Analysis
- max time kernel
2s - max time network
10s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/10/2026, 15:26
General
- Target AngryVirus.exe
- Size 482KB
- Sample261024-svkwmacv3k
- SHA256 b6dac480e4c7f15e8de6633ee9b52b3bda0b6b2f1897a76ddb4ab0ffb76b2588
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\AngryVirus.exe"C:\Users\Admin\AppData\Local\Temp\AngryVirus.exe"1⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe" /RL HIGHEST2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\MasonMBR-S.exe"C:\Users\Admin\AppData\Local\Temp\MasonMBR-S.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"2⤵
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004D81⤵
-
C:\Users\Admin\AppData\Local\Temp\MasonMBR.exeC:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
MasonGDI.exe
MasonMBR-S.exe
MasonMBR.exe
MasonRootkit.exe
memory/744-48-0x000001BA07750000-0x000001BA0777B000-memory.dmp
memory/744-49-0x00007FFE5F720000-0x00007FFE5F730000-memory.dmp
memory/744-47-0x000001BA07720000-0x000001BA07745000-memory.dmp
memory/904-99-0x00007FFE5F720000-0x00007FFE5F730000-memory.dmp
memory/904-98-0x00000272D7B90000-0x00000272D7BBB000-memory.dmp
memory/960-54-0x00007FFE5F720000-0x00007FFE5F730000-memory.dmp
memory/960-53-0x000001DD0AEA0000-0x000001DD0AECB000-memory.dmp
memory/968-56-0x0000025168AB0000-0x0000025168ADB000-memory.dmp
memory/968-57-0x00007FFE5F720000-0x00007FFE5F730000-memory.dmp
memory/1020-85-0x000001F022390000-0x000001F0223BB000-memory.dmp
memory/1020-87-0x00007FFE5F720000-0x00007FFE5F730000-memory.dmp
memory/1100-107-0x00007FFE5F720000-0x00007FFE5F730000-memory.dmp
memory/1100-106-0x0000026AB1DA0000-0x0000026AB1DCB000-memory.dmp
memory/1136-39-0x00007FFE9EBC0000-0x00007FFE9EC87000-memory.dmp
memory/1136-38-0x00007FFE9F5E0000-0x00007FFE9F843000-memory.dmp
memory/1152-63-0x000001C6A0D60000-0x000001C6A0D8B000-memory.dmp
memory/1152-64-0x00007FFE5F720000-0x00007FFE5F730000-memory.dmp
memory/1224-124-0x00007FFE5F720000-0x00007FFE5F730000-memory.dmp
memory/1224-123-0x000001EDAD810000-0x000001EDAD83B000-memory.dmp
memory/1284-151-0x000002D46EEE0000-0x000002D46EF0B000-memory.dmp
memory/1284-152-0x00007FFE5F720000-0x00007FFE5F730000-memory.dmp
memory/1324-154-0x000002A862D80000-0x000002A862DAB000-memory.dmp
memory/1324-155-0x00007FFE5F720000-0x00007FFE5F730000-memory.dmp
memory/1372-158-0x00007FFE5F720000-0x00007FFE5F730000-memory.dmp
memory/1372-157-0x0000025DD5550000-0x0000025DD557B000-memory.dmp
memory/1596-161-0x00007FFE5F720000-0x00007FFE5F730000-memory.dmp
memory/1596-160-0x000001FBA6E80000-0x000001FBA6EAB000-memory.dmp
memory/1644-163-0x0000015A0E7F0000-0x0000015A0E81B000-memory.dmp
memory/1644-164-0x00007FFE5F720000-0x00007FFE5F730000-memory.dmp
memory/1656-167-0x00007FFE5F720000-0x00007FFE5F730000-memory.dmp
memory/1656-166-0x000001DE25E30000-0x000001DE25E5B000-memory.dmp
memory/1672-74-0x000002BF9FF20000-0x000002BF9FF4B000-memory.dmp
memory/1672-75-0x00007FFE5F720000-0x00007FFE5F730000-memory.dmp
memory/1684-169-0x0000018D07680000-0x0000018D076AB000-memory.dmp
memory/1684-170-0x00007FFE5F720000-0x00007FFE5F730000-memory.dmp
memory/1752-148-0x000001D687480000-0x000001D6874AB000-memory.dmp
memory/1752-149-0x00007FFE5F720000-0x00007FFE5F730000-memory.dmp
memory/1844-173-0x00007FFE5F720000-0x00007FFE5F730000-memory.dmp
memory/1844-172-0x0000014C09310000-0x0000014C0933B000-memory.dmp
memory/1904-176-0x00007FFE5F720000-0x00007FFE5F730000-memory.dmp
memory/1904-175-0x0000025625820000-0x000002562584B000-memory.dmp
memory/2036-178-0x000001A342BC0000-0x000001A342BEB000-memory.dmp
memory/2036-179-0x00007FFE5F720000-0x00007FFE5F730000-memory.dmp
memory/2064-182-0x00007FFE5F720000-0x00007FFE5F730000-memory.dmp
memory/2064-181-0x0000022392ED0000-0x0000022392EFB000-memory.dmp
memory/2072-184-0x0000019CE1AB0000-0x0000019CE1ADB000-memory.dmp
memory/2072-185-0x00007FFE5F720000-0x00007FFE5F730000-memory.dmp
memory/2128-187-0x000002218FB00000-0x000002218FB2B000-memory.dmp
memory/2128-188-0x00007FFE5F720000-0x00007FFE5F730000-memory.dmp
memory/2208-190-0x000001929EDA0000-0x000001929EDCB000-memory.dmp
memory/2208-191-0x00007FFE5F720000-0x00007FFE5F730000-memory.dmp
memory/2292-193-0x0000026631800000-0x000002663182B000-memory.dmp
memory/2292-194-0x00007FFE5F720000-0x00007FFE5F730000-memory.dmp
memory/2304-196-0x000001FBA7460000-0x000001FBA748B000-memory.dmp
memory/2304-197-0x00007FFE5F720000-0x00007FFE5F730000-memory.dmp
memory/2496-22-0x00000000002A0000-0x00000000002B4000-memory.dmp
memory/2496-32-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp
memory/2496-33-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp
memory/2500-199-0x0000027196660000-0x000002719668B000-memory.dmp
memory/2500-200-0x00007FFE5F720000-0x00007FFE5F730000-memory.dmp
memory/2596-203-0x00007FFE5F720000-0x00007FFE5F730000-memory.dmp
memory/2596-202-0x00000239BB390000-0x00000239BB3BB000-memory.dmp
memory/2616-205-0x0000019886F10000-0x0000019886F3B000-memory.dmp
memory/2952-143-0x0000000005F30000-0x0000000005F5B000-memory.dmp
memory/2952-144-0x00007FFE5F720000-0x00007FFE5F730000-memory.dmp
memory/3568-44-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp
memory/3568-0-0x00007FFE7C94F000-0x00007FFE7C950000-memory.dmp
memory/3568-4-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp
memory/3568-3-0x0000000001590000-0x00000000015E6000-memory.dmp
memory/3568-2-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp
memory/3568-1-0x0000000000C60000-0x0000000000CDE000-memory.dmp
memory/3836-41-0x00000000066C0000-0x0000000006752000-memory.dmp
memory/3836-34-0x00000000009F0000-0x0000000000A1A000-memory.dmp
memory/4992-128-0x000001AB40400000-0x000001AB4042B000-memory.dmp
memory/4992-129-0x00007FFE5F720000-0x00007FFE5F730000-memory.dmp