Analysis
- user interaction
yes - max time kernel
2s - max time network
4s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/10/2026, 14:04
Errors
General
- Target AngryVirus.exe
- Size 482KB
- Sample261024-rdknvsfa97
- SHA256 b6dac480e4c7f15e8de6633ee9b52b3bda0b6b2f1897a76ddb4ab0ffb76b2588
Malware Config
Signatures
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\AngryVirus.exe"C:\Users\Admin\AppData\Local\Temp\AngryVirus.exe"1⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe" /RL HIGHEST2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\MasonMBR-S.exe"C:\Users\Admin\AppData\Local\Temp\MasonMBR-S.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"2⤵
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004CC1⤵
-
C:\Users\Admin\AppData\Local\Temp\MasonMBR.exeC:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
MasonGDI.exe
MasonMBR-S.exe
MasonMBR.exe
MasonRootkit.exe
memory/472-64-0x000001CC433A0000-0x000001CC433CB000-memory.dmp
memory/472-144-0x00007FF815820000-0x00007FF815830000-memory.dmp
memory/544-61-0x000001DF4C960000-0x000001DF4C98B000-memory.dmp
memory/544-62-0x00007FF815820000-0x00007FF815830000-memory.dmp
memory/740-47-0x000002459C940000-0x000002459C96B000-memory.dmp
memory/740-48-0x00007FF815820000-0x00007FF815830000-memory.dmp
memory/740-46-0x000002459C910000-0x000002459C935000-memory.dmp
memory/956-56-0x00007FF815820000-0x00007FF815830000-memory.dmp
memory/956-55-0x0000021F4ABD0000-0x0000021F4ABFB000-memory.dmp
memory/964-59-0x00007FF815820000-0x00007FF815830000-memory.dmp
memory/964-58-0x00000206C3F50000-0x00000206C3F7B000-memory.dmp
memory/1104-67-0x00007FF815820000-0x00007FF815830000-memory.dmp
memory/1104-66-0x000001D677550000-0x000001D67757B000-memory.dmp
memory/1164-69-0x000001A95B600000-0x000001A95B62B000-memory.dmp
memory/1164-70-0x00007FF815820000-0x00007FF815830000-memory.dmp
memory/1200-146-0x0000017EB8C40000-0x0000017EB8C6B000-memory.dmp
memory/1200-148-0x00007FF815820000-0x00007FF815830000-memory.dmp
memory/1240-147-0x0000023FA86A0000-0x0000023FA86CB000-memory.dmp
memory/1240-150-0x00007FF815820000-0x00007FF815830000-memory.dmp
memory/1328-153-0x00007FF815820000-0x00007FF815830000-memory.dmp
memory/1328-152-0x00000268FCE40000-0x00000268FCE6B000-memory.dmp
memory/1400-76-0x000002362B190000-0x000002362B1BB000-memory.dmp
memory/1400-77-0x00007FF815820000-0x00007FF815830000-memory.dmp
memory/1508-173-0x0000026771680000-0x00000267716AB000-memory.dmp
memory/1508-174-0x00007FF815820000-0x00007FF815830000-memory.dmp
memory/1520-155-0x0000025419590000-0x00000254195BB000-memory.dmp
memory/1520-156-0x00007FF815820000-0x00007FF815830000-memory.dmp
memory/1556-159-0x00007FF815820000-0x00007FF815830000-memory.dmp
memory/1556-158-0x0000029DB7FA0000-0x0000029DB7FCB000-memory.dmp
memory/1604-162-0x00007FF815820000-0x00007FF815830000-memory.dmp
memory/1604-161-0x0000017E10820000-0x0000017E1084B000-memory.dmp
memory/1664-177-0x00007FF815820000-0x00007FF815830000-memory.dmp
memory/1664-176-0x000002164EFC0000-0x000002164EFEB000-memory.dmp
memory/1680-164-0x000001ECBC5D0000-0x000001ECBC5FB000-memory.dmp
memory/1680-165-0x00007FF815820000-0x00007FF815830000-memory.dmp
memory/1692-168-0x00007FF815820000-0x00007FF815830000-memory.dmp
memory/1692-167-0x00000214743C0000-0x00000214743EB000-memory.dmp
memory/1908-140-0x000001D817520000-0x000001D81754B000-memory.dmp
memory/1908-141-0x00007FF815820000-0x00007FF815830000-memory.dmp
memory/1952-171-0x00007FF815820000-0x00007FF815830000-memory.dmp
memory/1952-170-0x000001DE55470000-0x000001DE5549B000-memory.dmp
memory/2076-136-0x00007FF815820000-0x00007FF815830000-memory.dmp
memory/2076-135-0x0000000003350000-0x000000000337B000-memory.dmp
memory/2120-179-0x000002CC44A10000-0x000002CC44A3B000-memory.dmp
memory/2120-180-0x00007FF815820000-0x00007FF815830000-memory.dmp
memory/2128-182-0x000001FB11FD0000-0x000001FB11FFB000-memory.dmp
memory/2128-183-0x00007FF815820000-0x00007FF815830000-memory.dmp
memory/2160-185-0x0000015A37F00000-0x0000015A37F2B000-memory.dmp
memory/2160-186-0x00007FF815820000-0x00007FF815830000-memory.dmp
memory/2368-188-0x000002AB29A60000-0x000002AB29A8B000-memory.dmp
memory/2368-189-0x00007FF815820000-0x00007FF815830000-memory.dmp
memory/2432-191-0x0000027CD09D0000-0x0000027CD09FB000-memory.dmp
memory/2432-192-0x00007FF815820000-0x00007FF815830000-memory.dmp
memory/2488-195-0x00007FF815820000-0x00007FF815830000-memory.dmp
memory/2488-194-0x0000026E8F370000-0x0000026E8F39B000-memory.dmp
memory/2584-197-0x000001ECEDBF0000-0x000001ECEDC1B000-memory.dmp
memory/2584-198-0x00007FF815820000-0x00007FF815830000-memory.dmp
memory/2620-200-0x0000012E0A5C0000-0x0000012E0A5EB000-memory.dmp
memory/2620-201-0x00007FF815820000-0x00007FF815830000-memory.dmp
memory/2680-203-0x000002AC859B0000-0x000002AC859DB000-memory.dmp
memory/4288-4-0x00007FF8328D0000-0x00007FF833274000-memory.dmp
memory/4288-0-0x00007FF832A5F000-0x00007FF832A60000-memory.dmp
memory/4288-1-0x00000000001F0000-0x000000000026E000-memory.dmp
memory/4288-39-0x00007FF8328D0000-0x00007FF833274000-memory.dmp
memory/4288-2-0x0000000002520000-0x0000000002576000-memory.dmp
memory/4288-3-0x00007FF8328D0000-0x00007FF833274000-memory.dmp
memory/4748-31-0x00007FF8328D0000-0x00007FF833274000-memory.dmp
memory/4748-22-0x0000000000200000-0x0000000000214000-memory.dmp
memory/4964-120-0x00007FF815820000-0x00007FF815830000-memory.dmp
memory/4964-119-0x00000178EE7D0000-0x00000178EE7FB000-memory.dmp
memory/5684-40-0x0000000006B40000-0x0000000006BD2000-memory.dmp
memory/5684-38-0x0000000000E50000-0x0000000000E7A000-memory.dmp
memory/5800-36-0x00007FF8556E0000-0x00007FF855943000-memory.dmp
memory/5800-37-0x00007FF854790000-0x00007FF854857000-memory.dmp