Analysis
- max time kernel
3s - max time network
6s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
05/09/2026, 23:23
Errors
General
- Target AngryVirus.exe
- Size 482KB
- Sample260905-3dk56svbkf
- SHA256 b6dac480e4c7f15e8de6633ee9b52b3bda0b6b2f1897a76ddb4ab0ffb76b2588
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\System32\WUDFHost.exe"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-5788d42f-5b20-46eb-bedd-2d8e286ddd97 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-fe1ecb04-6d4d-4617-ac05-6f62a2b8a66f -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-2aa5bfaa-dfdf-4d46-b362-13a4d7e2e5a8 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-63f48a22-fe4e-449d-8ae2-8fcf34bb83ed -LifetimeId:673d52a8-bf5c-47fa-9612-8942e517f35b -DeviceGroupId:WudfDefaultDevicePool -HostArg:01⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Users\Admin\AppData\Local\Temp\AngryVirus.exe"C:\Users\Admin\AppData\Local\Temp\AngryVirus.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe" /RL HIGHEST2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\MasonMBR-S.exe"C:\Users\Admin\AppData\Local\Temp\MasonMBR-S.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\AppData\Local\Temp\MasonMBR.exeC:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x500 0x4e81⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
MasonGDI.exe
MasonMBR-S.exe
MasonMBR.exe
MasonRootkit.exe
memory/64-64-0x000001AA9DCD0000-0x000001AA9DCFB000-memory.dmp
memory/64-65-0x00007FFAED010000-0x00007FFAED020000-memory.dmp
memory/444-305-0x0000000006060000-0x00000000060F2000-memory.dmp
memory/444-107-0x00000000000B0000-0x00000000000DA000-memory.dmp
memory/476-73-0x00007FFAED010000-0x00007FFAED020000-memory.dmp
memory/476-72-0x000002109DF30000-0x000002109DF5B000-memory.dmp
memory/620-57-0x00007FFAED010000-0x00007FFAED020000-memory.dmp
memory/620-56-0x000002CDA5570000-0x000002CDA559B000-memory.dmp
memory/620-51-0x000002CDA5540000-0x000002CDA5565000-memory.dmp
memory/676-53-0x000001FB835C0000-0x000001FB835EB000-memory.dmp
memory/676-54-0x00007FFAED010000-0x00007FFAED020000-memory.dmp
memory/768-70-0x00007FFAED010000-0x00007FFAED020000-memory.dmp
memory/768-69-0x0000023844360000-0x000002384438B000-memory.dmp
memory/888-61-0x0000027CC9930000-0x0000027CC995B000-memory.dmp
memory/888-62-0x00007FFAED010000-0x00007FFAED020000-memory.dmp
memory/1032-78-0x00007FFAED010000-0x00007FFAED020000-memory.dmp
memory/1032-77-0x00000282A7D90000-0x00000282A7DBB000-memory.dmp
memory/1088-81-0x00007FFAED010000-0x00007FFAED020000-memory.dmp
memory/1088-80-0x0000017FCEE30000-0x0000017FCEE5B000-memory.dmp
memory/1128-92-0x000002CFA73D0000-0x000002CFA73FB000-memory.dmp
memory/1128-93-0x00007FFAED010000-0x00007FFAED020000-memory.dmp
memory/1172-86-0x00007FFAED010000-0x00007FFAED020000-memory.dmp
memory/1172-85-0x00000173EEDE0000-0x00000173EEE0B000-memory.dmp
memory/1180-95-0x000002D9DA5A0000-0x000002D9DA5CB000-memory.dmp
memory/1180-96-0x00007FFAED010000-0x00007FFAED020000-memory.dmp
memory/1296-98-0x000002A3904A0000-0x000002A3904CB000-memory.dmp
memory/1296-99-0x00007FFAED010000-0x00007FFAED020000-memory.dmp
memory/1364-101-0x0000019A2D2C0000-0x0000019A2D2EB000-memory.dmp
memory/1364-102-0x00007FFAED010000-0x00007FFAED020000-memory.dmp
memory/1480-105-0x00007FFAED010000-0x00007FFAED020000-memory.dmp
memory/1480-104-0x000002459C760000-0x000002459C78B000-memory.dmp
memory/1564-113-0x00007FFAED010000-0x00007FFAED020000-memory.dmp
memory/1564-112-0x0000015B0F160000-0x0000015B0F18B000-memory.dmp
memory/1576-115-0x000001FB02F90000-0x000001FB02FBB000-memory.dmp
memory/1576-116-0x00007FFAED010000-0x00007FFAED020000-memory.dmp
memory/1608-118-0x000001A9475C0000-0x000001A9475EB000-memory.dmp
memory/1608-119-0x00007FFAED010000-0x00007FFAED020000-memory.dmp
memory/1720-122-0x00007FFAED010000-0x00007FFAED020000-memory.dmp
memory/1720-121-0x000001B8D6EF0000-0x000001B8D6F1B000-memory.dmp
memory/1740-144-0x00007FFAED010000-0x00007FFAED020000-memory.dmp
memory/1740-143-0x00000218B6180000-0x00000218B61AB000-memory.dmp
memory/1760-146-0x0000026C846A0000-0x0000026C846CB000-memory.dmp
memory/1760-147-0x00007FFAED010000-0x00007FFAED020000-memory.dmp
memory/1796-149-0x0000018388CA0000-0x0000018388CCB000-memory.dmp
memory/1796-150-0x00007FFAED010000-0x00007FFAED020000-memory.dmp
memory/1896-153-0x00007FFAED010000-0x00007FFAED020000-memory.dmp
memory/1896-152-0x000002156C8F0000-0x000002156C91B000-memory.dmp
memory/1948-156-0x00007FFAED010000-0x00007FFAED020000-memory.dmp
memory/1948-155-0x000001DBE8430000-0x000001DBE845B000-memory.dmp
memory/2004-159-0x00007FFAED010000-0x00007FFAED020000-memory.dmp
memory/2004-158-0x00000289D2F70000-0x00000289D2F9B000-memory.dmp
memory/2032-162-0x00007FFAED010000-0x00007FFAED020000-memory.dmp
memory/2032-161-0x0000024A5E830000-0x0000024A5E85B000-memory.dmp
memory/2056-164-0x000001AB043D0000-0x000001AB043FB000-memory.dmp
memory/2056-165-0x00007FFAED010000-0x00007FFAED020000-memory.dmp
memory/2068-167-0x000001857A6E0000-0x000001857A70B000-memory.dmp
memory/2068-168-0x00007FFAED010000-0x00007FFAED020000-memory.dmp
memory/2076-170-0x000002B88F9B0000-0x000002B88F9DB000-memory.dmp
memory/2076-171-0x00007FFAED010000-0x00007FFAED020000-memory.dmp
memory/2144-173-0x0000018A57F70000-0x0000018A57F9B000-memory.dmp
memory/2144-174-0x00007FFAED010000-0x00007FFAED020000-memory.dmp
memory/2276-176-0x0000000001050000-0x000000000107B000-memory.dmp
memory/2276-177-0x00007FFAED010000-0x00007FFAED020000-memory.dmp
memory/2356-179-0x0000022BDE7C0000-0x0000022BDE7EB000-memory.dmp
memory/2436-0-0x0000000000CB0000-0x0000000000D2E000-memory.dmp
memory/2436-2-0x0000000001510000-0x0000000001566000-memory.dmp
memory/2436-1-0x000000001B9E0000-0x000000001B9F0000-memory.dmp
memory/3472-50-0x00007FFB2B270000-0x00007FFB2B32D000-memory.dmp
memory/3472-49-0x00007FFB2CF90000-0x00007FFB2D188000-memory.dmp
memory/3816-37-0x0000000000930000-0x0000000000944000-memory.dmp