Analysis
- max time kernel
2s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
05/09/2026, 23:23
Errors
General
- Target AngryVirus.exe
- Size 482KB
- Sample260905-3dk56svbkf
- SHA256 b6dac480e4c7f15e8de6633ee9b52b3bda0b6b2f1897a76ddb4ab0ffb76b2588
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\AngryVirus.exe"C:\Users\Admin\AppData\Local\Temp\AngryVirus.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe" /RL HIGHEST2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\MasonMBR-S.exe"C:\Users\Admin\AppData\Local\Temp\MasonMBR-S.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MasonMBR.exeC:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004C81⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
MasonGDI.exe
MasonMBR-S.exe
MasonMBR.exe
MasonRootkit.exe
memory/72-59-0x00000262BC770000-0x00000262BC79B000-memory.dmp
memory/72-60-0x00007FFD5B890000-0x00007FFD5B8A0000-memory.dmp
memory/480-64-0x00007FFD5B890000-0x00007FFD5B8A0000-memory.dmp
memory/480-63-0x0000022E93D40000-0x0000022E93D6B000-memory.dmp
memory/636-43-0x000001E883A30000-0x000001E883A5B000-memory.dmp
memory/636-44-0x00007FFD5B890000-0x00007FFD5B8A0000-memory.dmp
memory/636-42-0x000001E883A00000-0x000001E883A25000-memory.dmp
memory/692-47-0x0000023C46060000-0x0000023C4608B000-memory.dmp
memory/692-48-0x00007FFD5B890000-0x00007FFD5B8A0000-memory.dmp
memory/708-53-0x000002E232C30000-0x000002E232C5B000-memory.dmp
memory/708-54-0x00007FFD5B890000-0x00007FFD5B8A0000-memory.dmp
memory/880-57-0x00007FFD5B890000-0x00007FFD5B8A0000-memory.dmp
memory/880-56-0x0000020D87700000-0x0000020D8772B000-memory.dmp
memory/1056-68-0x00007FFD5B890000-0x00007FFD5B8A0000-memory.dmp
memory/1056-67-0x0000022A68100000-0x0000022A6812B000-memory.dmp
memory/1132-75-0x00007FFD5B890000-0x00007FFD5B8A0000-memory.dmp
memory/1132-74-0x0000015B13110000-0x0000015B1313B000-memory.dmp
memory/1148-78-0x00007FFD5B890000-0x00007FFD5B8A0000-memory.dmp
memory/1148-77-0x0000012B2E4D0000-0x0000012B2E4FB000-memory.dmp
memory/1240-80-0x000001E899090000-0x000001E8990BB000-memory.dmp
memory/1240-84-0x00007FFD5B890000-0x00007FFD5B8A0000-memory.dmp
memory/1280-82-0x00007FFD5B890000-0x00007FFD5B8A0000-memory.dmp
memory/1280-81-0x00000249EFC60000-0x00000249EFC8B000-memory.dmp
memory/1316-89-0x0000018F9C3D0000-0x0000018F9C3FB000-memory.dmp
memory/1316-90-0x00007FFD5B890000-0x00007FFD5B8A0000-memory.dmp
memory/1344-91-0x000001972CA80000-0x000001972CAAB000-memory.dmp
memory/1344-92-0x00007FFD5B890000-0x00007FFD5B8A0000-memory.dmp
memory/1372-95-0x00007FFD5B890000-0x00007FFD5B8A0000-memory.dmp
memory/1372-94-0x000001D6E8760000-0x000001D6E878B000-memory.dmp
memory/1440-117-0x0000018019CC0000-0x0000018019CEB000-memory.dmp
memory/1440-119-0x00007FFD5B890000-0x00007FFD5B8A0000-memory.dmp
memory/1548-122-0x00000259BCD40000-0x00000259BCD6B000-memory.dmp
memory/1548-123-0x00007FFD5B890000-0x00007FFD5B8A0000-memory.dmp
memory/1696-141-0x00007FFD5B890000-0x00007FFD5B8A0000-memory.dmp
memory/1696-140-0x0000020783310000-0x000002078333B000-memory.dmp
memory/1744-127-0x00007FFD5B890000-0x00007FFD5B8A0000-memory.dmp
memory/1744-125-0x0000018757ED0000-0x0000018757EFB000-memory.dmp
memory/1788-126-0x000002336AE60000-0x000002336AE8B000-memory.dmp
memory/1788-129-0x00007FFD5B890000-0x00007FFD5B8A0000-memory.dmp
memory/1876-131-0x0000023292860000-0x000002329288B000-memory.dmp
memory/1876-132-0x00007FFD5B890000-0x00007FFD5B8A0000-memory.dmp
memory/1912-135-0x00007FFD5B890000-0x00007FFD5B8A0000-memory.dmp
memory/1912-134-0x00000293FA370000-0x00000293FA39B000-memory.dmp
memory/2028-137-0x000002C993980000-0x000002C9939AB000-memory.dmp
memory/2028-138-0x00007FFD5B890000-0x00007FFD5B8A0000-memory.dmp
memory/2108-144-0x00007FFD5B890000-0x00007FFD5B8A0000-memory.dmp
memory/2108-143-0x00000159CDCA0000-0x00000159CDCCB000-memory.dmp
memory/2140-146-0x000002DB21760000-0x000002DB2178B000-memory.dmp
memory/2140-147-0x00007FFD5B890000-0x00007FFD5B8A0000-memory.dmp
memory/2152-149-0x00000161DBB80000-0x00000161DBBAB000-memory.dmp
memory/2152-151-0x00007FFD5B890000-0x00007FFD5B8A0000-memory.dmp
memory/2224-150-0x00000226AF100000-0x00000226AF12B000-memory.dmp
memory/2224-152-0x00007FFD5B890000-0x00007FFD5B8A0000-memory.dmp
memory/2252-156-0x00007FFD5B890000-0x00007FFD5B8A0000-memory.dmp
memory/2252-155-0x000001E2CC590000-0x000001E2CC5BB000-memory.dmp
memory/2364-158-0x00000000009C0000-0x00000000009EB000-memory.dmp
memory/2364-159-0x00007FFD5B890000-0x00007FFD5B8A0000-memory.dmp
memory/2432-162-0x00007FFD5B890000-0x00007FFD5B8A0000-memory.dmp
memory/2432-161-0x0000023172B60000-0x0000023172B8B000-memory.dmp
memory/2484-41-0x00007FFD9B320000-0x00007FFD9B3DD000-memory.dmp
memory/2484-39-0x00007FFD9B800000-0x00007FFD9BA09000-memory.dmp
memory/2548-164-0x000002582E400000-0x000002582E42B000-memory.dmp
memory/2548-165-0x00007FFD5B890000-0x00007FFD5B8A0000-memory.dmp
memory/2568-167-0x000001A043370000-0x000001A04339B000-memory.dmp
memory/3400-199-0x0000000006BE0000-0x0000000006C72000-memory.dmp
memory/3400-98-0x0000000000E50000-0x0000000000E7A000-memory.dmp
memory/5028-29-0x0000000000310000-0x0000000000324000-memory.dmp
memory/5604-0-0x0000000000480000-0x00000000004FE000-memory.dmp
memory/5604-2-0x0000000002640000-0x0000000002696000-memory.dmp
memory/5604-1-0x000000001CAF0000-0x000000001CB00000-memory.dmp