b6dac480e4c7f15e8de6633ee9b52b3bda0b6b2f1897a76ddb4ab0ffb76b2588

Analysis

max time kernel
30s
max time network
40s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
AngryVirus.exe
Size 482KB
Sample260910-wfmnfstbrh
SHA256 b6dac480e4c7f15e8de6633ee9b52b3bda0b6b2f1897a76ddb4ab0ffb76b2588
MD5 85e11c1d67aec0150757e3255d8231b7
SHA1 9167c5ea4a23d59f38e82f128f2b1a2dbbd88cea
SHA512 a25fcf6c359a00e5671b08dbf91fde79fe14e9720d8d8b4980584fbb32f9bba78a8cc8760e5c504fad894e34df1d2693bd1d161539ad4597df3c50c84c1c5e51
SSDEEP 12288:IJvK+727xaxunsCoFJse5vKNkuCCT3X7t8OP:IJKDAxuPondKNHj7hP
TLSH
T1E9A42382B21AE061E2CAF43727BD7A9273F6B0136352F91F51688A213D35FC0977525D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery execution persistence spyware

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3552	MasonMBR-S.exe
1768	MasonGDI.exe
2824	MasonRootkit.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MasonGDI.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\e4bfbfdf_0\ = "{2}.\\\\?\\hdaudio#func_01&ven_8086&dev_0022&subsys_80860022&rev_1001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\\elineouttopo/00010001\|\\Device\\HarddiskVolume2\\Users\\Admin\\AppData\\Local\\Temp\\MasonGDI.exe%b{00000000-0000-0000-0000-000000000000}"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\e4bfbfdf_0	svchost.exe

Modifies data under HKEY_USERS 16 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-3989226554-2204910950-1522900112-1000\02bssxjksdpiqbsl\AppIdList = "{AFDA72BF-3409-413A-B54E-2AB8D66A7826};"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-3989226554-2204910950-1522900112-1000\ValidDeviceId	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-3989226554-2204910950-1522900112-1000\02bssxjksdpiqbsl\DeviceId = "<Data><User username=\"02BSSXJKSDPIQBSL\"/></Data>\r\n"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-3989226554-2204910950-1522900112-1000\02bssxjksdpiqbsl\DeviceId = "<Data><User username=\"02BSSXJKSDPIQBSL\"><HardwareInfo BoundTime=\"1789062751\" TpmKeyStateClient=\"0\" TpmKeyStateServer=\"0\" LicenseInstallError=\"0\"/></User></Data>\r\n"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02toozpfruzfcidc\DeviceId = "<Data LastUpdatedTime=\"1789062727\"><User username=\"02TOOZPFRUZFCIDC\"><HardwareInfo BoundTime=\"1789062727\" TpmKeyStateClient=\"1\" TpmKeyStateServer=\"3\" LicenseKeySequence=\"1\" LicenseInstallError=\"0\" LicenseKeyVersion=\"2\"/></User></Data>\r\n"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02toozpfruzfcidc\DeviceId = "<Data LastUpdatedTime=\"1789062727\"><User username=\"02TOOZPFRUZFCIDC\"><HardwareInfo BoundTime=\"1789062729\" TpmKeyStateClient=\"1\" TpmKeyStateServer=\"3\" LicenseKeySequence=\"1\" LicenseInstallError=\"0\" LicenseKeyVersion=\"2\"/></User></Data>\r\n"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02canmlhqjfcciqb\Response Thursday, September 10, 2026 18:52:30 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAXVTDLqTA7Uil/Th7gGvyEQAAAAACAAAAAAAQZgAAAAEAACAAAACeTma6pmXRZphteB8jzdZrjt8IPg1vDWdXdveEwWAzjwAAAAAOgAAAAAIAACAAAADdpAVvFo1DkZcxxd34niiDgASf7hnTS0jPH0nxgRHBPoAFAACWCLRCagJveRrMbzm/MxvGA6xpGJxFkrSWBOY+/upWcs8gDvLced3+SiqwbjaJ0qVf0cg4ReLe39HSjviu1KcxWJfPw0Yyy9sGaCB9QSx2xpg+2mLJmvaZgNGy3iKeb1alfcUlVD2GJg/2jjHt6JnWbz/J4NSXiw5gTxeLZp+9ecKWz8jWvEs8SwwF4Ho8hqyDYMXdARoYnhIKBscKbEFe42w9d4c8juxhbpORa+5OXA1mJRHxgNAwSDsn3YbPpxWlAEfxoqVFRdkzDQ4QDTmiLhJr6xTjdS2AWWOjt8MQkzHk5RcjAc4PdW/zgCcJ/gTHntOhIx/5cmvOKFO916Hw/EEMYhtdayB9Z8Kx/Ryrl83LeBWYJuMTbYdd/BDgNvY58kBkwJlsGboWJ4oOhdEioLIftSEvLGLlnJ/zoaJFjLf1hrrGuggMMPkhW14rFcBWs3GWh25+ScJchT1bjO3ckYKB5F5glJKmvOo9Up2ydT3mNfLT9+NEbLQwy0iPbFRSs4URhFaMmlWz3lNB81sVvNiq/axslbKESyxFWHQa12NGIfhxiHBqaKGHg/z9dHJxtsJoltkEMLpZpIEyuZba/r330EbCjEIlVfmjX9RfEKXA7n4XLqnaiMHKKpqVhk8x08uQQ+x1izL0X45TFV1LMnlZP4wwPtmykhW5mGVEcgWWLSiOakm0JwJirN6TUbKlqJGFwqOdv1SliNIcfrI6y9cG4aygEM/fHiDppsumiq5+/Cpu4P19Lbo+oFXzKPU/kjEz5/PJ8ywNY83HRX4DtPjRjHd8LGMauniJxTr0grjIa/XXvpeFF/fQDV9hRtMumyvEP+tJBFCg6I/pyk2/UddLmSLqgfWSElCNq0b93zMastQen0+dSzPWBfxfCbHY06MdVBNCG8KvXlmt6MBTXAGlQxedcIItfo2qwxXnP67lQDQ3TPOX5OmTXdlMIEMygBv5xb4k/2SuggCDJWBJht0y5dR5XRmM88g6AnJa+HuduTwgP2DMDlAYxlgKSzlt/afMqwhMwuExWGD8qv/eUq3Kevn+kVl7ff99LKT8iFyZ1t2nsPY86T5qhLZegOe16VK+Jo4h1n+32u5zrUzRXahIrhrXX2oCBhiZ7xLDDFcltatsix0gbsZ+AIp+zgHZudeHt8w1aYDtm0WEwL7g25OWOQN81cYvAM2Lanu9WkvuxmLDBZTY0Pz6qmNKp3Hz4tHEztCsQ9VafY4qkdtjNB/0pNPaaosjTdgenn/chtQEfEeR0OV76aNWFzZK22eGcuKIun7KkMOmV//oCe5Gb7n1b3ee+ZyOZ2Quro0407ru+rJj9PHDnqXjBpKSVA8t8uCZJvhZLGPwK0IglKlRaK9Sy0vv4fMrAOD0PCsnJSjE3INz0Wnnuf8yKGerrrdpss4hytgUT0dX/yMM72nHcLJlmGY6rGFjLaxd0W+a4Y+NXpkO+TBPrg4DsptulO7RZ7quZJkWX+MkmNgAc28MeerwbdzQpPaLSSEtKLyYJhvrouD/7eOrAtA0RN8FSp5aXQQwOaA5lRxsX0eHbmR1+WQg85+4iUjFzDyv8Yl1GuntDVkczc/+RoZXYaSKXmFxKQ2P1vWnLKZLU/3ZumywXfMaXnuGswCuhhgQuj8ern8cIxnQcpImM9zTWpEbuSsfEjZ/eosQBJonJ7gHnqn8ziRdfJr95jSnOZmXcOMJMA/JXhV2dbGBZXuTkkW/zmX2qH1EN4R5/yrUCcyPnQ/yW45LDg3MtTdtWq6GC9TBRlFEW4HSqY6kjM4nIJZKzE7bAgAmnYl8lHjzcak81eKnBnpgu1NRzjsR+rC6G4Wip2YDf/4dt4Q0tzsdJPFmKrwsqorF1tDPEWIFwatQchJAQAAAAC4gB3VScBICfbMqYsxRsyJoHSvm5JIEaEKttOlTifn5U00nYvuZ1sFPwtaR3YX62iPKi7IfPgQB6eY7FEAkzs8="	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ExtendedProperties\LID = "00184019036C6F94"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02canmlhqjfcciqb\Request Thursday, September 10, 2026 18:52:30 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAXVTDLqTA7Uil/Th7gGvyEQAAAAACAAAAAAAQZgAAAAEAACAAAACFYbVMD3M3lQbiDLFFj/B2rI8tyw0rGNHWN3LJUG5bhgAAAAAOgAAAAAIAACAAAACdfrpSnfqKhnjgPmTWUSO0YGx8ktf8OPcgse8guUsj2sASAABfL15csQ+bTVdF23deGnbnMTZhCSU61hrygiWNuc6A1fnI5ij0m61ztknJwdZzo+cXawUw1drEa3lNjIdySm7Mf9WSGQFGvV7paUCejVSmtO/LM6pzOppuLvVw598jPQd/OanWNrTy5t8uSHD6EvEVfCIinrXe13Y/pwZ/8LFez7gGWyA7l9L1yr+y2UCg9vy48ImYp+V/IF7qxdu/r1ZC/v/PWy7nYgcYFVFLnf07k6BAz/yRjdeD7xy6Jw56rgWBMimXYwoptN023PRT7QlY/46E1hAqhP35hHwWY2QzsIXM1WvUa0y7DENqQuG42NTjuFRqhfWdXWZhrOFmgXQg650iIhD84ULdnCRLPkDduudVX7k5NDlQ3vkYzIw9zrGhXRc5+MON9X8kIw+6PqGjPSQ/S9AVEHDJv6LUN68FVtSoUyvxoRvQFYLVlgk1TwwdzKg0+LiygYuFlISKwe0KFXH6RdPe1jwLdBkt+P55/uBpoQNGtdBSWBH+7KNsyQigyJrghAZV4MLymoAujovNw0Lw0pi4jBrwU0x/zZx296eO2mW6sywYc30Hl3qcQaJGm0aMmo0rLcvY7L0Eldla2bZo4+PSqmMXEUUouKChVPBJ+Npb09lwNBQ9JrrLA+x6aKsg8sqm9ttbM8JReguWHNqlV3+C993Wzn7Aoc3NWqNhurpRufm0hJ55wUYB19vefsNENj8VUbOYdBhc1jIiESefqDYmY9FEk1PGLaTKHPAfCXoWk7MaWwOnfbivn7EaF2v62+vO1AeDFZ3oORnIUQW/ZmfbNXaDUAkDhOmphugs3/tALVOb1ggxcZ0jnnV783ayFiwuvV3x0P5Rl5IWyy99JcE8aGKx/TwV5oVD8RAKZqJc8h7EIwLiLtviPZjjoz1mh7PvtyOyago8eSkoIMkZ/VVb/J5YGv84EBsaGAwi7TlC0NubrL81vxZS/DeoH9Hg5u/H2GOahOnzLKnCrGtfcG1NcdPcoXW+1Pl+RjYFR3e0LdrIAEtwvH4qLZlZPky5fKajOOjkmyZnB2YBt1BGroq1s7TF22mDQj0W2Fw4VsujAUIL1X8cJGRiUAIn79trDevRcSXrWvXMjfXdkVFWSew+AuVFLr3SPL/nNaVlRYmzK7NIjj2bPHUBwp0d6LmaF07vY86HU+mKvymEsApGBPCh0dhkrjwQX4uTiVO7aeTkf/n3LdjMS+m5x07/TqAPMnqsbTDvqMcXTN7JSg6oJIc32dUs1+kEJ6Rup3/WXEwkTX1inMpVztS5egEuSoadD7qxiyRRJI3HkLJYKA9m2jUtAiyz56+5hilVPZATvye3bmn/U9IFX8xbx3VdLIhk+LhHF/RxEP6BogRaQmx7jrWofRx+Bq5fsedFhtyjtD3ILlq4YIRNAzF/0klW9W5vzIkfrG63vgPiId5QPygosYc4FGgdIZXLdOJZwQw/v+3W671I+iVxKEbXvCSmxz3eXMAMnia6tuD6FgEkQykkzia94c0L0HEnh/iJJb+wIy5sgLA7bxSaml11bOGBi7Al9Qsu8vryaGFKqi1d4IbD497hLWFBz73Nb+UR7ocXdzUdaR9JKj8DiaeP8Q16DhhEWiDFGZdqfgkRwJeI51sFKCWseiqiTARU8dlRxBMbRRluDSpml98GYhl2EP4qS+gJivPblRXo5CMaxJ/np1HZhwWDV35Wf/yt1tPNLrEQVUzMnZ8LpYKXkfA+7AKU+Wm+IiqxDjeI5q9MBNeih2GmZ3/htzZ419T093Cy413qaAME/OQlNo8p16cKbkEn/KTQ4DDbXyhB4w2EuMpQ/HGH97npvs99Ab9yaoRj31DGIhRiTQxxfhs5fORvFFPfuQjmtFdVZXhR5M56heMAFKzAEEIL9PuI6vlg7QJ8AM4qV2a9iqnh6OZ3dOGmissrN9/9z1FOsqpZItKUau0WTGVvM3+XGgj05bVF9PSjoemrWptdOzNpQY4f0J4BD3n4v/vKBJkacgoah6gijvrhSKpujQdn6SMJD7TiTIcsJRLEYJCzMUnU2ylmRcjVGyq1xUj0+IywFkjxKIGw9dKBD/1iHQIpxNOPUQ7AiprvIBI43ANapzxp5Txk0qTJRzjx6c5fS476gJ5UfTHXzMBF14I0m9zvTJpTvuOh4ywzMUjVitoY8Ef+B3vKqA/rY/tT2n4BoNPfGcWHrpnctOFRRXmGFs8T8lrlvZr0FoBSBYJKJ4bF0qqdtk5LkM2EuayRWANxrzCtPBnqrKzzQgVBwc3CsTpi+OH5W2xmqYjWfnUGTD1J6cjnUU82ggbRCbj5KOewTVXbLy5IgHucKrsNAL2LKUhstZN+4aCcXDrI8bXRU9nDR0P62NaFwERhIku4/l6ACwTyiWlP3VDV69JmCM3knOGOcjHjzrNADAaFd1vYkFTi2UGdhXww3A9NNe45bq7a3fRc4AP5Q9tOlxgagGaO4xaAtBJKZJmXCoDmSLJw8Si3stbWR9ehSWWt2VJlTcgrJaRFJfoFnKgfUi8Axa4O6wq1hjbeUckPo5C2SqpypM3B3zfSqfI7iyaz05Ae5jseRsLizkYxydXjvoJ2TbETxsolN0ujGvIsXEVSwpa7LgW9K7xFdl2ZLg2v216zfNiDA5DS9Aqli+qMbYN0RPhQI+9xhpk05POzJ9/vWdcYJacuiJfhUxUt4MPAoECj+tTLRzV9jA2q3ecqnD2a9v6TVLgUrTY8CWgAzIVL5YMCddeGp6jb4FoLRI4cVWrMzBGDVcfctTtpteLEDfiCS/CzF1wjLMQt72iFqaeUWOVA7dZAsoIuuOR+mkI4bMDnCfwc0Hps8QIttSheIPXcfbzYGgPnJyUqfOY0Ot+1k9Vxm0u9A/gbztrePnEetMANZhZvUxFy8NUFElC/rUbFJzVKoPhYX6qdKRz1jbAQqcEJ+QASHbJWQ5Dbxl4r3qtYs52hlzmGs4OMMrEWY0hlDAZ9CqGQfgejkBv9LVDy/N8HHuHoauhnUo2m+AYQPEs44hlRkprZ1yEtC6uLMPTtrQhaNzIfWiPVohiWKhK/bQzDvdNAUn1uYleTy/cWf93EpLm6hG22FJ2xz1VN5Z7MeHSsAK4CLR2aKiagD6i4B20kvIjhOtEYP4nbn0azdRA42Ch/B2qb1RRmeYEGI9ohfKGVVWbJivCetkdUyAXYNBXFSCINHCKr0gIDBmxP1/OtST7up/6DLiRo9iaxBH25Oy1cHvL1eRsMqM8XlSBUM7N8dYWVjYzl8qDjzQjItxXXGlgdehbO3juLyH/0kk/lgvZODYBAhgUSINhwq2UlY2DBxFSmJKSK++DUOcGZY2/3K/SmDkCqzMoGticxP5SxAy5UAlAOXWNJgpco3EVdkeCkXSydomb8xkGaqAxCwLJfPUkp73GhpEUVViEBVXwLBg2JLRMov/LRvlsa1YU0wQfoGlllqV911qvSOGtLRjo00JSL4Dot1E354Shcy6b23vgF2S3XGBs/FDp0Tv7YSqAmcof/v24asG9q8VRkHCdnrWJgjrX7O58+BByBVDlXIPZEQFFmPuQ0xuzCVpbXAqw9amr0bHS1jFMTACHdyPeif2FHsmsxi1arZdNyK/7HvdT4K22sMyEDr16FRAOFdQ3Jbuf49yaN4Txg0ZZoJMgj4fePG5j6+96zjQ7xJnJbdIBtpYmc55uiFXGrdIJvJ1uLwkb3WPPEuw3yJglBT11y+fCAJmKr54rdp+U4CJDm3ZiL+92qgkbQvhb4mdLkbAxs35fT8NQqpOeyyLT+dfTslRfpWaHlsAszglmnuFeF1pjRZlKAIbTVDzY6b2xJ5d8Fp0M2Fs52rOty+J3/FUXGSJueG6YKLmAS/zFG73IMgvfyfeHhk4KmbHCbl6NzhYrU8Uk1UocgpM7f5QsfJHvfUC3fGIT0LbWILavFOYMSygiU6mak6DG6YBdNlO2nqqhUD9UnM33cqxc+DHFMcEe7KB3J+Gr5lkWuYCdv2qQAm+XYSBreym4Pabfjk7zBVuVae8SM9on4OiQNyPl8tM8tOljQoDj3LxDuwXXIOlpWtIlFHVDwlmKL7F8q5Y/fnJ2HcbPicvL/E04M08fNKttoSSTMlsdS5ulr0DZ0dq+xoEO2A+G+phvaU9Xx14yQDEdmuydMvTPppCYc4PFOz+wPzqQO34CW6WgkzTHBv7bmgVlPAkztJmptptDoz36DzQ68mfP1KYnodmopWcuHqW+7NCIWZ5IENglLigJ/jXBzJj4704jKKyCoZidWuVhR4zKT8Mx99D2WCKf+5gQ2LHZqKlTIzYVP+fxyJNWmX8udlMHEYjV83J4vFg+0+iDWtFrIjedmD6pW+vCo9YIEz5LOSc8kcjNNEZlJRR5UagO5y5bdFdzm9aHqs4U1409F+Jj9FXkuRHMpDR8nQZYlpKhvOU6DyQEhl0dip5r//txm4YYKCQXOFBTWSA16pP7dsoEkCSzXmDE4CdBAAHSKbEDZGBwwXoQ6f4YKvdjKSMPCjx86trdzss0F1Et6W11gvtgwdarTrtTKaCvk5juQ0XMJTx8UlCfW7VXtXod/O46Ybcq0WqXQ0OEjU9hhOGAmEVI1V1sCMZoRvGfdrCDVvpMqKQO7PGBFCzrltQQjwF+aQx1+oPYdITdriBUHunT7Vc7XTEXG25iFDsynclOoPrSL0utIi8qUOOKfC5++PMO3HnsYrnW2PnRs5WjgOMtSa92uIy1Y15CPHWwZBtNVTlPe/TqCtEvYGF30oiAiCBhXGq8du8gXIsJhSymt8wm42Lty706FXSguRMHp+MMkrLng+NKcpgrTWb6F5IFvTUr8dWHz4NPYSPTckBIq1rXnQQD4pbSmG4VD7BJIhxQGxgdWBVxvPtTpR8RK+VpT2llVXK8OgPghz5uqJmFqJrPuOldDwDWzvg/jNpQuxCQr+UD0knucroR/dFXoacFPlakWf0fV1kMssIrcsXIXMpYeWBRiT1ZQ93amipA7DoonN6nSMEtxdB9QmkIPnXDBIlIJQlVYcgMEtyiaScYbOMHgpelaiIU1iXksTTGKCdORPaGBEoAMgtEbaAl7wyl7L3N3NxPfROR9FoctA9o3+Zp37WyonSr78SSO2FsI5l+P1P63afmB8zf7rGBqY1v9Fcwmt611LnRD30wW2gVjszE4ejRfLCg6lCCVJvdtW4RkpXIFuuJViGVDp8Nzi7z7dh053ACvwn6kXZVxEi8IhzD+YP5zXEyLm336f22NtVOd0uAKqpzruLHIJnAPXezYznjiZUzSnoqVOnQnWXwwG6MQ/DrWmJ5gixVDD5kqMV2PW47LzCMCjdnj9LAha7a6eb6ancz2qkKtytfm1WAbTe6GqWBBnDFDcD2p/J4xHVvhe2LElyxmMRBdGX9eCb27YL6ZBH8T2Ad+zzET5zvHqjD90SuYzNpEnK7tCwMC9nZdJCEb061jxYCJen0ADlC6KtslpYKh21jsBIUpfaJbCn4GlI+rsUby267g8vJ5NtnWYZePtkTrtJvrRQLxJhizgWJN2vUWxr4HGmNcRxBlZAr7h/+dDOpfIte3kHnoNkstEPZuPkSDMjhVCrn7VU/RVIsBZAMpiVITZuSUroTgDqaeVHk1VTOVF/q1TUWknDlPnAa3uo8UecOazf1W7Ll8UZoKfqVAuYGv0x6ofxteM8IKvrCVTycRDubdJYOdkUf0/RjLp8f3p+JX3g3Lb+4lncEUAmJadoM/KryMGuUtdzql83jnnNbP00EhFzBTV/FQqE2yiy3dcRRHOnVQGLM1YGvmZ6ti5eEb0qGavFBrTj/x87z+2wlaeNNgdhchywUYxgqlhJ6CJzXu02ZGzt94+Acx6mRaI4+Vt3vAB8C4rTt1VhI/hR7j1ZT4IEdW8sNgAGKRAr6NL11ObCqa8VCbW2mvHjKu/6YNb0iGBkLRIVUT4w97a28PiK/r4rv9w+pVcFRUbT58uOwg7SugUX5cyIJY7uVcLhZvYA/BgJH9pLzqSO5qN6j4USfXso01meVMYObCqmCdWVinpZ9l6jzoSQUXIIPOEfq+Gu1NnEyJD+MCeT6Mzkur8BSf/uVhUgJXygTTcaALqKhjBEF9hlXPv8THXsiLCSltQS1hQ37JVcz40tbg7If4zOzy6GIEyqP2Nc++kk+wHDbhA4Q8rZ2Mny/Kuq9HZPPTAk4x+P4YbJ+LdIE+JpsLBjERgdRxkh7nzqtY65HToMsMH27dPyltq7mFXCdhKMm8R6wxJubyqfyUWGyyKQJMnbS9gBnCNWTHQ+2P0YyfkjHfOl9K3bAp0y7HlAlDMoDb5okVMlQNeftTwERFLGgOHIVroHsPRJcXtFDDW9LQs2ihDBPrVQEkZsG4lRDfiHT5yxLVksjKIex6OXApvhpeQgdBzSDEnzRje0NAAAAAvwvjiuiU0DSZ3GZQSRrJSeuq7PIic5GE8smmmYG9x13VfXvmvVGeqMv2J51o/wlmg6kVydhiMhF/zUrjIOnUvA=="	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-3989226554-2204910950-1522900112-1000\02bssxjksdpiqbsl	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-3989226554-2204910950-1522900112-1000\ValidDeviceId = "02bssxjksdpiqbsl"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-3989226554-2204910950-1522900112-1000\02bssxjksdpiqbsl\DeviceId = "<Data><User username=\"02BSSXJKSDPIQBSL\"><HardwareInfo BoundTime=\"1789062752\" TpmKeyStateClient=\"0\" TpmKeyStateServer=\"0\" LicenseInstallError=\"0\"/></User></Data>\r\n"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02canmlhqjfcciqb	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-3989226554-2204910950-1522900112-1000\02canmlhqjfcciqb\Reason = "2147780641"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-3989226554-2204910950-1522900112-1000\02canmlhqjfcciqb\AppIdList	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\NotificationData	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1256	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe
2824	MasonRootkit.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5292	explorer.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	2824	MasonRootkit.exe
Token: SeShutdownPrivilege	5292	explorer.exe
Token: SeCreatePagefilePrivilege	5292	explorer.exe
Token: SeShutdownPrivilege	5292	explorer.exe
Token: SeCreatePagefilePrivilege	5292	explorer.exe
Token: 33	2580	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2580	AUDIODG.EXE
Token: SeShutdownPrivilege	5292	explorer.exe
Token: SeCreatePagefilePrivilege	5292	explorer.exe
Token: SeShutdownPrivilege	5292	explorer.exe
Token: SeCreatePagefilePrivilege	5292	explorer.exe
Token: SeShutdownPrivilege	5292	explorer.exe
Token: SeCreatePagefilePrivilege	5292	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 1256	1620	AngryVirus.exe	89
PID 1620 wrote to memory of 3552	1620	AngryVirus.exe	91
PID 1620 wrote to memory of 1768	1620	AngryVirus.exe	92
PID 1620 wrote to memory of 2824	1620	AngryVirus.exe	93
PID 2824 wrote to memory of 740	2824	MasonRootkit.exe	5
PID 2824 wrote to memory of 964	2824	MasonRootkit.exe	9
PID 2824 wrote to memory of 972	2824	MasonRootkit.exe	10
PID 2824 wrote to memory of 520	2824	MasonRootkit.exe	11
PID 2824 wrote to memory of 900	2824	MasonRootkit.exe	13
PID 2824 wrote to memory of 1088	2824	MasonRootkit.exe	14
PID 2824 wrote to memory of 1132	2824	MasonRootkit.exe	15
PID 2824 wrote to memory of 1140	2824	MasonRootkit.exe	16
PID 2824 wrote to memory of 1208	2824	MasonRootkit.exe	17
PID 2824 wrote to memory of 1264	2824	MasonRootkit.exe	18
PID 2824 wrote to memory of 1284	2824	MasonRootkit.exe	19
PID 2824 wrote to memory of 1436	2824	MasonRootkit.exe	22
PID 2824 wrote to memory of 1444	2824	MasonRootkit.exe	23
PID 2824 wrote to memory of 1468	2824	MasonRootkit.exe	24
PID 2824 wrote to memory of 1504	2824	MasonRootkit.exe	25
PID 2824 wrote to memory of 1736	2824	MasonRootkit.exe	26
PID 2824 wrote to memory of 1852	2824	MasonRootkit.exe	27
PID 2824 wrote to memory of 1864	2824	MasonRootkit.exe	28
PID 2824 wrote to memory of 1936	2824	MasonRootkit.exe	29
PID 2824 wrote to memory of 1064	2824	MasonRootkit.exe	30
PID 2824 wrote to memory of 1364	2824	MasonRootkit.exe	31
PID 2824 wrote to memory of 2180	2824	MasonRootkit.exe	32
PID 2824 wrote to memory of 2196	2824	MasonRootkit.exe	33
PID 2824 wrote to memory of 2232	2824	MasonRootkit.exe	34
PID 2824 wrote to memory of 2320	2824	MasonRootkit.exe	35
PID 2824 wrote to memory of 2372	2824	MasonRootkit.exe	36
PID 2824 wrote to memory of 2448	2824	MasonRootkit.exe	37
PID 2824 wrote to memory of 2584	2824	MasonRootkit.exe	38
PID 2824 wrote to memory of 2620	2824	MasonRootkit.exe	39
PID 2824 wrote to memory of 2648	2824	MasonRootkit.exe	40
PID 2824 wrote to memory of 2744	2824	MasonRootkit.exe	41
PID 2824 wrote to memory of 2892	2824	MasonRootkit.exe	42
PID 2824 wrote to memory of 2968	2824	MasonRootkit.exe	43
PID 2824 wrote to memory of 2432	2824	MasonRootkit.exe	44
PID 2824 wrote to memory of 1312	2824	MasonRootkit.exe	45
PID 2824 wrote to memory of 3180	2824	MasonRootkit.exe	47
PID 2824 wrote to memory of 3188	2824	MasonRootkit.exe	48
PID 2824 wrote to memory of 3480	2824	MasonRootkit.exe	50
PID 2824 wrote to memory of 3576	2824	MasonRootkit.exe	51
PID 2824 wrote to memory of 3608	2824	MasonRootkit.exe	52
PID 2824 wrote to memory of 3648	2824	MasonRootkit.exe	53
PID 2824 wrote to memory of 3656	2824	MasonRootkit.exe	54
PID 2824 wrote to memory of 3664	2824	MasonRootkit.exe	55
PID 2824 wrote to memory of 3688	2824	MasonRootkit.exe	56
PID 2824 wrote to memory of 3224	2824	MasonRootkit.exe	57
PID 2824 wrote to memory of 808	2824	MasonRootkit.exe	58
PID 2824 wrote to memory of 4364	2824	MasonRootkit.exe	59
PID 2824 wrote to memory of 4408	2824	MasonRootkit.exe	60
PID 2824 wrote to memory of 4448	2824	MasonRootkit.exe	61
PID 2824 wrote to memory of 4700	2824	MasonRootkit.exe	62
PID 2824 wrote to memory of 4708	2824	MasonRootkit.exe	63
PID 2824 wrote to memory of 5016	2824	MasonRootkit.exe	64
PID 2824 wrote to memory of 5168	2824	MasonRootkit.exe	65
PID 2824 wrote to memory of 5232	2824	MasonRootkit.exe	66
PID 2824 wrote to memory of 5268	2824	MasonRootkit.exe	67
PID 2824 wrote to memory of 5668	2824	MasonRootkit.exe	70
PID 2824 wrote to memory of 5028	2824	MasonRootkit.exe	72
PID 2824 wrote to memory of 3216	2824	MasonRootkit.exe	74
PID 2824 wrote to memory of 4236	2824	MasonRootkit.exe	75
PID 2824 wrote to memory of 952	2824	MasonRootkit.exe	78

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:740
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:972
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1140

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:964

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-2397f0ee-3992-4876-a3b3-0e459d4c3afe -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-74f0f715-2a6c-48e8-b3ca-e63d2106812d -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-a3c6df16-4b2e-4101-8803-3b1d6b964bda -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-a2d46ba4-c522-4eda-b7f7-57b99dfa3280 -LifetimeId:11de9307-032d-4ef4-b7cf-bde4cb6264c1 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1088

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1208

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc
1⤵
PID:1504

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1852
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:1300
- - C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    3⤵
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:5292
  - - C:\Users\Admin\AppData\Local\Temp\AngryVirus.exe
      "C:\Users\Admin\AppData\Local\Temp\AngryVirus.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1620
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1256
    - - C:\Users\Admin\AppData\Local\Temp\MasonMBR-S.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonMBR-S.exe"
        5⤵
        Executes dropped EXE
        
        PID:3552
      - C:\Users\Admin\AppData\Local\Temp\MasonMBR-L.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonMBR-L.exe"
        6⤵
        
        PID:1204
    - - C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1768
    - - C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2824

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1064

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:2196

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2320

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
- Modifies Internet Explorer settings
PID:2372
- C:\Windows\system32\AUDIODG.EXE
  C:\Windows\system32\AUDIODG.EXE 0x0000000000000504 0x0000000000000508
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2580

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
PID:2448
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:0000000000000268;000000000000026C;
  2⤵
  PID:5016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2584

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc
1⤵
PID:2620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2648

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc
1⤵
PID:2892

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2968

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:1312

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:3180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:3188

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:3608

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:3656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:3688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:808

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4364

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4448

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4708

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:5168

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:5232

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
PID:5268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc
1⤵
PID:5668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:5028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3216

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4236

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:952

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:3340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Modifies data under HKEY_USERS
PID:3336

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MasonGDI.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe
Size 147KB
SHA256 24f189af6d0c0af7dbdbf230183423d34d9cc3c06f55fa911145dcc19e3a6eb6
MD5 fd138f51961f3071e135dae4e279ca7d
SHA1 63a107425ab4b3515b4c6545076ac6721a459717
SHA512 f0d596ebe25c89907018f4d5ca4635df28c7f7095c81bd4d6f6b0819301bd113fb2469d643c02b5d41f2ce523e8539c1a97a817160ee0074d6e1f0a7951e7804
SSDEEP 3072:6NLBkRkkil8Wq1bQKn+D1LZc3CCT3aD+3V7t8OaahrpLfc:6NLG39Toc3CCT38m7t8OPdR
TLSH
T196E3124596808060EB07BE3ECAF7C15257FAF34AAD92BD5F5EBA1E243D34B4158B4312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MasonMBR-L.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonMBR-L.exe
Size 93KB
SHA256 b9177dd0173b676408b79085e0a18a4bf35356b76acf79aa6039a36911796e3c
MD5 b92a9c7baa9414d17e93112f621734b8
SHA1 f8f74b452bf78fd0dda4601d219d99d000d57606
SHA512 0ab4781877b788acdf0c8ac9fd18e71fcf8a42f960e4b12ae0b81dbbe8abc25092ff4119c877863814e97180a6ade73ec567809e21ca5e8f543f7e7690c7d9e9
SSDEEP 1536:CmwoXyoci5SjY3SaRO7IPqifrJxdhGZCJjmGasWhQcdQ5/hO2o2jn:Tv5MYRIMPqiTJx+ZqreRQ5/hXo2r
TLSH
T19D937C43B5D28CB1E5B21D3118B1C9A19A6FB9210E248E6B7794137E5F340D0AE36FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MasonMBR-S.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonMBR-S.exe
Size 58KB
SHA256 34c657218a5d7702de283691e868f61c1f50ffcd9e6c6bd3f0336bda904975aa
MD5 1b120dcde4b7be948179d53257c71423
SHA1 efd894e18d8d9eb8b0af9e8eeaa0d44be04a7b62
SHA512 fb5ac3cdc836926919710edb15f0e4cb54a72f74122566ac2a965efb1b36daa94cdf01b4b984203d0d4c0deb0791f65d20d675029b40fa7e1baafd3194e4dbfe
SSDEEP 1536:0Xk0xKAR8NpSniWGpBZDOi23gkSH6MH/Rkexit:V0Gii3HEi2wkyHiSit
TLSH
T17B43F151E7DE01E3D31C4BF00D2311D752BAD719DD23A72E599CF2274F5B01E822A69A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MasonRootkit.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/520-129-0x00007FFB185A0000-0x00007FFB185B0000-memory.dmp

Download

memory/520-128-0x000001CA70960000-0x000001CA7098B000-memory.dmp

Download

memory/740-44-0x000001E1E9CC0000-0x000001E1E9CEB000-memory.dmp

Download

memory/740-43-0x000001E1E9C90000-0x000001E1E9CB5000-memory.dmp

Download

memory/740-45-0x00007FFB185A0000-0x00007FFB185B0000-memory.dmp

Download

memory/900-132-0x00007FFB185A0000-0x00007FFB185B0000-memory.dmp

Download

memory/900-131-0x000002257FFC0000-0x000002257FFEB000-memory.dmp

Download

memory/1064-170-0x0000018F2D720000-0x0000018F2D74B000-memory.dmp

Download

memory/1064-171-0x00007FFB185A0000-0x00007FFB185B0000-memory.dmp

Download

memory/1088-135-0x00007FFB185A0000-0x00007FFB185B0000-memory.dmp

Download

memory/1088-134-0x000001460DBE0000-0x000001460DC0B000-memory.dmp

Download

memory/1132-137-0x000002665AC40000-0x000002665AC6B000-memory.dmp

Download

memory/1132-138-0x00007FFB185A0000-0x00007FFB185B0000-memory.dmp

Download

memory/1140-56-0x00000292B16E0000-0x00000292B170B000-memory.dmp

Download

memory/1140-58-0x00007FFB185A0000-0x00007FFB185B0000-memory.dmp

Download

memory/1208-141-0x00007FFB185A0000-0x00007FFB185B0000-memory.dmp

Download

memory/1208-140-0x000002648A820000-0x000002648A84B000-memory.dmp

Download

memory/1264-144-0x00007FFB185A0000-0x00007FFB185B0000-memory.dmp

Download

memory/1264-143-0x0000020716B70000-0x0000020716B9B000-memory.dmp

Download

memory/1284-146-0x000001A274D90000-0x000001A274DBB000-memory.dmp

Download

memory/1284-147-0x00007FFB185A0000-0x00007FFB185B0000-memory.dmp

Download

memory/1364-173-0x0000023C698D0000-0x0000023C698FB000-memory.dmp

Download

memory/1364-174-0x00007FFB185A0000-0x00007FFB185B0000-memory.dmp

Download

memory/1436-149-0x0000018A86610000-0x0000018A8663B000-memory.dmp

Download

memory/1436-150-0x00007FFB185A0000-0x00007FFB185B0000-memory.dmp

Download

memory/1444-153-0x00007FFB185A0000-0x00007FFB185B0000-memory.dmp

Download

memory/1444-152-0x000001501EF40000-0x000001501EF6B000-memory.dmp

Download

memory/1468-64-0x00007FFB185A0000-0x00007FFB185B0000-memory.dmp

Download

memory/1468-63-0x000001FAF2CF0000-0x000001FAF2D1B000-memory.dmp

Download

memory/1504-155-0x00000174C9DB0000-0x00000174C9DDB000-memory.dmp

Download

memory/1504-156-0x00007FFB185A0000-0x00007FFB185B0000-memory.dmp

Download

memory/1620-38-0x00007FFB35AA0000-0x00007FFB36444000-memory.dmp

Download

memory/1620-0-0x00007FFB35C2F000-0x00007FFB35C30000-memory.dmp

Download

memory/1620-1-0x00000000001F0000-0x000000000026E000-memory.dmp

Download

memory/1620-3-0x00007FFB35AA0000-0x00007FFB36444000-memory.dmp

Download

memory/1620-2-0x00000000022A0000-0x00000000022F6000-memory.dmp

Download

memory/1736-159-0x00007FFB185A0000-0x00007FFB185B0000-memory.dmp

Download

memory/1736-158-0x000001D9BCE00000-0x000001D9BCE2B000-memory.dmp

Download

memory/1768-41-0x00000000069C0000-0x0000000006A52000-memory.dmp

Download

memory/1768-37-0x0000000000B30000-0x0000000000B5A000-memory.dmp

Download

memory/1852-162-0x00007FFB185A0000-0x00007FFB185B0000-memory.dmp

Download

memory/1852-161-0x000001AD439B0000-0x000001AD439DB000-memory.dmp

Download

memory/1864-164-0x000001C58BB00000-0x000001C58BB2B000-memory.dmp

Download

memory/1864-165-0x00007FFB185A0000-0x00007FFB185B0000-memory.dmp

Download

memory/1936-167-0x0000024FE5B30000-0x0000024FE5B5B000-memory.dmp

Download

memory/1936-168-0x00007FFB185A0000-0x00007FFB185B0000-memory.dmp

Download

memory/2180-176-0x0000022256FD0000-0x0000022256FFB000-memory.dmp

Download

memory/2180-178-0x00007FFB185A0000-0x00007FFB185B0000-memory.dmp

Download

memory/2196-177-0x000001F0BA760000-0x000001F0BA78B000-memory.dmp

Download

memory/2196-180-0x00007FFB185A0000-0x00007FFB185B0000-memory.dmp

Download

memory/2232-183-0x00007FFB185A0000-0x00007FFB185B0000-memory.dmp

Download

memory/2232-182-0x000001C77FD10000-0x000001C77FD3B000-memory.dmp

Download

memory/2320-185-0x0000027223850000-0x000002722387B000-memory.dmp

Download

memory/2320-186-0x00007FFB185A0000-0x00007FFB185B0000-memory.dmp

Download

memory/2372-187-0x000001CBCCB30000-0x000001CBCCB5B000-memory.dmp

Download

memory/2372-189-0x00007FFB185A0000-0x00007FFB185B0000-memory.dmp

Download

memory/2448-191-0x0000013CADE10000-0x0000013CADE3B000-memory.dmp

Download

memory/2448-192-0x00007FFB185A0000-0x00007FFB185B0000-memory.dmp

Download

memory/2584-194-0x000001CB29530000-0x000001CB2955B000-memory.dmp

Download

memory/2584-195-0x00007FFB185A0000-0x00007FFB185B0000-memory.dmp

Download

memory/2620-197-0x000001E345850000-0x000001E34587B000-memory.dmp

Download

memory/2648-198-0x0000021DA6000000-0x0000021DA602B000-memory.dmp

Download

memory/2744-200-0x000002A807440000-0x000002A80746B000-memory.dmp

Download

memory/2824-36-0x00007FFB57700000-0x00007FFB577C7000-memory.dmp

Download

memory/2824-35-0x00007FFB58460000-0x00007FFB586C3000-memory.dmp

Download

memory/3552-327-0x00007FFB35AA0000-0x00007FFB36444000-memory.dmp

Download

memory/3552-21-0x0000000000EA0000-0x0000000000EB4000-memory.dmp

Download

memory/3552-315-0x00007FFB35AA0000-0x00007FFB36444000-memory.dmp

Download

memory/3552-31-0x00007FFB35AA0000-0x00007FFB36444000-memory.dmp

Download

memory/4352-125-0x000001D15CC40000-0x000001D15CC6B000-memory.dmp

Download

memory/4352-126-0x00007FFB185A0000-0x00007FFB185B0000-memory.dmp

Download

memory/5016-104-0x000002A1DD180000-0x000002A1DD1AB000-memory.dmp

Download

memory/5016-105-0x00007FFB185A0000-0x00007FFB185B0000-memory.dmp

Download

memory/5292-120-0x0000000003AE0000-0x0000000003B0B000-memory.dmp

Download

memory/5292-121-0x00007FFB185A0000-0x00007FFB185B0000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads