Analysis
- max time kernel
3s - max time network
4s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/09/2026, 17:51
Errors
General
- Target AngryVirus.exe
- Size 482KB
- Sample260910-wfmnfstbrh
- SHA256 b6dac480e4c7f15e8de6633ee9b52b3bda0b6b2f1897a76ddb4ab0ffb76b2588
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\AngryVirus.exe"C:\Users\Admin\AppData\Local\Temp\AngryVirus.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe" /RL HIGHEST2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\MasonMBR-S.exe"C:\Users\Admin\AppData\Local\Temp\MasonMBR-S.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MasonMBR.exeC:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x45c 0x2fc1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
MasonGDI.exe
MasonMBR-S.exe
MasonMBR.exe
MasonRootkit.exe
memory/516-62-0x00007FFEC4CF0000-0x00007FFEC4D00000-memory.dmp
memory/516-61-0x000001B773FB0000-0x000001B773FDB000-memory.dmp
memory/536-1-0x000000001B800000-0x000000001B810000-memory.dmp
memory/536-0-0x0000000000CF0000-0x0000000000D6E000-memory.dmp
memory/536-2-0x000000001B810000-0x000000001B866000-memory.dmp
memory/612-51-0x000002F1E6040000-0x000002F1E606B000-memory.dmp
memory/612-52-0x00007FFEC4CF0000-0x00007FFEC4D00000-memory.dmp
memory/612-49-0x000002F1E6010000-0x000002F1E6035000-memory.dmp
memory/672-54-0x000001CF12700000-0x000001CF1272B000-memory.dmp
memory/672-55-0x00007FFEC4CF0000-0x00007FFEC4D00000-memory.dmp
memory/880-85-0x00007FFEC4CF0000-0x00007FFEC4D00000-memory.dmp
memory/880-84-0x00000193B0B40000-0x00000193B0B6B000-memory.dmp
memory/884-71-0x00007FFEC4CF0000-0x00007FFEC4D00000-memory.dmp
memory/884-70-0x000001A73FEE0000-0x000001A73FF0B000-memory.dmp
memory/1020-83-0x00007FFEC4CF0000-0x00007FFEC4D00000-memory.dmp
memory/1020-73-0x0000025E623D0000-0x0000025E623FB000-memory.dmp
memory/1068-133-0x00007FFEC4CF0000-0x00007FFEC4D00000-memory.dmp
memory/1068-132-0x000002B83AFC0000-0x000002B83AFEB000-memory.dmp
memory/1188-137-0x00007FFEC4CF0000-0x00007FFEC4D00000-memory.dmp
memory/1188-136-0x0000023E2E3D0000-0x0000023E2E3FB000-memory.dmp
memory/1196-140-0x00007FFEC4CF0000-0x00007FFEC4D00000-memory.dmp
memory/1196-139-0x000001C12A2D0000-0x000001C12A2FB000-memory.dmp
memory/1204-142-0x000001BF677A0000-0x000001BF677CB000-memory.dmp
memory/1204-143-0x00007FFEC4CF0000-0x00007FFEC4D00000-memory.dmp
memory/1212-146-0x00007FFEC4CF0000-0x00007FFEC4D00000-memory.dmp
memory/1212-145-0x000001C2EB140000-0x000001C2EB16B000-memory.dmp
memory/1352-148-0x000001E0A1060000-0x000001E0A108B000-memory.dmp
memory/1352-149-0x00007FFEC4CF0000-0x00007FFEC4D00000-memory.dmp
memory/1364-151-0x000001C142FB0000-0x000001C142FDB000-memory.dmp
memory/1364-152-0x00007FFEC4CF0000-0x00007FFEC4D00000-memory.dmp
memory/1376-154-0x0000027CA1960000-0x0000027CA198B000-memory.dmp
memory/1376-155-0x00007FFEC4CF0000-0x00007FFEC4D00000-memory.dmp
memory/1388-157-0x000001DBF7FC0000-0x000001DBF7FEB000-memory.dmp
memory/1388-158-0x00007FFEC4CF0000-0x00007FFEC4D00000-memory.dmp
memory/1468-160-0x0000022361460000-0x000002236148B000-memory.dmp
memory/1468-161-0x00007FFEC4CF0000-0x00007FFEC4D00000-memory.dmp
memory/1592-163-0x00000269353B0000-0x00000269353DB000-memory.dmp
memory/1592-164-0x00007FFEC4CF0000-0x00007FFEC4D00000-memory.dmp
memory/1652-126-0x000001EEAE0C0000-0x000001EEAE0EB000-memory.dmp
memory/1652-127-0x00007FFEC4CF0000-0x00007FFEC4D00000-memory.dmp
memory/1704-166-0x0000021F2AEC0000-0x0000021F2AEEB000-memory.dmp
memory/1704-167-0x00007FFEC4CF0000-0x00007FFEC4D00000-memory.dmp
memory/1760-170-0x00007FFEC4CF0000-0x00007FFEC4D00000-memory.dmp
memory/1760-169-0x0000023BD05B0000-0x0000023BD05DB000-memory.dmp
memory/1776-172-0x000002B6B2D30000-0x000002B6B2D5B000-memory.dmp
memory/1776-173-0x00007FFEC4CF0000-0x00007FFEC4D00000-memory.dmp
memory/1876-175-0x0000018019F60000-0x0000018019F8B000-memory.dmp
memory/1876-176-0x00007FFEC4CF0000-0x00007FFEC4D00000-memory.dmp
memory/1900-178-0x0000025CE8C90000-0x0000025CE8CBB000-memory.dmp
memory/1900-179-0x00007FFEC4CF0000-0x00007FFEC4D00000-memory.dmp
memory/1924-181-0x00000214D7340000-0x00000214D736B000-memory.dmp
memory/1924-182-0x00007FFEC4CF0000-0x00007FFEC4D00000-memory.dmp
memory/2008-185-0x00007FFEC4CF0000-0x00007FFEC4D00000-memory.dmp
memory/2008-184-0x0000021571150000-0x000002157117B000-memory.dmp
memory/2060-187-0x00000276CDB10000-0x00000276CDB3B000-memory.dmp
memory/2060-188-0x00007FFEC4CF0000-0x00007FFEC4D00000-memory.dmp
memory/2068-190-0x0000029E40660000-0x0000029E4068B000-memory.dmp
memory/2068-191-0x00007FFEC4CF0000-0x00007FFEC4D00000-memory.dmp
memory/2080-193-0x00000213C8430000-0x00000213C845B000-memory.dmp
memory/2080-194-0x00007FFEC4CF0000-0x00007FFEC4D00000-memory.dmp
memory/2120-196-0x0000019BA7DA0000-0x0000019BA7DCB000-memory.dmp
memory/2120-198-0x00007FFEC4CF0000-0x00007FFEC4D00000-memory.dmp
memory/2156-200-0x00007FFEC4CF0000-0x00007FFEC4D00000-memory.dmp
memory/2156-197-0x00000146B3060000-0x00000146B308B000-memory.dmp
memory/2224-202-0x0000000001900000-0x000000000192B000-memory.dmp
memory/3960-19-0x0000000000700000-0x0000000000714000-memory.dmp
memory/3976-45-0x0000000006BB0000-0x0000000006C42000-memory.dmp
memory/3976-42-0x0000000000FF0000-0x000000000101A000-memory.dmp
memory/4452-41-0x00007FFF04B70000-0x00007FFF04C2E000-memory.dmp
memory/4452-40-0x00007FFF04C70000-0x00007FFF04E65000-memory.dmp