Analysis
- user interaction
yes - max time kernel
150s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/07/2026, 04:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
MasonService.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
MasonService.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target MasonService.exe
- Size 3.2MB
- Sample260728-e6dpssyakd
- SHA256 ac7e4670a3bf6ebdd3db36cb2d3fb569323a61824d9f2a916a76aae1a3fab671
- MD5 daa65750dd28de47f6108684f251024b
- SHA1 f4d825d29626139682ce46b60f3bcedf6134f7db
- SHA512 d1c1c720821fc3712db2dc92556891c67deb68c24b7e0c032557a4d5f50b65ac788d6505047ce84a41e2e9738536016d48aebb8b04cd41a3171d6d1d6ab06b42
- SSDEEP 384:GatW/BQxpgZ8oNxPlJVku8A91TQjE+WpH0L0SN3cywPdD0xpQE4cLvqbpD6L8kqV:PcQxpghxPp9jhf
- TLSH T1CAF51129DFBB29FF0026CC5BDBD28263F4549126699D9BA209D243EB0793D076493D3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
resource yara_rule behavioral1/memory/3388-19-0x0000000004120000-0x0000000004171000-memory.dmp family_donutloader - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation MasonService.exe - Creates new service(s) 2 TTPs
- Executes dropped EXE 2 IoCs
pid Process 1708 MasonService.exe 3388 MasonService.exe - Stops running service(s) 4 TTPs
- Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\MasonService.exe MasonService.exe File opened for modification C:\Windows\SysWOW64\MasonService.exe MasonService.exe - Launches sc.exe 6 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3868 sc.exe 4060 sc.exe 1256 sc.exe 4844 sc.exe 4220 sc.exe 5060 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MasonService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MasonService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MasonService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Disables Windows logging functionality 2 TTPs
Changes registry settings to disable Windows Event logging.
- Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\Windows Error Reporting MasonService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\Windows Error Reporting\Disabled = "1" MasonService.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4688 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4876 MasonService.exe Token: SeDebugPrivilege 1708 MasonService.exe Token: SeDebugPrivilege 3388 MasonService.exe Token: SeDebugPrivilege 4688 taskmgr.exe Token: SeSystemProfilePrivilege 4688 taskmgr.exe Token: SeCreateGlobalPrivilege 4688 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4876 wrote to memory of 1708 4876 MasonService.exe 84 PID 1708 wrote to memory of 1256 1708 MasonService.exe 85 PID 1708 wrote to memory of 4844 1708 MasonService.exe 88 PID 1708 wrote to memory of 4220 1708 MasonService.exe 90 PID 1708 wrote to memory of 5060 1708 MasonService.exe 92 PID 1708 wrote to memory of 3868 1708 MasonService.exe 94 PID 1708 wrote to memory of 4060 1708 MasonService.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\MasonService.exe"C:\Users\Admin\AppData\Local\Temp\MasonService.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\SysWOW64\MasonService.exe"C:\Windows\System32\MasonService.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\sc.exe"sc.exe" stop MasonService3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1256
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" delete MasonService3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4844
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" create MasonService binPath= "C:\Windows\System32\MasonService.exe /service" type= own start= auto3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4220
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" description MasonService "Mason Stable Service (Single Instance)"3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:5060
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" failure MasonService reset= 3600 actions= restart/100003⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3868
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" start MasonService3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4060
-
-
-
C:\Windows\SysWOW64\MasonService.exeC:\Windows\SysWOW64\MasonService.exe /service1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3388
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4688
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MasonService.exe.log
- Size 425B
- SHA256 34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
- MD5 4eaca4566b22b01cd3bc115b9b0b2196
- SHA1 e743e0792c19f71740416e7b3c061d9f1336bf94
- SHA512 bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1
- TLSH T112E0AB303321E0D489422F821C1C769503EF0359A110EE183848125FD4251172B312E3
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\MasonService.exe
- Size 3.2MB
- SHA256 ac7e4670a3bf6ebdd3db36cb2d3fb569323a61824d9f2a916a76aae1a3fab671
- MD5 daa65750dd28de47f6108684f251024b
- SHA1 f4d825d29626139682ce46b60f3bcedf6134f7db
- SHA512 d1c1c720821fc3712db2dc92556891c67deb68c24b7e0c032557a4d5f50b65ac788d6505047ce84a41e2e9738536016d48aebb8b04cd41a3171d6d1d6ab06b42
- SSDEEP 384:GatW/BQxpgZ8oNxPlJVku8A91TQjE+WpH0L0SN3cywPdD0xpQE4cLvqbpD6L8kqV:PcQxpghxPp9jhf
- TLSH T1CAF51129DFBB29FF0026CC5BDBD28263F4549126699D9BA209D243EB0793D076493D3C
- MD5 SHA1 SHA512 SSDEEP TLSH