2b6455abbf84755be4dcf840ebbfed9c480dced7bd74806bafee05465a5e752d

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Squidward.exe
Size 535KB
Sample260827-chsspscq9x
SHA256 2b6455abbf84755be4dcf840ebbfed9c480dced7bd74806bafee05465a5e752d
MD5 82bf26203c5d76dfa3a591f1cb60d7b5
SHA1 93bf418f64ec701fd0d3232a00a167d04ba9a6d2
SHA512 6a896c274958467e18579affe68a2e0acb68ea633715920d244974765dbf577ce7558cb3dc467a69a656cb82c2f588565f71c4413b5dedc1005fba35303ed2f3
SSDEEP 6144:yrjS60VNKrDqa3pPvX0RQ/FwiSs8k//M4zVRslxX4ci0MAM0bCrvVFs47Xeeeeen:4jST2/l3Z8O7Ss8k//XzVRUX4fnr9
TLSH
T136C4CF61A103D6E2E38D4BB46152D478152E1FE6679A160DEFC13F8B7DF12A128239CF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery execution persistence spyware

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
6028	MasonMBR-SLEEP.exe
3884	MasonRootkit.exe
4892	MasonGDI.exe
3764	MasonGDI.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Tasks\MasonMBR	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5068	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MasonGDI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MasonGDI.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4124	timeout.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\e4bfbfdf_0	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\e4bfbfdf_0\ = "{2}.\\\\?\\hdaudio#func_01&ven_8086&dev_0022&subsys_80860022&rev_1001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\\elineouttopo/00010001\|\\Device\\HarddiskVolume2\\Users\\Admin\\AppData\\Local\\Temp\\MasonGDI.exe%b{00000000-0000-0000-0000-000000000000}"	svchost.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "504928405,17110992,7153487,17110988,7202265,507286179,41816131,504928410,577889346,5804129,17962391,508368333,17962392,41484365,24262478,9179409,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262477,25036127,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079,7202269"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,940 10,941 10,942 10,940 15,943 10,944 50,940 6,1329 15,944 10,941 15,942 15,940 50,943 15,944 6,944 15,943 6,1329 50,1329 100,1329 6,941 6,942 6,944 100,940 100"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\NotificationData	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2616	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe
3884	MasonRootkit.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5944	explorer.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeDebugPrivilege	3884	MasonRootkit.exe
Token: SeShutdownPrivilege	5944	explorer.exe
Token: SeCreatePagefilePrivilege	5944	explorer.exe
Token: 33	4812	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4812	AUDIODG.EXE
Token: SeShutdownPrivilege	5944	explorer.exe
Token: SeCreatePagefilePrivilege	5944	explorer.exe
Token: SeShutdownPrivilege	5944	explorer.exe
Token: SeCreatePagefilePrivilege	5944	explorer.exe
Token: SeShutdownPrivilege	5944	explorer.exe
Token: SeCreatePagefilePrivilege	5944	explorer.exe
Token: SeShutdownPrivilege	5944	explorer.exe
Token: SeCreatePagefilePrivilege	5944	explorer.exe
Token: SeShutdownPrivilege	5944	explorer.exe
Token: SeCreatePagefilePrivilege	5944	explorer.exe
Token: SeShutdownPrivilege	5944	explorer.exe
Token: SeCreatePagefilePrivilege	5944	explorer.exe
Token: SeShutdownPrivilege	5944	explorer.exe
Token: SeCreatePagefilePrivilege	5944	explorer.exe
Token: SeShutdownPrivilege	5944	explorer.exe
Token: SeCreatePagefilePrivilege	5944	explorer.exe
Token: SeShutdownPrivilege	5944	explorer.exe
Token: SeCreatePagefilePrivilege	5944	explorer.exe
Token: SeShutdownPrivilege	5944	explorer.exe
Token: SeCreatePagefilePrivilege	5944	explorer.exe
Token: SeShutdownPrivilege	5944	explorer.exe
Token: SeCreatePagefilePrivilege	5944	explorer.exe
Token: SeShutdownPrivilege	5944	explorer.exe
Token: SeCreatePagefilePrivilege	5944	explorer.exe
Token: SeShutdownPrivilege	5944	explorer.exe
Token: SeCreatePagefilePrivilege	5944	explorer.exe
Token: SeShutdownPrivilege	5944	explorer.exe
Token: SeCreatePagefilePrivilege	5944	explorer.exe
Token: SeShutdownPrivilege	5944	explorer.exe
Token: SeCreatePagefilePrivilege	5944	explorer.exe
Token: SeShutdownPrivilege	5944	explorer.exe
Token: SeCreatePagefilePrivilege	5944	explorer.exe
Token: SeShutdownPrivilege	5944	explorer.exe
Token: SeCreatePagefilePrivilege	5944	explorer.exe
Token: SeShutdownPrivilege	5944	explorer.exe
Token: SeCreatePagefilePrivilege	5944	explorer.exe
Token: SeShutdownPrivilege	5944	explorer.exe
Token: SeCreatePagefilePrivilege	5944	explorer.exe
Token: SeShutdownPrivilege	5944	explorer.exe
Token: SeCreatePagefilePrivilege	5944	explorer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4240	Conhost.exe
956	Conhost.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
5944	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 6028	4744	Squidward.exe	89
PID 4744 wrote to memory of 3884	4744	Squidward.exe	90
PID 4744 wrote to memory of 4892	4744	Squidward.exe	91
PID 3884 wrote to memory of 748	3884	MasonRootkit.exe	5
PID 3884 wrote to memory of 960	3884	MasonRootkit.exe	9
PID 3884 wrote to memory of 968	3884	MasonRootkit.exe	10
PID 3884 wrote to memory of 1016	3884	MasonRootkit.exe	11
PID 4744 wrote to memory of 2616	4744	Squidward.exe	92
PID 3884 wrote to memory of 1032	3884	MasonRootkit.exe	13
PID 3884 wrote to memory of 1116	3884	MasonRootkit.exe	14
PID 3884 wrote to memory of 1160	3884	MasonRootkit.exe	15
PID 3884 wrote to memory of 1244	3884	MasonRootkit.exe	16
PID 3884 wrote to memory of 1300	3884	MasonRootkit.exe	17
PID 3884 wrote to memory of 1324	3884	MasonRootkit.exe	18
PID 3884 wrote to memory of 1376	3884	MasonRootkit.exe	19
PID 3884 wrote to memory of 1548	3884	MasonRootkit.exe	22
PID 3884 wrote to memory of 1580	3884	MasonRootkit.exe	23
PID 3884 wrote to memory of 1604	3884	MasonRootkit.exe	24
PID 3884 wrote to memory of 1732	3884	MasonRootkit.exe	25
PID 3884 wrote to memory of 1764	3884	MasonRootkit.exe	26
PID 3884 wrote to memory of 1776	3884	MasonRootkit.exe	27
PID 3884 wrote to memory of 2000	3884	MasonRootkit.exe	28
PID 3884 wrote to memory of 1620	3884	MasonRootkit.exe	29
PID 3884 wrote to memory of 2076	3884	MasonRootkit.exe	30
PID 3884 wrote to memory of 2112	3884	MasonRootkit.exe	31
PID 3884 wrote to memory of 2120	3884	MasonRootkit.exe	32
PID 3884 wrote to memory of 2232	3884	MasonRootkit.exe	33
PID 3884 wrote to memory of 2308	3884	MasonRootkit.exe	34
PID 3884 wrote to memory of 2364	3884	MasonRootkit.exe	35
PID 3884 wrote to memory of 2412	3884	MasonRootkit.exe	36
PID 3884 wrote to memory of 2540	3884	MasonRootkit.exe	37
PID 3884 wrote to memory of 2604	3884	MasonRootkit.exe	38
PID 3884 wrote to memory of 2620	3884	MasonRootkit.exe	39
PID 3884 wrote to memory of 2696	3884	MasonRootkit.exe	40
PID 3884 wrote to memory of 2820	3884	MasonRootkit.exe	41
PID 3884 wrote to memory of 2924	3884	MasonRootkit.exe	42
PID 3884 wrote to memory of 2968	3884	MasonRootkit.exe	43
PID 3884 wrote to memory of 2304	3884	MasonRootkit.exe	44
PID 3884 wrote to memory of 2748	3884	MasonRootkit.exe	45
PID 3884 wrote to memory of 3176	3884	MasonRootkit.exe	47
PID 3884 wrote to memory of 3200	3884	MasonRootkit.exe	48
PID 3884 wrote to memory of 3492	3884	MasonRootkit.exe	50
PID 3884 wrote to memory of 3592	3884	MasonRootkit.exe	51
PID 3884 wrote to memory of 3644	3884	MasonRootkit.exe	52
PID 3884 wrote to memory of 3664	3884	MasonRootkit.exe	53
PID 3884 wrote to memory of 3676	3884	MasonRootkit.exe	54
PID 3884 wrote to memory of 3696	3884	MasonRootkit.exe	55
PID 3884 wrote to memory of 3772	3884	MasonRootkit.exe	56
PID 3884 wrote to memory of 3832	3884	MasonRootkit.exe	57
PID 3884 wrote to memory of 1096	3884	MasonRootkit.exe	58
PID 3884 wrote to memory of 4388	3884	MasonRootkit.exe	59
PID 3884 wrote to memory of 4448	3884	MasonRootkit.exe	60
PID 3884 wrote to memory of 4508	3884	MasonRootkit.exe	61
PID 3884 wrote to memory of 4604	3884	MasonRootkit.exe	62
PID 3884 wrote to memory of 3328	3884	MasonRootkit.exe	63
PID 3884 wrote to memory of 4908	3884	MasonRootkit.exe	64
PID 3884 wrote to memory of 5160	3884	MasonRootkit.exe	65
PID 3884 wrote to memory of 5220	3884	MasonRootkit.exe	66
PID 3884 wrote to memory of 5260	3884	MasonRootkit.exe	67
PID 3884 wrote to memory of 5512	3884	MasonRootkit.exe	70
PID 3884 wrote to memory of 5756	3884	MasonRootkit.exe	72
PID 3884 wrote to memory of 3228	3884	MasonRootkit.exe	74
PID 3884 wrote to memory of 4472	3884	MasonRootkit.exe	75
PID 3884 wrote to memory of 2444	3884	MasonRootkit.exe	78

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:748
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:968
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1160

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:960

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-c04ea092-40b8-4638-ae77-ba91f31c8307 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-89012eb9-7c1a-4101-90ab-5892d1b4bda8 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-d5ebf6b0-28e4-4e92-99c0-24f8e8d5f957 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-0e4583d3-bb0e-4506-92c0-d41ec1fc5ec8 -LifetimeId:db5becfa-8f00-402b-8fec-f9b557eb1283 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:1016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1116

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1300

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc
1⤵
PID:1732

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:2000
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:5252
- - C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    3⤵
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of UnmapMainImage
    PID:5944
  - - C:\Users\Admin\AppData\Local\Temp\Squidward.exe
      "C:\Users\Admin\AppData\Local\Temp\Squidward.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4744
    - - C:\Users\Admin\AppData\Local\Temp\MasonMBR-SLEEP.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonMBR-SLEEP.exe"
        5⤵
        Executes dropped EXE
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3884
    - - C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4892
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2616
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4240
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp502A.tmp.bat""
        5⤵
        Executes a command shell one-liner
        
        PID:5068
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:2636
      - C:\Windows\system32\timeout.exe
        
        timeout 3
        6⤵
        Delays execution with timeout.exe
        
        PID:4124

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:2112

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:2120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:2232

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2364

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
- Modifies Internet Explorer settings
PID:2412
- C:\Windows\system32\AUDIODG.EXE
  C:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004F8
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4812

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
PID:2540
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:0000000000000268;000000000000026C;
  2⤵
  PID:4908

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:2620

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc
1⤵
PID:2696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc
1⤵
PID:2924

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2968

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2748

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:3176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:3200

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:3644

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:3676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:3772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:1096

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4388

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4604

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3328

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:5160

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:5220

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
PID:5260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc
1⤵
PID:5512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:5756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3228

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4472

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2444

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Modifies data under HKEY_USERS
PID:3404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4772

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of SetWindowsHookEx
PID:956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MasonGDI.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe
Size 61KB
SHA256 57eff2792a929b479b3e3bb9a25bbe750034dcba4213e2abb8865ff2268b53f6
MD5 2f9823efd49a6f8fc32ba52d75e620a4
SHA1 39f79bc2bba2f33f2e82da2dee4c8cf3be052b7e
SHA512 2f68ddb1d7d070f7d8675791f8ccc3b9d73236834f1bc787afdf1074d4d17601f77e53a98024a12e29119c5c38333cd7f6200a186e2ba96fc4186c86ca2cb6ad
SSDEEP 1536:PTynnng4PEIGZ5eqIXzgmYi/ZuPiDNG9j3+aOPw1WX6CjV9nu:9OFGfeZgmJ8POoOu1WX6CjS
TLSH
T13653F186E3B8C421D0F71333AD67E99413F5EAD69D56CA1F0A80935B6ED23464F21E1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MasonMBR-SLEEP.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonMBR-SLEEP.exe
Size 65KB
SHA256 de93250a0f249700407cd893e1b4d6b167c5e909b4b8f09cbefbbae473f4ad93
MD5 f006d2343d121bd2043925e87063fde7
SHA1 402799473ca52edb826a37e0042456032db121f3
SHA512 707c803508308fa0d002aa31187476cf1b000118f9b0d89982ab60a674de09f028ae860c3dbdad9fa902ee4e9d0771f8fa79e356bb2ae8bf4f2c57d61f3e68e0
SSDEEP 1536:ToHs+RMT9qQPhcm7V0vppY62kxt+nl5Hr1lo/u:MHssMT9qQPSmyvB2cKl5L3P
TLSH
T1FC63F1129FE8026AC35F47B25DE573910F2ADE44DE06775F809182A18F49AC88773B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MasonRootkit.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp1EB0.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp1EB0.tmp
Size 873KB
SHA256 6a1e08d3a6759f42ea2480450bdf1f369bf50236ba1dc94cfddbf02b5dd7ecaa
MD5 7bfe4475c45768860615d6cdc19dc622
SHA1 d937f02f743833748dbc391211602c28f0eaca8f
SHA512 64bb4d4ebc82a7509ded16677592dacb862bfbdbb9c06a871f7d051aa7a5c67c5a5358ddd3f44ca7922fd3f406a784c768737dddafc49075f496452b96597681
SSDEEP 1536:qnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnns:D
TLSH
T175150FF06479EE53F39685397920FD2846D03499AAF3493A707DF9C8A373B60285C61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp502A.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp502A.tmp.bat
Size 161B
SHA256 e7feead74b52f6b58dfbed99cabdb2bb8ad4378d361e3bee710264c051104edf
MD5 585abe53fa096ae1540c895769c9e7df
SHA1 aea049e1a3ea8784592c47b3b831e10506dc2119
SHA512 6c4ef3fba4620ac706658e31dbfcbc143afe30a1f6f89c9534e3709001c83e2903e82a738dc3a92cc0fb01ea5ee2da8a7d54e9a7e5245567e410a694cfd3a9fa
TLSH
T146C08C0024CAFB2E190E682711B6C18DC1A25C0B2E866B5097588008298186CF4B8709
MD5 SHA1 SHA512 TLSH

Submit Download

memory/748-38-0x000001A863D60000-0x000001A863D8B000-memory.dmp

Download

memory/748-39-0x00007FFC42440000-0x00007FFC42450000-memory.dmp

Download

memory/748-37-0x000001A863D30000-0x000001A863D55000-memory.dmp

Download

memory/960-43-0x000001A2425B0000-0x000001A2425DB000-memory.dmp

Download

memory/960-44-0x00007FFC42440000-0x00007FFC42450000-memory.dmp

Download

memory/968-47-0x00007FFC42440000-0x00007FFC42450000-memory.dmp

Download

memory/968-46-0x000002791DF60000-0x000002791DF8B000-memory.dmp

Download

memory/1016-126-0x000002068FD40000-0x000002068FD6B000-memory.dmp

Download

memory/1032-128-0x000001DFDEE30000-0x000001DFDEE5B000-memory.dmp

Download

memory/1116-130-0x000001D906D40000-0x000001D906D6B000-memory.dmp

Download

memory/1116-131-0x00007FFC42440000-0x00007FFC42450000-memory.dmp

Download

memory/1160-55-0x00007FFC42440000-0x00007FFC42450000-memory.dmp

Download

memory/1160-54-0x000001B19FFC0000-0x000001B19FFEB000-memory.dmp

Download

memory/1244-134-0x00007FFC42440000-0x00007FFC42450000-memory.dmp

Download

memory/1244-133-0x0000022C77EB0000-0x0000022C77EDB000-memory.dmp

Download

memory/1300-137-0x00007FFC42440000-0x00007FFC42450000-memory.dmp

Download

memory/1300-136-0x0000027BFBEE0000-0x0000027BFBF0B000-memory.dmp

Download

memory/1324-140-0x00007FFC42440000-0x00007FFC42450000-memory.dmp

Download

memory/1324-139-0x000001D2755D0000-0x000001D2755FB000-memory.dmp

Download

memory/1376-143-0x00007FFC42440000-0x00007FFC42450000-memory.dmp

Download

memory/1376-142-0x00000231CFFC0000-0x00000231CFFEB000-memory.dmp

Download

memory/1548-146-0x00007FFC42440000-0x00007FFC42450000-memory.dmp

Download

memory/1548-145-0x000001542BB10000-0x000001542BB3B000-memory.dmp

Download

memory/1580-63-0x000001DE5A2D0000-0x000001DE5A2FB000-memory.dmp

Download

memory/1580-64-0x00007FFC42440000-0x00007FFC42450000-memory.dmp

Download

memory/1604-148-0x000001E5CDD50000-0x000001E5CDD7B000-memory.dmp

Download

memory/1604-149-0x00007FFC42440000-0x00007FFC42450000-memory.dmp

Download

memory/1620-163-0x0000023AD3600000-0x0000023AD362B000-memory.dmp

Download

memory/1620-164-0x00007FFC42440000-0x00007FFC42450000-memory.dmp

Download

memory/1732-152-0x00007FFC42440000-0x00007FFC42450000-memory.dmp

Download

memory/1732-151-0x0000020E98340000-0x0000020E9836B000-memory.dmp

Download

memory/1764-154-0x00000187E3C30000-0x00000187E3C5B000-memory.dmp

Download

memory/1764-155-0x00007FFC42440000-0x00007FFC42450000-memory.dmp

Download

memory/1776-158-0x00007FFC42440000-0x00007FFC42450000-memory.dmp

Download

memory/1776-157-0x000002683B260000-0x000002683B28B000-memory.dmp

Download

memory/2000-161-0x00007FFC42440000-0x00007FFC42450000-memory.dmp

Download

memory/2000-160-0x000001B476A60000-0x000001B476A8B000-memory.dmp

Download

memory/2076-165-0x000001C23BB30000-0x000001C23BB5B000-memory.dmp

Download

memory/2076-166-0x00007FFC42440000-0x00007FFC42450000-memory.dmp

Download

memory/2112-168-0x000001E8EE8D0000-0x000001E8EE8FB000-memory.dmp

Download

memory/2112-169-0x00007FFC42440000-0x00007FFC42450000-memory.dmp

Download

memory/2120-172-0x000001781FF20000-0x000001781FF4B000-memory.dmp

Download

memory/2120-175-0x00007FFC42440000-0x00007FFC42450000-memory.dmp

Download

memory/2232-171-0x000001CFB6F60000-0x000001CFB6F8B000-memory.dmp

Download

memory/2232-173-0x00007FFC42440000-0x00007FFC42450000-memory.dmp

Download

memory/2308-177-0x000001C703000000-0x000001C70302B000-memory.dmp

Download

memory/2308-178-0x00007FFC42440000-0x00007FFC42450000-memory.dmp

Download

memory/2364-181-0x00007FFC42440000-0x00007FFC42450000-memory.dmp

Download

memory/2364-180-0x000001AAC6C40000-0x000001AAC6C6B000-memory.dmp

Download

memory/2412-183-0x00000185BFB60000-0x00000185BFB8B000-memory.dmp

Download

memory/2412-184-0x00007FFC42440000-0x00007FFC42450000-memory.dmp

Download

memory/2540-187-0x00007FFC42440000-0x00007FFC42450000-memory.dmp

Download

memory/2540-186-0x000001797CA40000-0x000001797CA6B000-memory.dmp

Download

memory/2604-189-0x000001A76C3C0000-0x000001A76C3EB000-memory.dmp

Download

memory/2604-190-0x00007FFC42440000-0x00007FFC42450000-memory.dmp

Download

memory/2620-193-0x00007FFC42440000-0x00007FFC42450000-memory.dmp

Download

memory/2620-192-0x0000016DEBF00000-0x0000016DEBF2B000-memory.dmp

Download

memory/2696-196-0x00007FFC42440000-0x00007FFC42450000-memory.dmp

Download

memory/3884-29-0x00007FFC82300000-0x00007FFC82563000-memory.dmp

Download

memory/3884-31-0x00007FFC816A0000-0x00007FFC81767000-memory.dmp

Download

memory/4744-2-0x00000000013E0000-0x0000000001422000-memory.dmp

Download

memory/4744-3-0x00007FFC5F490000-0x00007FFC5FE34000-memory.dmp

Download

memory/4744-1-0x0000000000AE0000-0x0000000000B6C000-memory.dmp

Download

memory/4744-349-0x00007FFC5F490000-0x00007FFC5FE34000-memory.dmp

Download

memory/4744-0-0x00007FFC5F61F000-0x00007FFC5F620000-memory.dmp

Download

memory/4892-49-0x0000000000550000-0x0000000000566000-memory.dmp

Download

memory/4892-302-0x0000000005340000-0x00000000053D2000-memory.dmp

Download

memory/4908-105-0x000001E959190000-0x000001E9591BB000-memory.dmp

Download

memory/4908-106-0x00007FFC42440000-0x00007FFC42450000-memory.dmp

Download

memory/5944-124-0x00007FFC42440000-0x00007FFC42450000-memory.dmp

Download

memory/5944-122-0x0000000000760000-0x000000000078B000-memory.dmp

Download

memory/6028-19-0x0000000000CB0000-0x0000000000CC6000-memory.dmp

Download

memory/6028-35-0x00007FFC5F490000-0x00007FFC5FE34000-memory.dmp

Download

memory/6028-360-0x00007FFC5F490000-0x00007FFC5FE34000-memory.dmp

Download

memory/6028-366-0x00007FFC5F490000-0x00007FFC5FE34000-memory.dmp

Download