msnrt.exe
3136	msnrt.exe
3136	msnrt.exe
4620	DiagServiceMonitor.exe
4620	DiagServiceMonitor.exe
4620	DiagServiceMonitor.exe
4620	DiagServiceMonitor.exe
4116	DiagServiceMonitor.exe
4116	DiagServiceMonitor.exe
4116	DiagServiceMonitor.exe
4116	DiagServiceMonitor.exe
3596	DiagServiceMonitor.exe
3596	DiagServiceMonitor.exe
3596	DiagServiceMonitor.exe
3596	DiagServiceMonitor.exe
4224	WUDFHost.exe
4224	WUDFHost.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe
2488	40jnjfzg.4au.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2832	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2384	injection.exe
Token: SeDebugPrivilege	4940	WUDFHost.exe
Token: SeDebugPrivilege	4224	WUDFHost.exe
Token: SeShutdownPrivilege	2832	explorer.exe
Token: SeCreatePagefilePrivilege	2832	explorer.exe
Token: SeShutdownPrivilege	2832	explorer.exe
Token: SeCreatePagefilePrivilege	2832	explorer.exe
Token: SeDebugPrivilege	2832	explorer.exe
Token: SeShutdownPrivilege	2832	explorer.exe
Token: SeCreatePagefilePrivilege	2832	explorer.exe
Token: SeShutdownPrivilege	2832	explorer.exe
Token: SeCreatePagefilePrivilege	2832	explorer.exe
Token: SeShutdownPrivilege	2832	explorer.exe
Token: SeCreatePagefilePrivilege	2832	explorer.exe
Token: SeDebugPrivilege	2488	40jnjfzg.4au.exe
Token: SeShutdownPrivilege	2832	explorer.exe
Token: SeCreatePagefilePrivilege	2832	explorer.exe
Token: SeShutdownPrivilege	2832	explorer.exe
Token: SeCreatePagefilePrivilege	2832	explorer.exe
Token: SeShutdownPrivilege	2832	explorer.exe
Token: SeCreatePagefilePrivilege	2832	explorer.exe
Token: SeAuditPrivilege	3232	svchost.exe
Token: SeShutdownPrivilege	2832	explorer.exe
Token: SeCreatePagefilePrivilege	2832	explorer.exe
Token: SeShutdownPrivilege	2832	explorer.exe
Token: SeCreatePagefilePrivilege	2832	explorer.exe
Token: SeShutdownPrivilege	2832	explorer.exe
Token: SeCreatePagefilePrivilege	2832	explorer.exe
Token: SeShutdownPrivilege	2832	explorer.exe
Token: SeCreatePagefilePrivilege	2832	explorer.exe
Token: SeShutdownPrivilege	2832	explorer.exe
Token: SeCreatePagefilePrivilege	2832	explorer.exe
Token: SeShutdownPrivilege	2832	explorer.exe
Token: SeCreatePagefilePrivilege	2832	explorer.exe
Token: SeShutdownPrivilege	2832	explorer.exe
Token: SeCreatePagefilePrivilege	2832	explorer.exe
Token: SeShutdownPrivilege	2832	explorer.exe
Token: SeCreatePagefilePrivilege	2832	explorer.exe
Token: SeShutdownPrivilege	2832	explorer.exe
Token: SeCreatePagefilePrivilege	2832	explorer.exe
Token: SeShutdownPrivilege	2832	explorer.exe
Token: SeCreatePagefilePrivilege	2832	explorer.exe
Token: SeShutdownPrivilege	2832	explorer.exe
Token: SeCreatePagefilePrivilege	2832	explorer.exe
Token: SeShutdownPrivilege	2832	explorer.exe
Token: SeCreatePagefilePrivilege	2832	explorer.exe
Token: SeShutdownPrivilege	2832	explorer.exe
Token: SeCreatePagefilePrivilege	2832	explorer.exe
Token: SeShutdownPrivilege	2832	explorer.exe
Token: SeCreatePagefilePrivilege	2832	explorer.exe
Token: SeShutdownPrivilege	2832	explorer.exe
Token: SeCreatePagefilePrivilege	2832	explorer.exe
Token: SeShutdownPrivilege	2832	explorer.exe
Token: SeCreatePagefilePrivilege	2832	explorer.exe
Token: SeShutdownPrivilege	2832	explorer.exe
Token: SeCreatePagefilePrivilege	2832	explorer.exe
Token: SeShutdownPrivilege	2832	explorer.exe
Token: SeCreatePagefilePrivilege	2832	explorer.exe
Token: SeShutdownPrivilege	2832	explorer.exe
Token: SeCreatePagefilePrivilege	2832	explorer.exe
Token: SeShutdownPrivilege	2832	explorer.exe
Token: SeCreatePagefilePrivilege	2832	explorer.exe
Token: SeShutdownPrivilege	2832	explorer.exe
Token: SeCreatePagefilePrivilege	2832	explorer.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe
2832	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3396	Conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 2384	4936	mns.exe	89
PID 4936 wrote to memory of 3136	4936	mns.exe	90
PID 3136 wrote to memory of 4620	3136	msnrt.exe	91
PID 4620 wrote to memory of 4116	4620	DiagServiceMonitor.exe	92
PID 4620 wrote to memory of 6040	4620	DiagServiceMonitor.exe	93
PID 6040 wrote to memory of 4232	6040	cmd.exe	95
PID 4620 wrote to memory of 4112	4620	DiagServiceMonitor.exe	96
PID 4112 wrote to memory of 2680	4112	cmd.exe	98
PID 4112 wrote to memory of 6084	4112	cmd.exe	99
PID 4620 wrote to memory of 4276	4620	DiagServiceMonitor.exe	100
PID 4276 wrote to memory of 4600	4276	cmd.exe	102
PID 4276 wrote to memory of 5324	4276	cmd.exe	103
PID 4224 wrote to memory of 2488	4224	WUDFHost.exe	109
PID 4224 wrote to memory of 2832	4224	WUDFHost.exe	80
PID 2832 wrote to memory of 5508	2832	explorer.exe
PID 2832 wrote to memory of 2240	2832	explorer.exe	111
PID 2488 wrote to memory of 756	2488	40jnjfzg.4au.exe	5
PID 2488 wrote to memory of 980	2488	40jnjfzg.4au.exe	9
PID 2488 wrote to memory of 988	2488	40jnjfzg.4au.exe	10
PID 2488 wrote to memory of 1008	2488	40jnjfzg.4au.exe	11
PID 2488 wrote to memory of 1036	2488	40jnjfzg.4au.exe	13
PID 2488 wrote to memory of 1116	2488	40jnjfzg.4au.exe	14
PID 2488 wrote to memory of 1188	2488	40jnjfzg.4au.exe	15
PID 2488 wrote to memory of 1284	2488	40jnjfzg.4au.exe	16
PID 2488 wrote to memory of 1340	2488	40jnjfzg.4au.exe	17
PID 2488 wrote to memory of 1360	2488	40jnjfzg.4au.exe	18
PID 2488 wrote to memory of 1420	2488	40jnjfzg.4au.exe	19
PID 2488 wrote to memory of 1564	2488	40jnjfzg.4au.exe	22
PID 2488 wrote to memory of 1592	2488	40jnjfzg.4au.exe	23
PID 2488 wrote to memory of 1664	2488	40jnjfzg.4au.exe	24
PID 2488 wrote to memory of 1744	2488	40jnjfzg.4au.exe	25
PID 2488 wrote to memory of 1844	2488	40jnjfzg.4au.exe	26
PID 2488 wrote to memory of 1852	2488	40jnjfzg.4au.exe	27
PID 2488 wrote to memory of 1992	2488	40jnjfzg.4au.exe	28
PID 2488 wrote to memory of 1184	2488	40jnjfzg.4au.exe	29
PID 2488 wrote to memory of 1768	2488	40jnjfzg.4au.exe	30
PID 2488 wrote to memory of 472	2488	40jnjfzg.4au.exe	31
PID 2488 wrote to memory of 2156	2488	40jnjfzg.4au.exe	32
PID 2488 wrote to memory of 2164	2488	40jnjfzg.4au.exe	33
PID 2488 wrote to memory of 2228	2488	40jnjfzg.4au.exe	34
PID 2488 wrote to memory of 2372	2488	40jnjfzg.4au.exe	35
PID 2488 wrote to memory of 2472	2488	40jnjfzg.4au.exe	36
PID 2488 wrote to memory of 2576	2488	40jnjfzg.4au.exe	37
PID 2488 wrote to memory of 2612	2488	40jnjfzg.4au.exe	38
PID 2488 wrote to memory of 2632	2488	40jnjfzg.4au.exe	39
PID 2488 wrote to memory of 2704	2488	40jnjfzg.4au.exe	40
PID 2488 wrote to memory of 2868	2488	40jnjfzg.4au.exe	41
PID 2488 wrote to memory of 2940	2488	40jnjfzg.4au.exe	42
PID 2488 wrote to memory of 3008	2488	40jnjfzg.4au.exe	43
PID 2488 wrote to memory of 2216	2488	40jnjfzg.4au.exe	44
PID 2488 wrote to memory of 3088	2488	40jnjfzg.4au.exe	45
PID 2488 wrote to memory of 3148	2488	40jnjfzg.4au.exe	46
PID 2488 wrote to memory of 3232	2488	40jnjfzg.4au.exe	48
PID 2488 wrote to memory of 3476	2488	40jnjfzg.4au.exe	50
PID 2488 wrote to memory of 3608	2488	40jnjfzg.4au.exe	51
PID 2488 wrote to memory of 3616	2488	40jnjfzg.4au.exe	52
PID 2488 wrote to memory of 3684	2488	40jnjfzg.4au.exe	53
PID 2488 wrote to memory of 3708	2488	40jnjfzg.4au.exe	54
PID 2488 wrote to memory of 3720	2488	40jnjfzg.4au.exe	55
PID 2488 wrote to memory of 3728	2488	40jnjfzg.4au.exe	56
PID 2488 wrote to memory of 3260	2488	40jnjfzg.4au.exe	57
PID 2488 wrote to memory of 1148	2488	40jnjfzg.4au.exe	58
PID 2488 wrote to memory of 4348	2488	40jnjfzg.4au.exe	59
PID 2488 wrote to memory of 4392	2488	40jnjfzg.4au.exe	60

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5324	attrib.exe

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:756
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:988
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1188

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:980

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-8697ed74-3874-4809-9a54-5accc37e89c6 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-fecf4d94-cf3d-4f7e-a5f1-82a82438267d -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-af3399d5-821a-478f-a88e-452ff7773c7c -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-d11684ea-7e91-4182-ad3f-4a9b3e6b8781 -LifetimeId:094a9692-71b6-4d77-8c82-3623bb6af5d8 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:1008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1116

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1340

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1664
- C:\Users\Admin\AppData\Roaming\WUDFHost.exe
  "C:\Users\Admin\AppData\Roaming\WUDFHost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4224
- - C:\Users\Admin\AppData\Local\Temp\40jnjfzg.4au.exe
    "C:\Users\Admin\AppData\Local\Temp\40jnjfzg.4au.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2488
- C:\Users\Admin\AppData\Roaming\explorer.exe
  "C:\Users\Admin\AppData\Roaming\explorer.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:4984
- C:\Users\Admin\AppData\Roaming\explorer.exe
  "C:\Users\Admin\AppData\Roaming\explorer.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:6048
- C:\Users\Admin\AppData\Roaming\explorer.exe
  "C:\Users\Admin\AppData\Roaming\explorer.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:4592

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc
1⤵
PID:1844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1852

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1184
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:6028
- - C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    3⤵
    - Drops desktop.ini file(s)
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2832
  - - C:\Users\Admin\AppData\Local\Temp\mns.exe
      "C:\Users\Admin\AppData\Local\Temp\mns.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4936
    - - C:\Users\Admin\AppData\Local\Temp\MasonDrop\injection.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonDrop\injection.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2384
    - - C:\Users\Admin\AppData\Local\Temp\MasonDrop\msnrt.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonDrop\msnrt.exe"
        5⤵
        Executes dropped EXE
        Checks system information in the registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3136
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DiagServiceMonitor.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DiagServiceMonitor.exe" --r
        6⤵
        Executes dropped EXE
        Checks system information in the registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4620
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DiagServiceMonitor.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DiagServiceMonitor.exe" --wd 4620
        7⤵
        Executes dropped EXE
        Checks system information in the registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:4116
        
        C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c chcp 65001 >nul && hòÊ³¥·t
        7⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:6040
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:4232
        
        C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c chcp 65001 >nul && schtasks /create /f /sc onlogon /tn "DiagServiceMonitor" /tr "\"C:\Users\Admin\AppData\Roaming\DiagServiceMonitor.exe\"" /ru ""
        7⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4112
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:2680
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /tn "DiagServiceMonitor" /tr "\"C:\Users\Admin\AppData\Roaming\DiagServiceMonitor.exe\"" /ru ""
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6084
        
        C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c chcp 65001 >nul && attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DiagServiceMonitor.exe"
        7⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:4276
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:4600
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DiagServiceMonitor.exe"
        8⤵
        Views/modifies file attributes
        
        PID:5324
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "explorer" /tr "C:\Users\Admin\AppData\Roaming\explorer.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1768

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:2164

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2372

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2472

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
PID:2576
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:000000000000026C;0000000000000270;
  2⤵
  PID:4996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2612

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2632

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc
1⤵
PID:2704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc
1⤵
PID:2940

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:3008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2216

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:3088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:3148

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3232

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:3608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:3684

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:3720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:1148

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4348

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4684

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4692

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:2284

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
PID:5196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc
1⤵
PID:5536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:2696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:1136

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2184

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:5100

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3664

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:1144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:6004

C:\Users\Admin\AppData\Roaming\WUDFHost.exe
C:\Users\Admin\AppData\Roaming\WUDFHost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4940

C:\Users\Admin\AppData\Roaming\DiagServiceMonitor.exe
"C:\Users\Admin\AppData\Roaming\DiagServiceMonitor.exe"
1⤵
- Executes dropped EXE
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
PID:3596

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of SetWindowsHookEx
PID:3396

C:\Users\Admin\AppData\Roaming\explorer.exe
C:\Users\Admin\AppData\Roaming\explorer.exe
1⤵
- Executes dropped EXE
- Modifies registry class
PID:4668

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:2812

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:5820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3
Size 422B
SHA256 370b445a972c9610d63659302ca67e59f6e8d4e182991f12c0a29bc09eff2d3a
MD5 26598cc582923bd7ee9ce6759474b3fd
SHA1 2fe8690bc64e3e93e5d6acce7325467cb9f43f7d
SHA512 9fe6a8f40f88c334f48436d663cde7aad59c8e87ebd6449b13cbca935b1e4bc36064b986888e2df4c462a1edbf4c8e47f975deb538fc58b729a25a89447c1613
TLSH
T1BBE0685428FDC019E632BA3C6BC81E6E0A3AF72344083A78136041085105C504D72732
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
Size 412B
SHA256 fd263c44f654b7d1e67a13d42e61351e37cdaa090824a05b33d68e3465a7bc77
MD5 9e11a0b83b74c86d16b46300a818b38a
SHA1 d23ae73dd36ce4dc246487519a40f4669a61ae88
SHA512 b0b30c9dc8c5513272f452ac72bba9247cf7534c1a3fb85db64b905ebcccb673892d9c13982f085635b99a9a65394f76cc4176856422603573609edd82bc021e
TLSH
T16CE0C01414FB411EF4FAD1380BE971619656F0710435E1B61AD05704A606A00EC11D34
MD5 SHA1 SHA512 TLSH

Submit Download

40jnjfzg.4au.exe

Path C:\Users\Admin\AppData\Local\Temp\40jnjfzg.4au.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

injection.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonDrop\injection.exe
Size 474KB
SHA256 27a5c4f69c991b2e6988537a27d16b1b75069021cbb2f705a5716560a57017a6
MD5 30d6a0127cc7dd90fa225e08d546d03c
SHA1 d3fcff577b391b502387d58fa2aaaae44a4ab317
SHA512 dced7edef3cb73ec3a51041dc334d00a97eee68b0b739ad5804a0efd8c9e3ff122f2b30258e30d3948084ec19ca30f77b05937b130ec0229e84c010d12694364
SSDEEP 12288:keCGDdog0ttPLmXGn3s78CSTGZPtAsA1cif:PUBUTAqi
TLSH
T12AA4A0013B988697F5AD33B9A0A30311D778E9595A51E78FB8DC47EA2F9334119033AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msnrt.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonDrop\msnrt.exe
Size 648KB
SHA256 78a1a59e103a0bdccec0fe1873c9fe13e9473aa8e388b54b33d4386e4e7a6de0
MD5 e7a4d3aee51a5571972514333474dce6
SHA1 a2422860e1336671a658716bfecc20ed17ef07d5
SHA512 387ce0bc1e263f0a18e62b0726c32df59107037582ae4c5633f9b2d838909d40a02543fdc1c6ef54745a75dd8a9cd175d880788b2627ed06a2d2500d37a945d5
SSDEEP 6144:a3zWXIs81huxaQKC6kZmwcOcq/ypHj4igrpfuZgisDPXsJOUS5qA:mqYs82xl6kmp34duCDTX73
TLSH
T1CCE4294AF653A1BCD52BC1718BAF6633B932B81C4135797F5A14C77A3EA1E500638F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2098e080cf7ac4.automaticDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5a2098e080cf7ac4.automaticDestinations-ms
Size 2KB
SHA256 e0ef60ee042b29498a2ca36ecc72892ad0b1d4227611658b17bf76697de26289
MD5 6d7a36fb5b5a93d9a25c809143f02645
SHA1 768f1aea472b875dbde8d4f5a066e5b8a8854dca
SHA512 ffaac7e897ab550c83884649e271b6f712c90df5ccab628fb182740f2223574265f77a10e414dca3507e8a1f86b4f8db580ad46c800a9ab071b7fd49ac86ee85
TLSH
T14151ED0033E8E62AE0A05E324DB2C046A7307D41AD01E10F72AA338F88B6640E078312
MD5 SHA1 SHA512 TLSH

Submit Download

explorer.exe

Path C:\Users\Admin\AppData\Roaming\explorer.exe
Size 2.7MB
SHA256 75a58fed6d38498775ec288ff7da54209c47cea2625f7eaedf15ef2d0e6c1add
MD5 38c5baa5bb4685a66f7b661b17ba53d7
SHA1 8ac453ad7bbe88d8b779ee7b5cd7a7b44dac115f
SHA512 b69d6cd01b2f07babe5e45ed30bf208701e909812ccab35abd7eedbbee9d3f957c7facdc8ba2d86980a98f9f1623f36f0376374f56e67a2ebe1aa5276f2b4bf2
SSDEEP 49152:OGwY2N3ZkD80rbU1CbyrOwGlxEs5Itbw8A7/eFwz:OcuGlGtbw8a0E
TLSH
T1F5D59D1D27E840C4D1BA803CC9468B27E9713C251731A6DB0660FA7D6F33AE59A7EF52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/472-133-0x000002518ED10000-0x000002518ED3B000-memory.dmp

Download

memory/472-134-0x00007FFB37CA0000-0x00007FFB37CB0000-memory.dmp

Download

memory/756-52-0x0000023A369E0000-0x0000023A36A05000-memory.dmp

Download

memory/756-53-0x0000023A36A10000-0x0000023A36A3B000-memory.dmp

Download

memory/756-54-0x00007FFB37CA0000-0x00007FFB37CB0000-memory.dmp

Download

memory/980-57-0x000002A364720000-0x000002A36474B000-memory.dmp

Download

memory/980-58-0x00007FFB37CA0000-0x00007FFB37CB0000-memory.dmp

Download

memory/988-62-0x00007FFB37CA0000-0x00007FFB37CB0000-memory.dmp

Download

memory/988-61-0x0000023539090000-0x00000235390BB000-memory.dmp

Download

memory/1008-65-0x0000021CF0A90000-0x0000021CF0ABB000-memory.dmp

Download

memory/1008-66-0x00007FFB37CA0000-0x00007FFB37CB0000-memory.dmp

Download

memory/1036-69-0x000001BE9D730000-0x000001BE9D75B000-memory.dmp

Download

memory/1036-70-0x00007FFB37CA0000-0x00007FFB37CB0000-memory.dmp

Download

memory/1116-74-0x00007FFB37CA0000-0x00007FFB37CB0000-memory.dmp

Download

memory/1116-73-0x0000022634640000-0x000002263466B000-memory.dmp

Download

memory/1184-125-0x0000022D641A0000-0x0000022D641CB000-memory.dmp

Download

memory/1184-126-0x00007FFB37CA0000-0x00007FFB37CB0000-memory.dmp

Download

memory/1188-77-0x0000012E46070000-0x0000012E4609B000-memory.dmp

Download

memory/1188-78-0x00007FFB37CA0000-0x00007FFB37CB0000-memory.dmp

Download

memory/1284-81-0x000002AD791C0000-0x000002AD791EB000-memory.dmp

Download

memory/1284-82-0x00007FFB37CA0000-0x00007FFB37CB0000-memory.dmp

Download

memory/1340-86-0x00007FFB37CA0000-0x00007FFB37CB0000-memory.dmp

Download

memory/1340-85-0x0000024FB24A0000-0x0000024FB24CB000-memory.dmp

Download

memory/1360-89-0x00000276C49F0000-0x00000276C4A1B000-memory.dmp

Download

memory/1360-90-0x00007FFB37CA0000-0x00007FFB37CB0000-memory.dmp

Download

memory/1420-94-0x00007FFB37CA0000-0x00007FFB37CB0000-memory.dmp

Download

memory/1420-93-0x00000260448B0000-0x00000260448DB000-memory.dmp

Download

memory/1564-98-0x00007FFB37CA0000-0x00007FFB37CB0000-memory.dmp

Download

memory/1564-97-0x000002B386F60000-0x000002B386F8B000-memory.dmp

Download

memory/1592-101-0x00000213462D0000-0x00000213462FB000-memory.dmp

Download

memory/1592-102-0x00007FFB37CA0000-0x00007FFB37CB0000-memory.dmp

Download

memory/1664-106-0x00007FFB37CA0000-0x00007FFB37CB0000-memory.dmp

Download

memory/1664-105-0x00000205BBFC0000-0x00000205BBFEB000-memory.dmp

Download

memory/1744-110-0x00007FFB37CA0000-0x00007FFB37CB0000-memory.dmp

Download

memory/1744-109-0x000002A854AE0000-0x000002A854B0B000-memory.dmp

Download

memory/1768-129-0x00000142798D0000-0x00000142798FB000-memory.dmp

Download

memory/1768-130-0x00007FFB37CA0000-0x00007FFB37CB0000-memory.dmp

Download

memory/1844-114-0x00007FFB37CA0000-0x00007FFB37CB0000-memory.dmp

Download

memory/1844-113-0x0000022199370000-0x000002219939B000-memory.dmp

Download

memory/1852-118-0x00007FFB37CA0000-0x00007FFB37CB0000-memory.dmp

Download

memory/1852-117-0x0000026078FB0000-0x0000026078FDB000-memory.dmp

Download

memory/1992-122-0x00007FFB37CA0000-0x00007FFB37CB0000-memory.dmp

Download

memory/1992-121-0x000002DCD56B0000-0x000002DCD56DB000-memory.dmp

Download

memory/2156-138-0x00007FFB37CA0000-0x00007FFB37CB0000-memory.dmp

Download

memory/2156-137-0x0000013A83F20000-0x0000013A83F4B000-memory.dmp

Download

memory/2164-142-0x00007FFB37CA0000-0x00007FFB37CB0000-memory.dmp

Download

memory/2164-141-0x000001F1387D0000-0x000001F1387FB000-memory.dmp

Download

memory/2228-146-0x00007FFB37CA0000-0x00007FFB37CB0000-memory.dmp

Download

memory/2228-145-0x0000025A84450000-0x0000025A8447B000-memory.dmp

Download

memory/2372-150-0x00007FFB37CA0000-0x00007FFB37CB0000-memory.dmp

Download

memory/2372-149-0x000002020F4E0000-0x000002020F50B000-memory.dmp

Download

memory/2384-11-0x00007FFB5540F000-0x00007FFB55410000-memory.dmp

Download

memory/2384-32-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/2384-33-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/2384-13-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/2384-18-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/2384-12-0x0000000000010000-0x000000000008C000-memory.dmp

Download

memory/2472-154-0x00007FFB37CA0000-0x00007FFB37CB0000-memory.dmp

Download

memory/2472-153-0x0000017B176D0000-0x0000017B176FB000-memory.dmp

Download

memory/2488-50-0x00007FFB77B60000-0x00007FFB77DC3000-memory.dmp

Download

memory/2488-51-0x00007FFB764B0000-0x00007FFB76577000-memory.dmp

Download

memory/2576-157-0x0000016DB9490000-0x0000016DB94BB000-memory.dmp

Download

memory/2576-158-0x00007FFB37CA0000-0x00007FFB37CB0000-memory.dmp

Download

memory/2612-162-0x00007FFB37CA0000-0x00007FFB37CB0000-memory.dmp

Download

memory/2612-161-0x00000282444D0000-0x00000282444FB000-memory.dmp

Download

memory/2832-48-0x0000000003460000-0x0000000003472000-memory.dmp

Download

memory/2832-46-0x0000000002F00000-0x0000000002F14000-memory.dmp

Download

memory/2832-47-0x0000000003400000-0x0000000003401000-memory.dmp

Download

memory/3136-27-0x00007FF6BC600000-0x00007FF6BC6BF000-memory.dmp

Download

memory/3596-31-0x00007FF6157A0000-0x00007FF61585F000-memory.dmp

Download

memory/4224-35-0x00000000027A0000-0x00000000027EC000-memory.dmp

Download

memory/4224-36-0x0000000002920000-0x000000000294C000-memory.dmp

Download

memory/4224-45-0x000000001B250000-0x000000001B26C000-memory.dmp

Download

memory/4936-24-0x00007FF6F5390000-0x00007FF6F539D000-memory.dmp

Download