Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Mason<File name>' = '%APPDATA%\Mason<File name>.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\mason<File name>
Malicious functions
Downloads and executes files.
Modifies file system
Creates the following files
- %TEMP%\content\4132-3280-<File name>.exe-14-42-18-203.dump
- %APPDATA%\89715
- %APPDATA%\mason<File name>.exe
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\<File name>.exe.log
- %TEMP%\content\2040-1120-mason<File name>.exe-14-42-30-388.dump
- %TEMP%\content\4412-3444-mason<File name>.exe-14-43-06-717.dump
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\mason<File name>.exe.log
Network activity
Connects to
- 'ra#.####ubusercontent.com':443
- 'x1.#.lencr.org':80
- 'fo########it21-55066.portmap.host':55066
TCP
HTTP GET requests
- http://x1.#.lencr.org/
Other
- 'ra#.####ubusercontent.com':443
UDP
- DNS ASK ra#.####ubusercontent.com
- DNS ASK x1.#.lencr.org
- DNS ASK fo########it21-55066.portmap.host
Miscellaneous
Creates and executes the following
- '%APPDATA%\mason<File name>.exe'
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /f /sc minute /mo 1 /tn "Mason<File name>" /tr "%APPDATA%\Mason<File name>.exe"
- '%APPDATA%\mason<File name>.exe' ' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /create /f /sc minute /mo 1 /tn "Mason<File name>" /tr "%APPDATA%\Mason<File name>.exe"' (with hidden window)
