Overview

overview

8

Static

static

3

MasonEAX/O...AX.exe

windows10-ltsc_2021-x64

8

MasonEAX/O...AX.exe

windows10-2004-x64

1

MasonEAX/O...AX.exe

windows11-21h2-x64

1

MasonEAX/O...AX.exe

windows11-ltsc_2024-x64

1

Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    142s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260911-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    23/10/2026, 14:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    MasonEAX/OctopusEAX.exe
  • Size 1.4MB
  • Sample261023-rxyd3ada93
  • SHA256 6c1758ea8aff65a6f69bfab05752a343077bdffae6873ac1d83dbaa00dc1fc19
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistencespywaretrojan

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 16 IoCs
  • Drops file in Program Files directory 10 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 42 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 41 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\MasonEAX\OctopusEAX.exe
    "C:\Users\Admin\AppData\Local\Temp\MasonEAX\OctopusEAX.exe"
    1⤵
    • Checks computer location settings
    • Reads the TCP/IP host and domain name from the registry
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4732
    • C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Query /TN "OctopusEAX"
      2⤵
        PID:748
      • C:\Windows\system32\schtasks.exe
        "C:\Windows\system32\schtasks.exe" /Query /TN "MasonEAX"
        2⤵
          PID:5176
        • C:\Windows\system32\tar.exe
          "C:\Windows\system32\tar.exe" -xf "C:\Users\Admin\AppData\Local\OctopusEAX\vbcable\VBCABLE_Driver_Pack.zip" -C "C:\Users\Admin\AppData\Local\OctopusEAX\vbcable"
          2⤵
            PID:440
          • C:\Users\Admin\AppData\Local\OctopusEAX\vbcable\VBCABLE_Setup_x64.exe
            "C:\Users\Admin\AppData\Local\OctopusEAX\vbcable\VBCABLE_Setup_x64.exe"
            2⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:5116
        • C:\Windows\system32\AUDIODG.EXE
          C:\Windows\system32\AUDIODG.EXE 0x244 0x458
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:5600
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
          1⤵
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1964
          • C:\Windows\system32\DrvInst.exe
            DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{c1b43a2c-995d-f24b-a0aa-32768cf0f6a9}\vbmmecable64_win10.inf" "9" "412cfd737" "0000000000000178" "WinSta0\Default" "00000000000001DC" "208" "c:\users\admin\appdata\local\octopuseax\vbcable"
            2⤵
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Modifies data under HKEY_USERS
            PID:1420
          • C:\Windows\system32\DrvInst.exe
            DrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:c14ce8840c48fa1f:VBCableInst.NTamd64:3.3.1.7:vbaudiovacwdm," "412cfd737" "0000000000000178"
            2⤵
            • Drops file in Drivers directory
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            PID:2820
        • C:\Windows\system32\werfault.exe
          werfault.exe /h /shared Global\7917f9e3f9354369b9526bad7a749e9a /t 4192 /p 5116
          1⤵
            PID:4236
          • C:\Windows\system32\OpenWith.exe
            C:\Windows\system32\OpenWith.exe -Embedding
            1⤵
            • Suspicious use of SetWindowsHookEx
            PID:2800

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                Cable[1].htm
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8YQES76Z\Cable[1].htm
                • Size 31KB
                • SHA256 84a594b9987374a6816740a465dc75885fe1380753ee870089bdf595405289b7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                VBCABLE_Driver_Pack45[1].zip
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\B0TYBN1U\VBCABLE_Driver_Pack45[1].zip
                • Size 1.3MB
                • SHA256 b950e39f01af1d04ea623c8f6d8eb9b6ea5c477c637295fabf20631c85116bfb
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                VBCABLE_ControlPanel.exe
                • Path C:\Users\Admin\AppData\Local\OctopusEAX\vbcable\VBCABLE_ControlPanel.exe
                • Size 908KB
                • SHA256 f5b44706fe7ba2eed0516dee791f826dc7a9891e997f6ce9704e2899300b14ff
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                VBCABLE_Setup_x64.exe
                • Path C:\Users\Admin\AppData\Local\OctopusEAX\vbcable\VBCABLE_Setup_x64.exe
                • Size 915KB
                • SHA256 734c35dfa6d98f48782a451633ceb471166ec70d60482fd89a1123d0ee3c4f41
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pin_in.ico
                • Path C:\Users\Admin\AppData\Local\OctopusEAX\vbcable\pin_in.ico
                • Size 7KB
                • SHA256 934865449455103c1c5997d8220acd160c3891f8a870f8e745b743d12681ac42
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pin_out.ico
                • Path C:\Users\Admin\AppData\Local\OctopusEAX\vbcable\pin_out.ico
                • Size 7KB
                • SHA256 e8728a811e1f1af7d2ba31f77e47d449d5bba091e3e89a0df325ac7a3e67652c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                vbMmeCable64_win10.inf
                • Path C:\Users\Admin\AppData\Local\OctopusEAX\vbcable\vbMmeCable64_win10.inf
                • Size 11KB
                • SHA256 61c857be74831cc299d9be62f8d49d137f14063454fc54f859d5bc9b4b813daf
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                VBFFD5~1.SYS
                • Path \??\c:\users\admin\appdata\local\OCTOPU~1\vbcable\VBFFD5~1.SYS
                • Size 137KB
                • SHA256 f01344602472f1b527de5ee98f18987c03db48fea444e457d061e937f1d531d5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                vbaudio_cable64_win10.cat
                • Path \??\c:\users\admin\appdata\local\octopuseax\vbcable\vbaudio_cable64_win10.cat
                • Size 12KB
                • SHA256 0a921ebadbe39cf3fa7c14ff37d1ca22565a9651244bd3ac177dc810bc99072e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download