2b6455abbf84755be4dcf840ebbfed9c480dced7bd74806bafee05465a5e752d

Analysis

max time kernel
147s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Squidward.exe
Size 535KB
Sample261104-wp5kmayv9j
SHA256 2b6455abbf84755be4dcf840ebbfed9c480dced7bd74806bafee05465a5e752d
MD5 82bf26203c5d76dfa3a591f1cb60d7b5
SHA1 93bf418f64ec701fd0d3232a00a167d04ba9a6d2
SHA512 6a896c274958467e18579affe68a2e0acb68ea633715920d244974765dbf577ce7558cb3dc467a69a656cb82c2f588565f71c4413b5dedc1005fba35303ed2f3
SSDEEP 6144:yrjS60VNKrDqa3pPvX0RQ/FwiSs8k//M4zVRslxX4ci0MAM0bCrvVFs47Xeeeeen:4jST2/l3Z8O7Ss8k//XzVRUX4fnr9
TLSH
T136C4CF61A103D6E2E38D4BB46152D478152E1FE6679A160DEFC13F8B7DF12A128239CF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery execution persistence spyware

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4136	MasonMBR-SLEEP.exe
4452	MasonRootkit.exe
4608	MasonGDI.exe
5488	MasonGDI.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\MasonMBR	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5988	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MasonGDI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MasonGDI.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1460	timeout.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\e4bfbfdf_0	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\e4bfbfdf_0\ = "{2}.\\\\?\\hdaudio#func_01&ven_8086&dev_0022&subsys_80860022&rev_1001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\\elineouttopo/00010001\|\\Device\\HarddiskVolume2\\Users\\Admin\\AppData\\Local\\Temp\\MasonGDI.exe%b{00000000-0000-0000-0000-000000000000}"	svchost.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={C98D5C3B-5DBC-4580-8327-91D8507AE867}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,940 10,941 10,942 10,943 10,940 15,1329 15,940 6,944 50,944 10,941 15,942 15,940 50,943 15,944 6,944 15,943 6,1329 50,1329 100,1329 6,941 6,942 6,944 100,940 100"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1793815633"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Mon, 02 Nov 2026 13:55:32 GMT"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "17110992,504928405,41816131,507286179,7202265,17110988,7153487,504928410,577889346,5804129,17962391,508368333,17962392,41484365,24262478,9179409,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262477,25036127,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079,7202269"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\NotificationData	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3308	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe
4452	MasonRootkit.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4392	explorer.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeDebugPrivilege	4452	MasonRootkit.exe
Token: SeShutdownPrivilege	4392	explorer.exe
Token: SeCreatePagefilePrivilege	4392	explorer.exe
Token: SeShutdownPrivilege	4392	explorer.exe
Token: SeCreatePagefilePrivilege	4392	explorer.exe
Token: SeShutdownPrivilege	4392	explorer.exe
Token: SeCreatePagefilePrivilege	4392	explorer.exe
Token: 33	4988	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4988	AUDIODG.EXE
Token: SeShutdownPrivilege	4392	explorer.exe
Token: SeCreatePagefilePrivilege	4392	explorer.exe
Token: SeShutdownPrivilege	4392	explorer.exe
Token: SeCreatePagefilePrivilege	4392	explorer.exe
Token: SeShutdownPrivilege	4392	explorer.exe
Token: SeCreatePagefilePrivilege	4392	explorer.exe
Token: SeShutdownPrivilege	4392	explorer.exe
Token: SeCreatePagefilePrivilege	4392	explorer.exe
Token: SeShutdownPrivilege	4392	explorer.exe
Token: SeCreatePagefilePrivilege	4392	explorer.exe
Token: SeShutdownPrivilege	4392	explorer.exe
Token: SeCreatePagefilePrivilege	4392	explorer.exe
Token: SeShutdownPrivilege	4392	explorer.exe
Token: SeCreatePagefilePrivilege	4392	explorer.exe
Token: SeShutdownPrivilege	4392	explorer.exe
Token: SeCreatePagefilePrivilege	4392	explorer.exe
Token: SeShutdownPrivilege	4392	explorer.exe
Token: SeCreatePagefilePrivilege	4392	explorer.exe
Token: SeShutdownPrivilege	4392	explorer.exe
Token: SeCreatePagefilePrivilege	4392	explorer.exe
Token: SeShutdownPrivilege	4392	explorer.exe
Token: SeCreatePagefilePrivilege	4392	explorer.exe
Token: SeShutdownPrivilege	4392	explorer.exe
Token: SeCreatePagefilePrivilege	4392	explorer.exe
Token: SeShutdownPrivilege	4392	explorer.exe
Token: SeCreatePagefilePrivilege	4392	explorer.exe
Token: SeShutdownPrivilege	4392	explorer.exe
Token: SeCreatePagefilePrivilege	4392	explorer.exe
Token: SeShutdownPrivilege	4392	explorer.exe
Token: SeCreatePagefilePrivilege	4392	explorer.exe
Token: SeShutdownPrivilege	4392	explorer.exe
Token: SeCreatePagefilePrivilege	4392	explorer.exe
Token: SeShutdownPrivilege	4392	explorer.exe
Token: SeCreatePagefilePrivilege	4392	explorer.exe
Token: SeShutdownPrivilege	4392	explorer.exe
Token: SeCreatePagefilePrivilege	4392	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2752	Conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5220 wrote to memory of 4136	5220	Squidward.exe	89
PID 5220 wrote to memory of 4452	5220	Squidward.exe	90
PID 4452 wrote to memory of 744	4452	MasonRootkit.exe	5
PID 4452 wrote to memory of 964	4452	MasonRootkit.exe	9
PID 4452 wrote to memory of 972	4452	MasonRootkit.exe	10
PID 4452 wrote to memory of 520	4452	MasonRootkit.exe	11
PID 4452 wrote to memory of 872	4452	MasonRootkit.exe	13
PID 4452 wrote to memory of 1100	4452	MasonRootkit.exe	14
PID 4452 wrote to memory of 1160	4452	MasonRootkit.exe	15
PID 4452 wrote to memory of 1208	4452	MasonRootkit.exe	16
PID 4452 wrote to memory of 1240	4452	MasonRootkit.exe	17
PID 4452 wrote to memory of 1312	4452	MasonRootkit.exe	18
PID 4452 wrote to memory of 1348	4452	MasonRootkit.exe	19
PID 4452 wrote to memory of 1496	4452	MasonRootkit.exe	22
PID 4452 wrote to memory of 1604	4452	MasonRootkit.exe	23
PID 4452 wrote to memory of 1656	4452	MasonRootkit.exe	24
PID 4452 wrote to memory of 1684	4452	MasonRootkit.exe	25
PID 4452 wrote to memory of 1716	4452	MasonRootkit.exe	26
PID 4452 wrote to memory of 1836	4452	MasonRootkit.exe	27
PID 4452 wrote to memory of 1900	4452	MasonRootkit.exe	28
PID 4452 wrote to memory of 1984	4452	MasonRootkit.exe	29
PID 4452 wrote to memory of 1992	4452	MasonRootkit.exe	30
PID 4452 wrote to memory of 2004	4452	MasonRootkit.exe	31
PID 4452 wrote to memory of 2108	4452	MasonRootkit.exe	32
PID 4452 wrote to memory of 2196	4452	MasonRootkit.exe	33
PID 4452 wrote to memory of 2272	4452	MasonRootkit.exe	34
PID 4452 wrote to memory of 2348	4452	MasonRootkit.exe	35
PID 4452 wrote to memory of 2528	4452	MasonRootkit.exe	36
PID 4452 wrote to memory of 2536	4452	MasonRootkit.exe	37
PID 4452 wrote to memory of 2612	4452	MasonRootkit.exe	38
PID 4452 wrote to memory of 2692	4452	MasonRootkit.exe	39
PID 4452 wrote to memory of 2708	4452	MasonRootkit.exe	40
PID 4452 wrote to memory of 2728	4452	MasonRootkit.exe	41
PID 4452 wrote to memory of 2864	4452	MasonRootkit.exe	42
PID 4452 wrote to memory of 2928	4452	MasonRootkit.exe	43
PID 4452 wrote to memory of 3060	4452	MasonRootkit.exe	44
PID 4452 wrote to memory of 2460	4452	MasonRootkit.exe	46
PID 4452 wrote to memory of 3124	4452	MasonRootkit.exe	47
PID 4452 wrote to memory of 3172	4452	MasonRootkit.exe	48
PID 4452 wrote to memory of 3440	4452	MasonRootkit.exe	50
PID 4452 wrote to memory of 3476	4452	MasonRootkit.exe	51
PID 4452 wrote to memory of 3492	4452	MasonRootkit.exe	52
PID 4452 wrote to memory of 3512	4452	MasonRootkit.exe	53
PID 4452 wrote to memory of 3560	4452	MasonRootkit.exe	54
PID 4452 wrote to memory of 3568	4452	MasonRootkit.exe	55
PID 4452 wrote to memory of 3580	4452	MasonRootkit.exe	56
PID 4452 wrote to memory of 3300	4452	MasonRootkit.exe	57
PID 4452 wrote to memory of 1260	4452	MasonRootkit.exe	58
PID 4452 wrote to memory of 4328	4452	MasonRootkit.exe	59
PID 4452 wrote to memory of 4412	4452	MasonRootkit.exe	60
PID 4452 wrote to memory of 4428	4452	MasonRootkit.exe	61
PID 4452 wrote to memory of 4680	4452	MasonRootkit.exe	62
PID 4452 wrote to memory of 4688	4452	MasonRootkit.exe	63
PID 4452 wrote to memory of 5080	4452	MasonRootkit.exe	64
PID 4452 wrote to memory of 2444	4452	MasonRootkit.exe	65
PID 4452 wrote to memory of 5160	4452	MasonRootkit.exe	66
PID 4452 wrote to memory of 5428	4452	MasonRootkit.exe	69
PID 4452 wrote to memory of 704	4452	MasonRootkit.exe	72
PID 4452 wrote to memory of 1364	4452	MasonRootkit.exe	73
PID 4452 wrote to memory of 2340	4452	MasonRootkit.exe	74
PID 4452 wrote to memory of 2328	4452	MasonRootkit.exe	77
PID 4452 wrote to memory of 2420	4452	MasonRootkit.exe	78
PID 4452 wrote to memory of 5400	4452	MasonRootkit.exe	79
PID 4452 wrote to memory of 5996	4452	MasonRootkit.exe	80

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:744
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:972
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1160

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:964

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-607c8970-8cc6-447d-8c7c-04adbad26a46 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-f248d60c-8e3a-40b0-aa4e-7b5e3e746a9f -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-e01d544a-5e9e-4b49-a132-30986d7d2b6f -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-f19893f2-f18b-476b-9337-1035e1f79f28 -LifetimeId:de3a3c96-e80a-4763-8621-d729343f0cac -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Drops file in System32 directory
PID:1100

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1240

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1604

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc
1⤵
PID:1716

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1992
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:5996
- - C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    3⤵
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:4392
  - - C:\Users\Admin\AppData\Local\Temp\Squidward.exe
      "C:\Users\Admin\AppData\Local\Temp\Squidward.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\MasonMBR-SLEEP.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonMBR-SLEEP.exe"
        5⤵
        Executes dropped EXE
        
        PID:4136
      - C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4608
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3308
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:1456
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB106.tmp.bat""
        5⤵
        Executes a command shell one-liner
        
        PID:5988
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4520
      - C:\Windows\system32\timeout.exe
        
        timeout 3
        6⤵
        Delays execution with timeout.exe
        
        PID:1460

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:2004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:2196

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2528

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
- Modifies Internet Explorer settings
PID:2536
- C:\Windows\system32\AUDIODG.EXE
  C:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004FC
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4988

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
PID:2612
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:0000000000000268;000000000000026C;
  2⤵
  PID:5080

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2692

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc
1⤵
PID:2708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc
1⤵
PID:2728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2864

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2928

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:3060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2460

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:3124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:3172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:3476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:3492

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:3560

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:1260

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4328

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4428

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4688

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:2444

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
PID:5160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc
1⤵
PID:5428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:1364

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2340

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2328

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:5400

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:1556

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of SetWindowsHookEx
PID:2752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MasonGDI.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe
Size 61KB
SHA256 57eff2792a929b479b3e3bb9a25bbe750034dcba4213e2abb8865ff2268b53f6
MD5 2f9823efd49a6f8fc32ba52d75e620a4
SHA1 39f79bc2bba2f33f2e82da2dee4c8cf3be052b7e
SHA512 2f68ddb1d7d070f7d8675791f8ccc3b9d73236834f1bc787afdf1074d4d17601f77e53a98024a12e29119c5c38333cd7f6200a186e2ba96fc4186c86ca2cb6ad
SSDEEP 1536:PTynnng4PEIGZ5eqIXzgmYi/ZuPiDNG9j3+aOPw1WX6CjV9nu:9OFGfeZgmJ8POoOu1WX6CjS
TLSH
T13653F186E3B8C421D0F71333AD67E99413F5EAD69D56CA1F0A80935B6ED23464F21E1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MasonMBR-SLEEP.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonMBR-SLEEP.exe
Size 65KB
SHA256 de93250a0f249700407cd893e1b4d6b167c5e909b4b8f09cbefbbae473f4ad93
MD5 f006d2343d121bd2043925e87063fde7
SHA1 402799473ca52edb826a37e0042456032db121f3
SHA512 707c803508308fa0d002aa31187476cf1b000118f9b0d89982ab60a674de09f028ae860c3dbdad9fa902ee4e9d0771f8fa79e356bb2ae8bf4f2c57d61f3e68e0
SSDEEP 1536:ToHs+RMT9qQPhcm7V0vppY62kxt+nl5Hr1lo/u:MHssMT9qQPSmyvB2cKl5L3P
TLSH
T1FC63F1129FE8026AC35F47B25DE573910F2ADE44DE06775F809182A18F49AC88773B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MasonRootkit.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp8087.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp8087.tmp
Size 873KB
SHA256 6a1e08d3a6759f42ea2480450bdf1f369bf50236ba1dc94cfddbf02b5dd7ecaa
MD5 7bfe4475c45768860615d6cdc19dc622
SHA1 d937f02f743833748dbc391211602c28f0eaca8f
SHA512 64bb4d4ebc82a7509ded16677592dacb862bfbdbb9c06a871f7d051aa7a5c67c5a5358ddd3f44ca7922fd3f406a784c768737dddafc49075f496452b96597681
SSDEEP 1536:qnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnns:D
TLSH
T175150FF06479EE53F39685397920FD2846D03499AAF3493A707DF9C8A373B60285C61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MasonMBR

Path C:\Windows\System32\Tasks\MasonMBR
Size 3KB
SHA256 a065110405c5d70547ac261abfb55d56c2183b8a7f76aebcb0625a52fbf333b4
MD5 677d81c09d0afccecf07caa4bf240105
SHA1 bcec641bdfe0b9a7b015f500e595720df5633afe
SHA512 d51ad8a6631372f8b1bb371697e67281f08e2767c837ee69dbc454c02dc166e8c4d502efd8c7db865aa0298388d707e223959e8d2af2cf75f0d081440f74d668
TLSH
T11D61695367EE1109F2F76B2CAEB754218E67BD515938C46D00AC240DCBF3E2285607B7
MD5 SHA1 SHA512 TLSH

Submit Download

memory/520-56-0x00007FF85BFA0000-0x00007FF85BFB0000-memory.dmp

Download

memory/520-49-0x000002BB61B00000-0x000002BB61B2B000-memory.dmp

Download

memory/744-35-0x00007FF85BFA0000-0x00007FF85BFB0000-memory.dmp

Download

memory/744-298-0x000001BC41830000-0x000001BC4185B000-memory.dmp

Download

memory/744-33-0x000001BC41800000-0x000001BC41825000-memory.dmp

Download

memory/744-34-0x000001BC41830000-0x000001BC4185B000-memory.dmp

Download

memory/872-50-0x0000023EC0FB0000-0x0000023EC0FDB000-memory.dmp

Download

memory/872-51-0x00007FF85BFA0000-0x00007FF85BFB0000-memory.dmp

Download

memory/964-128-0x00007FF85BFA0000-0x00007FF85BFB0000-memory.dmp

Download

memory/964-127-0x000001FCB8000000-0x000001FCB802B000-memory.dmp

Download

memory/972-46-0x00000254DA670000-0x00000254DA69B000-memory.dmp

Download

memory/972-47-0x00007FF85BFA0000-0x00007FF85BFB0000-memory.dmp

Download

memory/1100-54-0x00007FF85BFA0000-0x00007FF85BFB0000-memory.dmp

Download

memory/1100-53-0x000002E17ED40000-0x000002E17ED6B000-memory.dmp

Download

memory/1160-43-0x0000015B82560000-0x0000015B8258B000-memory.dmp

Download

memory/1160-44-0x00007FF85BFA0000-0x00007FF85BFB0000-memory.dmp

Download

memory/1208-130-0x000001AE55490000-0x000001AE554BB000-memory.dmp

Download

memory/1208-131-0x00007FF85BFA0000-0x00007FF85BFB0000-memory.dmp

Download

memory/1240-133-0x0000023077EC0000-0x0000023077EEB000-memory.dmp

Download

memory/1240-134-0x00007FF85BFA0000-0x00007FF85BFB0000-memory.dmp

Download

memory/1312-137-0x00007FF85BFA0000-0x00007FF85BFB0000-memory.dmp

Download

memory/1312-136-0x000002329BD70000-0x000002329BD9B000-memory.dmp

Download

memory/1348-139-0x000002BC32500000-0x000002BC3252B000-memory.dmp

Download

memory/1348-140-0x00007FF85BFA0000-0x00007FF85BFB0000-memory.dmp

Download

memory/1496-63-0x00000133CC390000-0x00000133CC3BB000-memory.dmp

Download

memory/1496-64-0x00007FF85BFA0000-0x00007FF85BFB0000-memory.dmp

Download

memory/1604-143-0x00007FF85BFA0000-0x00007FF85BFB0000-memory.dmp

Download

memory/1604-142-0x0000024524000000-0x000002452402B000-memory.dmp

Download

memory/1656-145-0x000001E2E6860000-0x000001E2E688B000-memory.dmp

Download

memory/1656-146-0x00007FF85BFA0000-0x00007FF85BFB0000-memory.dmp

Download

memory/1684-148-0x00000143FC700000-0x00000143FC72B000-memory.dmp

Download

memory/1684-149-0x00007FF85BFA0000-0x00007FF85BFB0000-memory.dmp

Download

memory/1716-151-0x0000015C03460000-0x0000015C0348B000-memory.dmp

Download

memory/1716-152-0x00007FF85BFA0000-0x00007FF85BFB0000-memory.dmp

Download

memory/1836-155-0x00007FF85BFA0000-0x00007FF85BFB0000-memory.dmp

Download

memory/1836-154-0x0000022D41520000-0x0000022D4154B000-memory.dmp

Download

memory/1900-157-0x0000027F30120000-0x0000027F3014B000-memory.dmp

Download

memory/1900-159-0x00007FF85BFA0000-0x00007FF85BFB0000-memory.dmp

Download

memory/1984-161-0x00007FF85BFA0000-0x00007FF85BFB0000-memory.dmp

Download

memory/1984-158-0x00000206B1490000-0x00000206B14BB000-memory.dmp

Download

memory/1992-163-0x0000023384340000-0x000002338436B000-memory.dmp

Download

memory/1992-164-0x00007FF85BFA0000-0x00007FF85BFB0000-memory.dmp

Download

memory/2004-166-0x0000018778FB0000-0x0000018778FDB000-memory.dmp

Download

memory/2108-167-0x0000016AC55E0000-0x0000016AC560B000-memory.dmp

Download

memory/2196-169-0x000002602F440000-0x000002602F46B000-memory.dmp

Download

memory/2196-170-0x00007FF85BFA0000-0x00007FF85BFB0000-memory.dmp

Download

memory/2272-173-0x00007FF85BFA0000-0x00007FF85BFB0000-memory.dmp

Download

memory/2272-172-0x000001E235F40000-0x000001E235F6B000-memory.dmp

Download

memory/2348-175-0x000001ECD5030000-0x000001ECD505B000-memory.dmp

Download

memory/2528-177-0x000001933BA30000-0x000001933BA5B000-memory.dmp

Download

memory/2536-178-0x000001FBE5CE0000-0x000001FBE5D0B000-memory.dmp

Download

memory/2536-179-0x00007FF85BFA0000-0x00007FF85BFB0000-memory.dmp

Download

memory/2708-182-0x00007FF85BFA0000-0x00007FF85BFB0000-memory.dmp

Download

memory/2708-181-0x0000016C49110000-0x0000016C4913B000-memory.dmp

Download

memory/2728-184-0x000001D0BF920000-0x000001D0BF94B000-memory.dmp

Download

memory/2728-185-0x00007FF85BFA0000-0x00007FF85BFB0000-memory.dmp

Download

memory/2864-187-0x0000023248090000-0x00000232480BB000-memory.dmp

Download

memory/2864-188-0x00007FF85BFA0000-0x00007FF85BFB0000-memory.dmp

Download

memory/2928-191-0x00007FF85BFA0000-0x00007FF85BFB0000-memory.dmp

Download

memory/4136-21-0x00007FF8791C0000-0x00007FF879B64000-memory.dmp

Download

memory/4136-367-0x00007FF8791C0000-0x00007FF879B64000-memory.dmp

Download

memory/4136-359-0x00007FF8791C0000-0x00007FF879B64000-memory.dmp

Download

memory/4136-20-0x0000000000FE0000-0x0000000000FF6000-memory.dmp

Download

memory/4392-124-0x00007FF85BFA0000-0x00007FF85BFB0000-memory.dmp

Download

memory/4392-123-0x00000000007A0000-0x00000000007CB000-memory.dmp

Download

memory/4452-32-0x00007FF89B2B0000-0x00007FF89B377000-memory.dmp

Download

memory/4452-31-0x00007FF89BE60000-0x00007FF89C0C3000-memory.dmp

Download

memory/4608-322-0x0000000005A30000-0x0000000005AC2000-memory.dmp

Download

memory/4608-320-0x0000000000C70000-0x0000000000C86000-memory.dmp

Download

memory/5080-106-0x000001BC36310000-0x000001BC3633B000-memory.dmp

Download

memory/5080-107-0x00007FF85BFA0000-0x00007FF85BFB0000-memory.dmp

Download

memory/5220-4-0x00007FF8791C0000-0x00007FF879B64000-memory.dmp

Download

memory/5220-3-0x00007FF8791C0000-0x00007FF879B64000-memory.dmp

Download

memory/5220-2-0x0000000002EA0000-0x0000000002EE2000-memory.dmp

Download

memory/5220-351-0x00007FF8791C0000-0x00007FF879B64000-memory.dmp

Download

memory/5220-0-0x00007FF87934F000-0x00007FF879350000-memory.dmp

Download

memory/5220-1-0x0000000000CF0000-0x0000000000D7C000-memory.dmp

Download