Analysis
- user interaction
yes - max time kernel
2s - max time network
5s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
10/11/2026, 22:46
Errors
General
- Target AngryVirus.exe
- Size 482KB
- Sample261110-2px4faca83
- SHA256 b6dac480e4c7f15e8de6633ee9b52b3bda0b6b2f1897a76ddb4ab0ffb76b2588
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\AngryVirus.exe"C:\Users\Admin\AppData\Local\Temp\AngryVirus.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe" /RL HIGHEST2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\MasonMBR-S.exe"C:\Users\Admin\AppData\Local\Temp\MasonMBR-S.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MasonMBR.exeC:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3bc 0x3c41⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
MasonGDI.exe
MasonMBR-S.exe
MasonMBR.exe
MasonRootkit.exe
memory/448-61-0x0000019A698B0000-0x0000019A698DB000-memory.dmp
memory/448-62-0x00007FF8FE390000-0x00007FF8FE3A0000-memory.dmp
memory/612-52-0x0000015E20430000-0x0000015E2045B000-memory.dmp
memory/612-50-0x0000015E20400000-0x0000015E20425000-memory.dmp
memory/612-53-0x00007FF8FE390000-0x00007FF8FE3A0000-memory.dmp
memory/672-54-0x000001995B230000-0x000001995B25B000-memory.dmp
memory/672-56-0x00007FF8FE390000-0x00007FF8FE3A0000-memory.dmp
memory/876-64-0x000001131DC30000-0x000001131DC5B000-memory.dmp
memory/876-65-0x00007FF8FE390000-0x00007FF8FE3A0000-memory.dmp
memory/960-71-0x000002802D5C0000-0x000002802D5EB000-memory.dmp
memory/960-72-0x00007FF8FE390000-0x00007FF8FE3A0000-memory.dmp
memory/1016-67-0x0000024DC67A0000-0x0000024DC67CB000-memory.dmp
memory/1016-68-0x00007FF8FE390000-0x00007FF8FE3A0000-memory.dmp
memory/1080-77-0x00007FF8FE390000-0x00007FF8FE3A0000-memory.dmp
memory/1080-76-0x0000023490200000-0x000002349022B000-memory.dmp
memory/1088-79-0x000001BFB5090000-0x000001BFB50BB000-memory.dmp
memory/1088-80-0x00007FF8FE390000-0x00007FF8FE3A0000-memory.dmp
memory/1148-85-0x000001D402370000-0x000001D40239B000-memory.dmp
memory/1148-86-0x00007FF8FE390000-0x00007FF8FE3A0000-memory.dmp
memory/1264-88-0x000001869FD00000-0x000001869FD2B000-memory.dmp
memory/1264-89-0x00007FF8FE390000-0x00007FF8FE3A0000-memory.dmp
memory/1272-91-0x0000023378460000-0x000002337848B000-memory.dmp
memory/1272-92-0x00007FF8FE390000-0x00007FF8FE3A0000-memory.dmp
memory/1324-96-0x00007FF8FE390000-0x00007FF8FE3A0000-memory.dmp
memory/1324-95-0x00000213EE000000-0x00000213EE02B000-memory.dmp
memory/1348-100-0x000001D66FD40000-0x000001D66FD6B000-memory.dmp
memory/1348-101-0x00007FF8FE390000-0x00007FF8FE3A0000-memory.dmp
memory/1404-103-0x0000021338CC0000-0x0000021338CEB000-memory.dmp
memory/1404-104-0x00007FF8FE390000-0x00007FF8FE3A0000-memory.dmp
memory/1412-113-0x000001F073760000-0x000001F07378B000-memory.dmp
memory/1412-114-0x00007FF8FE390000-0x00007FF8FE3A0000-memory.dmp
memory/1500-117-0x00007FF8FE390000-0x00007FF8FE3A0000-memory.dmp
memory/1500-116-0x000001781B730000-0x000001781B75B000-memory.dmp
memory/1564-120-0x00007FF8FE390000-0x00007FF8FE3A0000-memory.dmp
memory/1564-119-0x000001ABE6930000-0x000001ABE695B000-memory.dmp
memory/1644-123-0x00007FF8FE390000-0x00007FF8FE3A0000-memory.dmp
memory/1644-122-0x0000021C51C70000-0x0000021C51C9B000-memory.dmp
memory/1672-126-0x00007FF8FE390000-0x00007FF8FE3A0000-memory.dmp
memory/1672-125-0x00000168AD530000-0x00000168AD55B000-memory.dmp
memory/1812-128-0x0000020079D70000-0x0000020079D9B000-memory.dmp
memory/1812-129-0x00007FF8FE390000-0x00007FF8FE3A0000-memory.dmp
memory/1836-132-0x00007FF8FE390000-0x00007FF8FE3A0000-memory.dmp
memory/1836-131-0x00000248376D0000-0x00000248376FB000-memory.dmp
memory/1896-140-0x0000025B68490000-0x0000025B684BB000-memory.dmp
memory/1896-141-0x00007FF8FE390000-0x00007FF8FE3A0000-memory.dmp
memory/1924-143-0x000001E94C030000-0x000001E94C05B000-memory.dmp
memory/1924-144-0x00007FF8FE390000-0x00007FF8FE3A0000-memory.dmp
memory/2020-146-0x00000162C0160000-0x00000162C018B000-memory.dmp
memory/2020-147-0x00007FF8FE390000-0x00007FF8FE3A0000-memory.dmp
memory/2052-149-0x00000203B25A0000-0x00000203B25CB000-memory.dmp
memory/2052-150-0x00007FF8FE390000-0x00007FF8FE3A0000-memory.dmp
memory/2060-153-0x00007FF8FE390000-0x00007FF8FE3A0000-memory.dmp
memory/2060-152-0x000002AD87D30000-0x000002AD87D5B000-memory.dmp
memory/2100-155-0x000001793B830000-0x000001793B85B000-memory.dmp
memory/2100-156-0x00007FF8FE390000-0x00007FF8FE3A0000-memory.dmp
memory/2156-167-0x0000021CD4EE0000-0x0000021CD4F0B000-memory.dmp
memory/2156-168-0x00007FF8FE390000-0x00007FF8FE3A0000-memory.dmp
memory/2188-170-0x0000022BC5940000-0x0000022BC596B000-memory.dmp
memory/2188-171-0x00007FF8FE390000-0x00007FF8FE3A0000-memory.dmp
memory/2280-174-0x00007FF8FE390000-0x00007FF8FE3A0000-memory.dmp
memory/2280-173-0x0000000001310000-0x000000000133B000-memory.dmp
memory/2384-40-0x00007FF93E310000-0x00007FF93E505000-memory.dmp
memory/2384-42-0x00007FF93C360000-0x00007FF93C41E000-memory.dmp
memory/3600-44-0x00000000060A0000-0x0000000006132000-memory.dmp
memory/3600-43-0x00000000003E0000-0x000000000040A000-memory.dmp
memory/3812-41-0x000000001B5D0000-0x000000001B779000-memory.dmp
memory/3812-0-0x0000000000170000-0x00000000001EE000-memory.dmp
memory/3812-2-0x00000000024B0000-0x0000000002506000-memory.dmp
memory/3812-1-0x000000001AD80000-0x000000001AD90000-memory.dmp
memory/3952-33-0x0000000000F20000-0x0000000000F34000-memory.dmp