Analysis
- max time kernel
2s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
- submitted
24/10/2026, 15:26
Errors
General
- Target AngryVirus.exe
- Size 482KB
- Sample261024-svkwmacv3k
- SHA256 b6dac480e4c7f15e8de6633ee9b52b3bda0b6b2f1897a76ddb4ab0ffb76b2588
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\AngryVirus.exe"C:\Users\Admin\AppData\Local\Temp\AngryVirus.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe" /RL HIGHEST2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\MasonMBR-S.exe"C:\Users\Admin\AppData\Local\Temp\MasonMBR-S.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"2⤵
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004C0 0x00000000000004341⤵
-
C:\Users\Admin\AppData\Local\Temp\MasonMBR.exeC:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
MasonGDI.exe
MasonMBR-S.exe
MasonMBR.exe
MasonRootkit.exe
memory/392-67-0x00007FFAEF2D0000-0x00007FFAEF2E0000-memory.dmp
memory/392-66-0x000001D2F7780000-0x000001D2F77AB000-memory.dmp
memory/436-60-0x0000025B826E0000-0x0000025B8270B000-memory.dmp
memory/436-61-0x00007FFAEF2D0000-0x00007FFAEF2E0000-memory.dmp
memory/632-49-0x0000021BAD4C0000-0x0000021BAD4E5000-memory.dmp
memory/632-50-0x0000021BAD4F0000-0x0000021BAD51B000-memory.dmp
memory/632-51-0x00007FFAEF2D0000-0x00007FFAEF2E0000-memory.dmp
memory/656-0-0x0000000000300000-0x000000000037E000-memory.dmp
memory/656-2-0x000000001AD60000-0x000000001ADB6000-memory.dmp
memory/656-1-0x000000001B0B0000-0x000000001B0C0000-memory.dmp
memory/684-55-0x00007FFAEF2D0000-0x00007FFAEF2E0000-memory.dmp
memory/684-54-0x00000242FD9B0000-0x00000242FD9DB000-memory.dmp
memory/712-39-0x00007FFB2F240000-0x00007FFB2F449000-memory.dmp
memory/712-40-0x00007FFB2D6B0000-0x00007FFB2D76D000-memory.dmp
memory/904-64-0x00007FFAEF2D0000-0x00007FFAEF2E0000-memory.dmp
memory/904-63-0x00000246375F0000-0x000002463761B000-memory.dmp
memory/1032-156-0x00007FFAEF2D0000-0x00007FFAEF2E0000-memory.dmp
memory/1032-155-0x000002158F0C0000-0x000002158F0EB000-memory.dmp
memory/1040-70-0x000001DDFCDB0000-0x000001DDFCDDB000-memory.dmp
memory/1040-71-0x00007FFAEF2D0000-0x00007FFAEF2E0000-memory.dmp
memory/1100-81-0x00007FFAEF2D0000-0x00007FFAEF2E0000-memory.dmp
memory/1100-80-0x0000016631660000-0x000001663168B000-memory.dmp
memory/1192-83-0x000001DF5D660000-0x000001DF5D68B000-memory.dmp
memory/1192-84-0x00007FFAEF2D0000-0x00007FFAEF2E0000-memory.dmp
memory/1204-87-0x00007FFAEF2D0000-0x00007FFAEF2E0000-memory.dmp
memory/1204-86-0x000001DAA2DD0000-0x000001DAA2DFB000-memory.dmp
memory/1252-90-0x00007FFAEF2D0000-0x00007FFAEF2E0000-memory.dmp
memory/1252-89-0x0000028E70330000-0x0000028E7035B000-memory.dmp
memory/1272-93-0x00007FFAEF2D0000-0x00007FFAEF2E0000-memory.dmp
memory/1272-92-0x000002387B190000-0x000002387B1BB000-memory.dmp
memory/1292-95-0x000001EF634B0000-0x000001EF634DB000-memory.dmp
memory/1292-96-0x00007FFAEF2D0000-0x00007FFAEF2E0000-memory.dmp
memory/1312-99-0x00007FFAEF2D0000-0x00007FFAEF2E0000-memory.dmp
memory/1312-98-0x000001B0EFF70000-0x000001B0EFF9B000-memory.dmp
memory/1364-125-0x0000024FE3FB0000-0x0000024FE3FDB000-memory.dmp
memory/1364-126-0x00007FFAEF2D0000-0x00007FFAEF2E0000-memory.dmp
memory/1396-161-0x000001C04EF50000-0x000001C04EF7B000-memory.dmp
memory/1396-162-0x00007FFAEF2D0000-0x00007FFAEF2E0000-memory.dmp
memory/1408-128-0x00000199DF8F0000-0x00000199DF91B000-memory.dmp
memory/1408-129-0x00007FFAEF2D0000-0x00007FFAEF2E0000-memory.dmp
memory/1508-132-0x00007FFAEF2D0000-0x00007FFAEF2E0000-memory.dmp
memory/1508-131-0x000001F856E60000-0x000001F856E8B000-memory.dmp
memory/1740-135-0x00007FFAEF2D0000-0x00007FFAEF2E0000-memory.dmp
memory/1740-134-0x00000187C0D30000-0x00000187C0D5B000-memory.dmp
memory/1764-137-0x000001D588590000-0x000001D5885BB000-memory.dmp
memory/1764-138-0x00007FFAEF2D0000-0x00007FFAEF2E0000-memory.dmp
memory/1780-141-0x00007FFAEF2D0000-0x00007FFAEF2E0000-memory.dmp
memory/1780-140-0x000002107AB80000-0x000002107ABAB000-memory.dmp
memory/1792-143-0x00000157A15B0000-0x00000157A15DB000-memory.dmp
memory/1792-144-0x00007FFAEF2D0000-0x00007FFAEF2E0000-memory.dmp
memory/1888-146-0x0000019EFE6C0000-0x0000019EFE6EB000-memory.dmp
memory/1888-147-0x00007FFAEF2D0000-0x00007FFAEF2E0000-memory.dmp
memory/1940-158-0x0000029442860000-0x000002944288B000-memory.dmp
memory/1940-159-0x00007FFAEF2D0000-0x00007FFAEF2E0000-memory.dmp
memory/1948-150-0x00007FFAEF2D0000-0x00007FFAEF2E0000-memory.dmp
memory/1948-149-0x0000025F93190000-0x0000025F931BB000-memory.dmp
memory/1976-152-0x000002319B1A0000-0x000002319B1CB000-memory.dmp
memory/1976-153-0x00007FFAEF2D0000-0x00007FFAEF2E0000-memory.dmp
memory/2172-164-0x000002B0529C0000-0x000002B0529EB000-memory.dmp
memory/2172-165-0x00007FFAEF2D0000-0x00007FFAEF2E0000-memory.dmp
memory/2212-167-0x00000198E3F40000-0x00000198E3F6B000-memory.dmp
memory/2212-169-0x00007FFAEF2D0000-0x00007FFAEF2E0000-memory.dmp
memory/2260-41-0x0000000000580000-0x0000000000594000-memory.dmp
memory/2296-168-0x0000000000FF0000-0x000000000101B000-memory.dmp
memory/2296-170-0x00007FFAEF2D0000-0x00007FFAEF2E0000-memory.dmp
memory/2416-173-0x0000024828390000-0x00000248283BB000-memory.dmp
memory/2416-174-0x00007FFAEF2D0000-0x00007FFAEF2E0000-memory.dmp
memory/2528-176-0x000001C28A290000-0x000001C28A2BB000-memory.dmp
memory/3480-43-0x00000000073D0000-0x0000000007462000-memory.dmp
memory/3480-42-0x0000000000F90000-0x0000000000FBA000-memory.dmp