Analysis
- user interaction
yes - max time kernel
2s - max time network
7s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
13/08/2026, 07:32
Errors
General
- Target AngryVirus.exe
- Size 482KB
- Sample260813-jdb3qadk21
- SHA256 b6dac480e4c7f15e8de6633ee9b52b3bda0b6b2f1897a76ddb4ab0ffb76b2588
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\AngryVirus.exe"C:\Users\Admin\AppData\Local\Temp\AngryVirus.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe" /RL HIGHEST2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\MasonMBR-S.exe"C:\Users\Admin\AppData\Local\Temp\MasonMBR-S.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"2⤵
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4f0 0x3fc1⤵
-
C:\Users\Admin\AppData\Local\Temp\MasonMBR.exeC:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
MasonGDI.exe
MasonMBR-S.exe
MasonMBR.exe
MasonRootkit.exe
memory/404-61-0x000001BC003A0000-0x000001BC003CB000-memory.dmp
memory/404-62-0x00007FF9E5BF0000-0x00007FF9E5C00000-memory.dmp
memory/524-86-0x00007FF9E5BF0000-0x00007FF9E5C00000-memory.dmp
memory/524-84-0x00000236F5530000-0x00000236F555B000-memory.dmp
memory/600-51-0x000001C0C5C00000-0x000001C0C5C2B000-memory.dmp
memory/600-49-0x000001C0C5830000-0x000001C0C5855000-memory.dmp
memory/600-52-0x00007FF9E5BF0000-0x00007FF9E5C00000-memory.dmp
memory/644-96-0x00007FF9E5BF0000-0x00007FF9E5C00000-memory.dmp
memory/644-94-0x000001AC08C90000-0x000001AC08CBB000-memory.dmp
memory/656-57-0x00007FF9E5BF0000-0x00007FF9E5C00000-memory.dmp
memory/656-56-0x0000021EA5EF0000-0x0000021EA5F1B000-memory.dmp
memory/860-75-0x000002B5D7B20000-0x000002B5D7B4B000-memory.dmp
memory/860-77-0x00007FF9E5BF0000-0x00007FF9E5C00000-memory.dmp
memory/992-71-0x000002A6C7BD0000-0x000002A6C7BFB000-memory.dmp
memory/992-72-0x00007FF9E5BF0000-0x00007FF9E5C00000-memory.dmp
memory/1068-110-0x00007FF9E5BF0000-0x00007FF9E5C00000-memory.dmp
memory/1068-109-0x0000022756360000-0x000002275638B000-memory.dmp
memory/1076-102-0x000001B33D700000-0x000001B33D72B000-memory.dmp
memory/1076-104-0x00007FF9E5BF0000-0x00007FF9E5C00000-memory.dmp
memory/1088-113-0x00007FF9E5BF0000-0x00007FF9E5C00000-memory.dmp
memory/1088-112-0x0000015C54340000-0x0000015C5436B000-memory.dmp
memory/1204-115-0x0000022B287A0000-0x0000022B287CB000-memory.dmp
memory/1204-116-0x00007FF9E5BF0000-0x00007FF9E5C00000-memory.dmp
memory/1236-119-0x00007FF9E5BF0000-0x00007FF9E5C00000-memory.dmp
memory/1236-118-0x000001D0AF430000-0x000001D0AF45B000-memory.dmp
memory/1320-121-0x0000023F47740000-0x0000023F4776B000-memory.dmp
memory/1320-122-0x00007FF9E5BF0000-0x00007FF9E5C00000-memory.dmp
memory/1380-154-0x000002007FCF0000-0x000002007FD1B000-memory.dmp
memory/1380-155-0x00007FF9E5BF0000-0x00007FF9E5C00000-memory.dmp
memory/1464-157-0x0000027AD1A40000-0x0000027AD1A6B000-memory.dmp
memory/1464-158-0x00007FF9E5BF0000-0x00007FF9E5C00000-memory.dmp
memory/1500-161-0x00007FF9E5BF0000-0x00007FF9E5C00000-memory.dmp
memory/1500-160-0x0000027E2C7A0000-0x0000027E2C7CB000-memory.dmp
memory/1552-163-0x0000019A831D0000-0x0000019A831FB000-memory.dmp
memory/1552-164-0x00007FF9E5BF0000-0x00007FF9E5C00000-memory.dmp
memory/1648-167-0x00007FF9E5BF0000-0x00007FF9E5C00000-memory.dmp
memory/1648-166-0x000001DA17A60000-0x000001DA17A8B000-memory.dmp
memory/1692-169-0x000002D307D40000-0x000002D307D6B000-memory.dmp
memory/1692-170-0x00007FF9E5BF0000-0x00007FF9E5C00000-memory.dmp
memory/1712-188-0x00007FF9E5BF0000-0x00007FF9E5C00000-memory.dmp
memory/1712-187-0x000002AD635C0000-0x000002AD635EB000-memory.dmp
memory/1716-172-0x00000255CA960000-0x00000255CA98B000-memory.dmp
memory/1716-173-0x00007FF9E5BF0000-0x00007FF9E5C00000-memory.dmp
memory/1768-175-0x0000026DB4540000-0x0000026DB456B000-memory.dmp
memory/1768-176-0x00007FF9E5BF0000-0x00007FF9E5C00000-memory.dmp
memory/1828-179-0x00007FF9E5BF0000-0x00007FF9E5C00000-memory.dmp
memory/1828-178-0x0000010C4F2E0000-0x0000010C4F30B000-memory.dmp
memory/1880-181-0x000002BACD0B0000-0x000002BACD0DB000-memory.dmp
memory/1880-182-0x00007FF9E5BF0000-0x00007FF9E5C00000-memory.dmp
memory/1944-184-0x0000026E3BA00000-0x0000026E3BA2B000-memory.dmp
memory/1944-185-0x00007FF9E5BF0000-0x00007FF9E5C00000-memory.dmp
memory/1952-41-0x00007FFA25230000-0x00007FFA252EE000-memory.dmp
memory/1952-40-0x00007FFA25B70000-0x00007FFA25D65000-memory.dmp
memory/2100-190-0x000001937B7C0000-0x000001937B7EB000-memory.dmp
memory/2100-191-0x00007FF9E5BF0000-0x00007FF9E5C00000-memory.dmp
memory/2108-193-0x000001E2CDEA0000-0x000001E2CDECB000-memory.dmp
memory/2108-194-0x00007FF9E5BF0000-0x00007FF9E5C00000-memory.dmp
memory/2140-196-0x0000019E24AA0000-0x0000019E24ACB000-memory.dmp
memory/2140-197-0x00007FF9E5BF0000-0x00007FF9E5C00000-memory.dmp
memory/2240-199-0x0000000001160000-0x000000000118B000-memory.dmp
memory/2240-200-0x00007FF9E5BF0000-0x00007FF9E5C00000-memory.dmp
memory/2260-2-0x0000000002AF0000-0x0000000002B46000-memory.dmp
memory/2260-0-0x00000000009A0000-0x0000000000A1E000-memory.dmp
memory/2260-1-0x0000000002B60000-0x0000000002B70000-memory.dmp
memory/2320-202-0x000001EC62930000-0x000001EC6295B000-memory.dmp
memory/3752-151-0x00000202D5E30000-0x00000202D5E5B000-memory.dmp
memory/3752-152-0x00007FF9E5BF0000-0x00007FF9E5C00000-memory.dmp
memory/3812-34-0x0000000000010000-0x0000000000024000-memory.dmp
memory/5036-42-0x0000000000220000-0x000000000024A000-memory.dmp
memory/5036-43-0x0000000005F10000-0x0000000005FA2000-memory.dmp