5f9c6b82e9f287d67b30c6edac1e8e606b6fb719206c88c5421846d48d64d271

Analysis

max time kernel
123s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 00:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Magellan.exe
Size 167KB
Sample260825-av7fhsdn7y
SHA256 5f9c6b82e9f287d67b30c6edac1e8e606b6fb719206c88c5421846d48d64d271
MD5 dcea41cf1d8e08ba9cf571fdb21f1db4
SHA1 da14f6d77d84da5e4290a28ce04e215d7cbfb937
SHA512 d094aad5cd856683e551a519039c183ba440052639f82c0fc9e9124714f4bd843f83fa5a400386add08ed30b1dfb51c095e0055c96f601bca0c18acff5bcaf2f
SSDEEP 3072:ia6Q7bFVzmHQg9Ug644RrO4gGBGhFxwzhk24UoobktbVZ:pz7bFVzvgP4O4bBG/qzhk+abV
TLSH
T138F3F26872FC6272E2BFC27645A6BE44572111B72B26FB6B0CC5E3F938137C54B20419
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5484	MasonGDI.exe
4272	MasonRootkit.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8A7891822FCFF127E4EADADE9757112B	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8A7891822FCFF127E4EADADE9757112B	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8A7891822FCFF127E4EADADE9757112B	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MasonGDI.exe

Modifies data under HKEY_USERS 54 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1787618015"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "17110992,504928405,41816131,507286179,7202265,17110988,7153487,504928410,577889346,5804129,17962391,508368333,17962392,41484365,24262478,9179409,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262477,25036127,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079,7202269"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={38D49882-515E-4823-B707-1F138A914AEF}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,940 10,941 10,942 10,943 10,940 15,1329 15,940 6,944 50,944 10,941 15,942 15,940 50,943 15,944 6,944 15,943 6,1329 50,1329 100,1329 6,941 6,942 6,944 100,940 100"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Mon, 24 Aug 2026 14:02:13 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CRLs	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\NotificationData	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5132	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe
4272	MasonRootkit.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5116	explorer.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	4272	MasonRootkit.exe
Token: 33	2804	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2804	AUDIODG.EXE
Token: SeShutdownPrivilege	5116	explorer.exe
Token: SeCreatePagefilePrivilege	5116	explorer.exe
Token: SeShutdownPrivilege	5116	explorer.exe
Token: SeCreatePagefilePrivilege	5116	explorer.exe
Token: SeShutdownPrivilege	5116	explorer.exe
Token: SeCreatePagefilePrivilege	5116	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 5484	3184	Magellan.exe	89
PID 3184 wrote to memory of 5132	3184	Magellan.exe	90
PID 3184 wrote to memory of 4272	3184	Magellan.exe	92
PID 4272 wrote to memory of 740	4272	MasonRootkit.exe	5
PID 4272 wrote to memory of 968	4272	MasonRootkit.exe	9
PID 4272 wrote to memory of 976	4272	MasonRootkit.exe	10
PID 4272 wrote to memory of 544	4272	MasonRootkit.exe	11
PID 4272 wrote to memory of 840	4272	MasonRootkit.exe	13
PID 4272 wrote to memory of 1120	4272	MasonRootkit.exe	14
PID 4272 wrote to memory of 1180	4272	MasonRootkit.exe	15
PID 4272 wrote to memory of 1276	4272	MasonRootkit.exe	16
PID 4272 wrote to memory of 1360	4272	MasonRootkit.exe	17
PID 4272 wrote to memory of 1368	4272	MasonRootkit.exe	18
PID 4272 wrote to memory of 1384	4272	MasonRootkit.exe	19
PID 4272 wrote to memory of 1560	4272	MasonRootkit.exe	22
PID 4272 wrote to memory of 1652	4272	MasonRootkit.exe	23
PID 4272 wrote to memory of 1672	4272	MasonRootkit.exe	24
PID 4272 wrote to memory of 1700	4272	MasonRootkit.exe	25
PID 4272 wrote to memory of 1712	4272	MasonRootkit.exe	26
PID 4272 wrote to memory of 1744	4272	MasonRootkit.exe	27
PID 4272 wrote to memory of 1948	4272	MasonRootkit.exe	28
PID 4272 wrote to memory of 2028	4272	MasonRootkit.exe	29
PID 4272 wrote to memory of 2064	4272	MasonRootkit.exe	30
PID 4272 wrote to memory of 2088	4272	MasonRootkit.exe	31
PID 4272 wrote to memory of 2140	4272	MasonRootkit.exe	32
PID 4272 wrote to memory of 2220	4272	MasonRootkit.exe	33
PID 4272 wrote to memory of 2264	4272	MasonRootkit.exe	34
PID 4272 wrote to memory of 2340	4272	MasonRootkit.exe	35
PID 4272 wrote to memory of 2392	4272	MasonRootkit.exe	36
PID 4272 wrote to memory of 2444	4272	MasonRootkit.exe	37
PID 4272 wrote to memory of 2584	4272	MasonRootkit.exe	38
PID 4272 wrote to memory of 2620	4272	MasonRootkit.exe	39
PID 4272 wrote to memory of 2636	4272	MasonRootkit.exe	40
PID 4272 wrote to memory of 2752	4272	MasonRootkit.exe	41
PID 4272 wrote to memory of 2940	4272	MasonRootkit.exe	42
PID 4272 wrote to memory of 2992	4272	MasonRootkit.exe	43
PID 4272 wrote to memory of 712	4272	MasonRootkit.exe	44
PID 4272 wrote to memory of 3080	4272	MasonRootkit.exe	45
PID 4272 wrote to memory of 3156	4272	MasonRootkit.exe	47
PID 4272 wrote to memory of 3196	4272	MasonRootkit.exe	48
PID 4272 wrote to memory of 3476	4272	MasonRootkit.exe	50
PID 4272 wrote to memory of 3644	4272	MasonRootkit.exe	51
PID 4272 wrote to memory of 3672	4272	MasonRootkit.exe	52
PID 4272 wrote to memory of 3684	4272	MasonRootkit.exe	53
PID 4272 wrote to memory of 3692	4272	MasonRootkit.exe	54
PID 4272 wrote to memory of 3700	4272	MasonRootkit.exe	55
PID 4272 wrote to memory of 3752	4272	MasonRootkit.exe	56
PID 4272 wrote to memory of 3360	4272	MasonRootkit.exe	57
PID 4272 wrote to memory of 936	4272	MasonRootkit.exe	58
PID 4272 wrote to memory of 4368	4272	MasonRootkit.exe	59
PID 4272 wrote to memory of 4432	4272	MasonRootkit.exe	60
PID 4272 wrote to memory of 4464	4272	MasonRootkit.exe	61
PID 4272 wrote to memory of 4592	4272	MasonRootkit.exe	62
PID 4272 wrote to memory of 4900	4272	MasonRootkit.exe	63
PID 4272 wrote to memory of 5072	4272	MasonRootkit.exe	64
PID 4272 wrote to memory of 5136	4272	MasonRootkit.exe	65
PID 4272 wrote to memory of 5192	4272	MasonRootkit.exe	66
PID 4272 wrote to memory of 5236	4272	MasonRootkit.exe	67
PID 4272 wrote to memory of 5600	4272	MasonRootkit.exe	70
PID 4272 wrote to memory of 4268	4272	MasonRootkit.exe	73
PID 4272 wrote to memory of 4964	4272	MasonRootkit.exe	74
PID 4272 wrote to memory of 4736	4272	MasonRootkit.exe	75
PID 4272 wrote to memory of 2208	4272	MasonRootkit.exe	78
PID 4272 wrote to memory of 3024	4272	MasonRootkit.exe	79

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:740
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:976
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1180

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:968

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-3a9f9e40-c80b-4955-90c4-129a82238e32 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-2e75dd3a-af6d-4f23-a972-6eed251fcde4 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-1d3a65fd-e10a-453d-b4fa-83b9d69e75c8 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-76dc7972-89c7-4448-87b1-8f02df9c8b77 -LifetimeId:c15d7eb8-62b1-486b-8071-0e4ae70be28f -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1120

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1276

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1672

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc
1⤵
PID:1744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1948
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:4796
- - C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    3⤵
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:5116
  - - C:\Users\Admin\AppData\Local\Temp\Magellan.exe
      "C:\Users\Admin\AppData\Local\Temp\Magellan.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3184
    - - C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5484
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4272

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:2028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:2064

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:2088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:2220

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2264

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2340
- C:\Windows\system32\AUDIODG.EXE
  C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004D4
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2392

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
PID:2444
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:0000000000000270;0000000000000274;
  2⤵
  PID:5072

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc
1⤵
PID:2584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2620

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc
1⤵
PID:2940

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:712

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:3080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:3156

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:3196

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:3672

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:3692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:3752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:936

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4368

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4592

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4900

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:5136

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:5192

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
PID:5236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc
1⤵
PID:5600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:4268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:4964

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4736

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2208

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3024

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Drops file in System32 directory
PID:5452

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:2352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MasonGDI.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe
Size 10KB
SHA256 f59f884933a7e58a80069e913fa497085c63dac8531c1af8dccee2aff7be97ac
MD5 ccd79db52a6621025a65456f817cc5f6
SHA1 735e42778bfd64e8c9bf9cdcb15c344fa433392c
SHA512 ca594c7809d4e157ff38576186909e741023ce0d03b3045a9d069ff386d8f83d811a1a2a43eb8035acb8b7e4fd1a9eea37975cf94d06a57f2e1c07b62afeff23
SSDEEP 192:14JYXN2qZZRDwpNa1Od2Z461A/t+hbCzB1CVbJNqp:1PXNTPRDua1OG4MA/t+hbOCVVNq
TLSH
T16E22185897E49636CA7906335EB367140B34DB42DE12EB7F1DC8912B2EE738207A1B70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MasonRootkit.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 163e03382bfdd692cae0e05eddaf2b961510d6c434f65549fefe5f5ce56d0b41
MD5 b8ddf64e701dede485d36f2bc7fa0153
SHA1 5cfd12fd531931e64377e1fedb2aacab129b8fa2
SHA512 5a5fee70ad9825cde7fbf0fd3c96297e4988581a101d485488bfc5ef705d132abb114f9122d82e6e2712a85362d783e15ffbfac91e1fff00f7433ce5c980112d
TLSH
T188E086153AA44208E5730A3CF973A94869367A675A01CADD1774045E1C28FA5CD36219
MD5 SHA1 SHA512 TLSH

Submit Download

8A7891822FCFF127E4EADADE9757112B

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8A7891822FCFF127E4EADADE9757112B
Size 246B
SHA256 72314128e6c9ac5d291bf02803b0d72450e37b3db5362e3bb95439901ecb28c8
MD5 16f49429dff7aa72c30f6a3183ad9310
SHA1 0a7e1b5dd77bf61bb73b38e9a1cd698faf835a93
SHA512 ca0293c0d10fa52ab5e92cbefba512076f03aea4cef7f4c41fb822b23abc5380686c30dde91d2947ee85a0e1925c469a209dfe5a51f51a39809027c6722d8e79
TLSH
T1A3D0122063B57606F16512BBBD604AE1B625AF15F843CF0507F11B0D5C6EFD11820E2B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/544-123-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp

Download

memory/544-122-0x0000021641160000-0x000002164118B000-memory.dmp

Download

memory/740-34-0x000001D5C4390000-0x000001D5C43B5000-memory.dmp

Download

memory/740-35-0x000001D5C43C0000-0x000001D5C43EB000-memory.dmp

Download

memory/740-36-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp

Download

memory/840-126-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp

Download

memory/840-124-0x00000164487E0000-0x000001644880B000-memory.dmp

Download

memory/976-119-0x00000170BF9A0000-0x00000170BF9CB000-memory.dmp

Download

memory/976-120-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp

Download

memory/1120-129-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp

Download

memory/1120-128-0x0000022632280000-0x00000226322AB000-memory.dmp

Download

memory/1180-44-0x0000026F2C120000-0x0000026F2C14B000-memory.dmp

Download

memory/1180-45-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp

Download

memory/1276-131-0x000001D693DB0000-0x000001D693DDB000-memory.dmp

Download

memory/1276-132-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp

Download

memory/1360-135-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp

Download

memory/1360-134-0x000001A2C6950000-0x000001A2C697B000-memory.dmp

Download

memory/1368-138-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp

Download

memory/1368-137-0x0000029836EC0000-0x0000029836EEB000-memory.dmp

Download

memory/1384-140-0x000001FC36F40000-0x000001FC36F6B000-memory.dmp

Download

memory/1384-141-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp

Download

memory/1560-53-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp

Download

memory/1560-52-0x000001B41BB60000-0x000001B41BB8B000-memory.dmp

Download

memory/1652-144-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp

Download

memory/1652-143-0x00000219D0E60000-0x00000219D0E8B000-memory.dmp

Download

memory/1672-150-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp

Download

memory/1672-149-0x000001F9F9E40000-0x000001F9F9E6B000-memory.dmp

Download

memory/1700-146-0x000001BACD590000-0x000001BACD5BB000-memory.dmp

Download

memory/1700-147-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp

Download

memory/1712-152-0x000001CCD5FA0000-0x000001CCD5FCB000-memory.dmp

Download

memory/1712-153-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp

Download

memory/1744-156-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp

Download

memory/1744-155-0x0000023B27B40000-0x0000023B27B6B000-memory.dmp

Download

memory/1948-159-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp

Download

memory/1948-158-0x0000021420840000-0x000002142086B000-memory.dmp

Download

memory/2028-161-0x0000028FB98F0000-0x0000028FB991B000-memory.dmp

Download

memory/2028-162-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp

Download

memory/2064-164-0x0000021C02AB0000-0x0000021C02ADB000-memory.dmp

Download

memory/2064-165-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp

Download

memory/2088-168-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp

Download

memory/2088-167-0x000001CE55ED0000-0x000001CE55EFB000-memory.dmp

Download

memory/2140-171-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp

Download

memory/2140-170-0x0000026B13ED0000-0x0000026B13EFB000-memory.dmp

Download

memory/2220-173-0x0000028A36830000-0x0000028A3685B000-memory.dmp

Download

memory/2220-174-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp

Download

memory/2264-176-0x000002CB60950000-0x000002CB6097B000-memory.dmp

Download

memory/2264-177-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp

Download

memory/2340-179-0x00000219E58C0000-0x00000219E58EB000-memory.dmp

Download

memory/2340-180-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp

Download

memory/2352-115-0x000002AC32970000-0x000002AC3299B000-memory.dmp

Download

memory/2352-116-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp

Download

memory/2392-182-0x0000014567290000-0x00000145672BB000-memory.dmp

Download

memory/2392-183-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp

Download

memory/2444-185-0x000001F4437B0000-0x000001F4437DB000-memory.dmp

Download

memory/2444-186-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp

Download

memory/2584-188-0x0000027E50B80000-0x0000027E50BAB000-memory.dmp

Download

memory/2584-189-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp

Download

memory/2620-191-0x00000194111C0000-0x00000194111EB000-memory.dmp

Download

memory/3184-4-0x00007FF903980000-0x00007FF904324000-memory.dmp

Download

memory/3184-1-0x0000000000E50000-0x0000000000E80000-memory.dmp

Download

memory/3184-2-0x0000000002EA0000-0x0000000002EC6000-memory.dmp

Download

memory/3184-3-0x00007FF903980000-0x00007FF904324000-memory.dmp

Download

memory/3184-0-0x00007FF903B0F000-0x00007FF903B10000-memory.dmp

Download

memory/3184-29-0x00007FF903980000-0x00007FF904324000-memory.dmp

Download

memory/4272-27-0x00007FF9267C0000-0x00007FF926A23000-memory.dmp

Download

memory/4272-28-0x00007FF925500000-0x00007FF9255C7000-memory.dmp

Download

memory/5072-98-0x000002228CA80000-0x000002228CAAB000-memory.dmp

Download

memory/5072-100-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp

Download

memory/5116-111-0x0000000002230000-0x000000000225B000-memory.dmp

Download

memory/5116-112-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp

Download

memory/5484-16-0x0000000074A22000-0x0000000074A23000-memory.dmp

Download

memory/5484-19-0x0000000000E30000-0x0000000000E38000-memory.dmp

Download

memory/5484-302-0x0000000074A10000-0x00000000751CC000-memory.dmp

Download

memory/5484-30-0x0000000074A10000-0x00000000751CC000-memory.dmp

Download