04697f994e1be55ce5ddbfc9bbf7151055318bd79ce1123b212de79a3f131d48

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/05/2026, 01:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ByPasswindowsv6.exe
Size 347KB
Sample260519-b494fae12x
SHA256 04697f994e1be55ce5ddbfc9bbf7151055318bd79ce1123b212de79a3f131d48
MD5 4acf8d46417fa399151553f7c4a670df
SHA1 6059ffd2fd4c16f9fdc557f3d91458d6d28c1262
SHA512 fefe2fc36f68976594a144be687a3591ea8b1c90348bc7cab145839b63e7eed12c1eb96c87d6a255cab4d53ce5bc0ab7ea03b1db84ddbfcebbfa1a5e344d89c7
SSDEEP 6144:zZTpxTpPD8+r0AgasW5tbMajaJ9IUBxy0fb:zlTVA+rBZ5tgsaJ93b
TLSH
T131743A06FB5394EDC926C13487ABA3337532BCAE51306E2A5798FB352D71E405A7CE18
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3788	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	ByPasswindowsv6.exe

Executes dropped EXE 8 IoCs

pid	Process
3468	MasonPatriot.exe
2636	SVCHOST.exe
4960	SensorMonitorRuntime.exe
2052	SensorMonitorRuntime.exe
2084	SensorMonitorRuntime.exe
3104	SensorMonitorRuntime.exe
1860	SensorMonitorRuntime.exe
4324	SensorMonitorRuntime.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3236	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MasonPatriot.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2468	cmd.exe
3308	attrib.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2904	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3788	powershell.exe
3788	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3788	powershell.exe
Token: SeIncreaseQuotaPrivilege	3788	powershell.exe
Token: SeSecurityPrivilege	3788	powershell.exe
Token: SeTakeOwnershipPrivilege	3788	powershell.exe
Token: SeLoadDriverPrivilege	3788	powershell.exe
Token: SeSystemProfilePrivilege	3788	powershell.exe
Token: SeSystemtimePrivilege	3788	powershell.exe
Token: SeProfSingleProcessPrivilege	3788	powershell.exe
Token: SeIncBasePriorityPrivilege	3788	powershell.exe
Token: SeCreatePagefilePrivilege	3788	powershell.exe
Token: SeBackupPrivilege	3788	powershell.exe
Token: SeRestorePrivilege	3788	powershell.exe
Token: SeShutdownPrivilege	3788	powershell.exe
Token: SeDebugPrivilege	3788	powershell.exe
Token: SeSystemEnvironmentPrivilege	3788	powershell.exe
Token: SeRemoteShutdownPrivilege	3788	powershell.exe
Token: SeUndockPrivilege	3788	powershell.exe
Token: SeManageVolumePrivilege	3788	powershell.exe
Token: 33	3788	powershell.exe
Token: 34	3788	powershell.exe
Token: 35	3788	powershell.exe
Token: 36	3788	powershell.exe
Token: SeIncreaseQuotaPrivilege	3788	powershell.exe
Token: SeSecurityPrivilege	3788	powershell.exe
Token: SeTakeOwnershipPrivilege	3788	powershell.exe
Token: SeLoadDriverPrivilege	3788	powershell.exe
Token: SeSystemProfilePrivilege	3788	powershell.exe
Token: SeSystemtimePrivilege	3788	powershell.exe
Token: SeProfSingleProcessPrivilege	3788	powershell.exe
Token: SeIncBasePriorityPrivilege	3788	powershell.exe
Token: SeCreatePagefilePrivilege	3788	powershell.exe
Token: SeBackupPrivilege	3788	powershell.exe
Token: SeRestorePrivilege	3788	powershell.exe
Token: SeShutdownPrivilege	3788	powershell.exe
Token: SeDebugPrivilege	3788	powershell.exe
Token: SeSystemEnvironmentPrivilege	3788	powershell.exe
Token: SeRemoteShutdownPrivilege	3788	powershell.exe
Token: SeUndockPrivilege	3788	powershell.exe
Token: SeManageVolumePrivilege	3788	powershell.exe
Token: 33	3788	powershell.exe
Token: 34	3788	powershell.exe
Token: 35	3788	powershell.exe
Token: 36	3788	powershell.exe
Token: SeIncreaseQuotaPrivilege	3788	powershell.exe
Token: SeSecurityPrivilege	3788	powershell.exe
Token: SeTakeOwnershipPrivilege	3788	powershell.exe
Token: SeLoadDriverPrivilege	3788	powershell.exe
Token: SeSystemProfilePrivilege	3788	powershell.exe
Token: SeSystemtimePrivilege	3788	powershell.exe
Token: SeProfSingleProcessPrivilege	3788	powershell.exe
Token: SeIncBasePriorityPrivilege	3788	powershell.exe
Token: SeCreatePagefilePrivilege	3788	powershell.exe
Token: SeBackupPrivilege	3788	powershell.exe
Token: SeRestorePrivilege	3788	powershell.exe
Token: SeShutdownPrivilege	3788	powershell.exe
Token: SeDebugPrivilege	3788	powershell.exe
Token: SeSystemEnvironmentPrivilege	3788	powershell.exe
Token: SeRemoteShutdownPrivilege	3788	powershell.exe
Token: SeUndockPrivilege	3788	powershell.exe
Token: SeManageVolumePrivilege	3788	powershell.exe
Token: 33	3788	powershell.exe
Token: 34	3788	powershell.exe
Token: 35	3788	powershell.exe
Token: 36	3788	powershell.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 3468	640	ByPasswindowsv6.exe	88
PID 640 wrote to memory of 2636	640	ByPasswindowsv6.exe	89
PID 2636 wrote to memory of 4960	2636	SVCHOST.exe	90
PID 4960 wrote to memory of 2052	4960	SensorMonitorRuntime.exe	91
PID 4960 wrote to memory of 2468	4960	SensorMonitorRuntime.exe	92
PID 2468 wrote to memory of 2152	2468	cmd.exe	94
PID 2468 wrote to memory of 3788	2468	cmd.exe	95
PID 4960 wrote to memory of 3996	4960	SensorMonitorRuntime.exe	98
PID 3996 wrote to memory of 1492	3996	cmd.exe	100
PID 3996 wrote to memory of 2904	3996	cmd.exe	101
PID 4960 wrote to memory of 3236	4960	SensorMonitorRuntime.exe	102
PID 3236 wrote to memory of 2736	3236	cmd.exe	104
PID 3236 wrote to memory of 3308	3236	cmd.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3308	attrib.exe

C:\Users\Admin\AppData\Local\Temp\ByPasswindowsv6.exe
"C:\Users\Admin\AppData\Local\Temp\ByPasswindowsv6.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:640
- C:\Users\Admin\AppData\Local\Temp\mb280e581289\MasonPatriot.exe
  "C:\Users\Admin\AppData\Local\Temp\mb280e581289\MasonPatriot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3468
- C:\Users\Admin\AppData\Local\Temp\mb280e581289\SVCHOST.exe
  "C:\Users\Admin\AppData\Local\Temp\mb280e581289\SVCHOST.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\SensorMonitorRuntime.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Network\SensorMonitorRuntime.exe" --r
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4960
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Network\SensorMonitorRuntime.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Network\SensorMonitorRuntime.exe" --wd 4960
      4⤵
      Executes dropped EXE
      PID:2052
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c chcp 65001 >nul && powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\Network\SensorMonitorRuntime.exe';$t=New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 2);$s=New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0;Register-ScheduledTask -Force -TaskName '\Microsoft\Windows\Maintenance\TelemetryHostAgent' -Action $a -Trigger $t -Settings $s"
      4⤵
      System Time Discovery
      Suspicious use of WriteProcessMemory
      PID:2468
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:2152
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\Network\SensorMonitorRuntime.exe';$t=New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 2);$s=New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0;Register-ScheduledTask -Force -TaskName '\Microsoft\Windows\Maintenance\TelemetryHostAgent' -Action $a -Trigger $t -Settings $s"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3788
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c chcp 65001 >nul && schtasks /create /f /sc minute /mo 1 /tn "SensorMonitorRuntime" /tr "\"C:\Users\Admin\AppData\Roaming\SensorMonitorRuntime.exe\""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3996
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:1492
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "SensorMonitorRuntime" /tr "\"C:\Users\Admin\AppData\Roaming\SensorMonitorRuntime.exe\""
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2904
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c chcp 65001 >nul && attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Network\SensorMonitorRuntime.exe"
      4⤵
      Hide Artifacts: Hidden Files and Directories
      Suspicious use of WriteProcessMemory
      PID:3236
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:2736
    - - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Network\SensorMonitorRuntime.exe"
        5⤵
        System Time Discovery
        Views/modifies file attributes
        
        PID:3308

C:\Users\Admin\AppData\Roaming\SensorMonitorRuntime.exe
"C:\Users\Admin\AppData\Roaming\SensorMonitorRuntime.exe"
1⤵
- Executes dropped EXE
PID:2084

C:\Users\Admin\AppData\Roaming\SensorMonitorRuntime.exe
C:\Users\Admin\AppData\Roaming\SensorMonitorRuntime.exe
1⤵
- Executes dropped EXE
PID:3104

C:\Users\Admin\AppData\Roaming\SensorMonitorRuntime.exe
C:\Users\Admin\AppData\Roaming\SensorMonitorRuntime.exe
1⤵
- Executes dropped EXE
PID:1860

C:\Users\Admin\AppData\Roaming\Microsoft\Network\SensorMonitorRuntime.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\SensorMonitorRuntime.exe
1⤵
- Executes dropped EXE
PID:4324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_bdc52eyl.ylt.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bdc52eyl.ylt.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

MasonPatriot.exe

Path C:\Users\Admin\AppData\Local\Temp\mb280e581289\MasonPatriot.exe
Size 33KB
SHA256 784acb9613cbb017945d83820924c0226f9221775dd1e86ac92161e131a99f9b
MD5 3f68f7a8600cd4b6390e2b1824b4eadb
SHA1 1e0434a9ae04c8fd2251a7139429da4849ed2bed
SHA512 c69d1203bec7e382bd0d9cc1c3fd263fd325f5ca00da25645ed889e0e918077f2bc3a752121d54c8be68270702e9e4869bb9d420e0b640222553f72a07366564
SSDEEP 384:CxoxHcKeOf23vQ1SHNVoGlDK+Yicf54O8wsjWnNFXKNrU/wLM+ES0:CR3hNwbsjaXKRqwlES0
TLSH
T10CF27F4B3E8C9551D8500077FEB68363276BA5B53A19359693DFF62FE460302AE2CD43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SVCHOST.exe

Path C:\Users\Admin\AppData\Local\Temp\mb280e581289\SVCHOST.exe
Size 269KB
SHA256 4799b0c7123041c4be25fb275e8de388b7585b3f5082a1063ece767c6a1079f3
MD5 3684f16bd70c21368b51c03500a2fcf0
SHA1 54b0fe981f91668aeae1c110f72df7d7860b3a66
SHA512 911f8411a1c6e8d5e8bc1b784ed4b458415918e8600413ab0ffd1ff05ed9b30425c9e2968935cad11ba68323c336038fcaeefc16109f546c108d9523e1252f17
SSDEEP 3072:NygmgD8+r5bqAgLMXcgnX28k8+s0g9sJfotbnyJZRT8jaJ9XrQBUBNHy0qcM:NpPD8+r0AgasW5tbMajaJ9IUBxy0f
TLSH
T167442907FB5394EDC927C13483AFA233B531BC9E5230AE2A5798CB352D52E505A7DE18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/640-39-0x00007FF665C30000-0x00007FF665C43000-memory.dmp

Download

memory/1860-77-0x00007FF7463C0000-0x00007FF746422000-memory.dmp

Download

memory/2052-42-0x00007FF624140000-0x00007FF6241A2000-memory.dmp

Download

memory/2084-38-0x00007FF7463C0000-0x00007FF746422000-memory.dmp

Download

memory/2636-29-0x00007FF67F330000-0x00007FF67F392000-memory.dmp

Download

memory/3104-55-0x00007FF7463C0000-0x00007FF746422000-memory.dmp

Download

memory/3468-43-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/3468-46-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/3468-40-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/3468-56-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/3468-59-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/3468-65-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/3468-68-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/3468-78-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/3468-81-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/3468-88-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/3788-28-0x000001620E510000-0x000001620E532000-memory.dmp

Download

memory/4324-87-0x00007FF624140000-0x00007FF6241A2000-memory.dmp

Download

memory/4960-41-0x00007FF624140000-0x00007FF6241A2000-memory.dmp

Download