04697f994e1be55ce5ddbfc9bbf7151055318bd79ce1123b212de79a3f131d48

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/05/2026, 01:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ByPasswindowsv6.exe
Size 347KB
Sample260519-b494fae12x
SHA256 04697f994e1be55ce5ddbfc9bbf7151055318bd79ce1123b212de79a3f131d48
MD5 4acf8d46417fa399151553f7c4a670df
SHA1 6059ffd2fd4c16f9fdc557f3d91458d6d28c1262
SHA512 fefe2fc36f68976594a144be687a3591ea8b1c90348bc7cab145839b63e7eed12c1eb96c87d6a255cab4d53ce5bc0ab7ea03b1db84ddbfcebbfa1a5e344d89c7
SSDEEP 6144:zZTpxTpPD8+r0AgasW5tbMajaJ9IUBxy0fb:zlTVA+rBZ5tgsaJ93b
TLSH
T131743A06FB5394EDC926C13487ABA3337532BCAE51306E2A5798FB352D71E405A7CE18
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2976	powershell.exe

Executes dropped EXE 9 IoCs

pid	Process
1744	MasonPatriot.exe
3600	SVCHOST.exe
4292	StateManagerMgr.exe
4128	StateManagerMgr.exe
1004	StateManagerMgr.exe
5084	StateManagerMgr.exe
4724	StateManagerMgr.exe
1836	StateManagerMgr.exe
3096	StateManagerMgr.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1420	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MasonPatriot.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1600	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2976	powershell.exe
2976	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2976	powershell.exe
Token: SeIncreaseQuotaPrivilege	2976	powershell.exe
Token: SeSecurityPrivilege	2976	powershell.exe
Token: SeTakeOwnershipPrivilege	2976	powershell.exe
Token: SeLoadDriverPrivilege	2976	powershell.exe
Token: SeSystemProfilePrivilege	2976	powershell.exe
Token: SeSystemtimePrivilege	2976	powershell.exe
Token: SeProfSingleProcessPrivilege	2976	powershell.exe
Token: SeIncBasePriorityPrivilege	2976	powershell.exe
Token: SeCreatePagefilePrivilege	2976	powershell.exe
Token: SeBackupPrivilege	2976	powershell.exe
Token: SeRestorePrivilege	2976	powershell.exe
Token: SeShutdownPrivilege	2976	powershell.exe
Token: SeDebugPrivilege	2976	powershell.exe
Token: SeSystemEnvironmentPrivilege	2976	powershell.exe
Token: SeRemoteShutdownPrivilege	2976	powershell.exe
Token: SeUndockPrivilege	2976	powershell.exe
Token: SeManageVolumePrivilege	2976	powershell.exe
Token: 33	2976	powershell.exe
Token: 34	2976	powershell.exe
Token: 35	2976	powershell.exe
Token: 36	2976	powershell.exe
Token: SeIncreaseQuotaPrivilege	2976	powershell.exe
Token: SeSecurityPrivilege	2976	powershell.exe
Token: SeTakeOwnershipPrivilege	2976	powershell.exe
Token: SeLoadDriverPrivilege	2976	powershell.exe
Token: SeSystemProfilePrivilege	2976	powershell.exe
Token: SeSystemtimePrivilege	2976	powershell.exe
Token: SeProfSingleProcessPrivilege	2976	powershell.exe
Token: SeIncBasePriorityPrivilege	2976	powershell.exe
Token: SeCreatePagefilePrivilege	2976	powershell.exe
Token: SeBackupPrivilege	2976	powershell.exe
Token: SeRestorePrivilege	2976	powershell.exe
Token: SeShutdownPrivilege	2976	powershell.exe
Token: SeDebugPrivilege	2976	powershell.exe
Token: SeSystemEnvironmentPrivilege	2976	powershell.exe
Token: SeRemoteShutdownPrivilege	2976	powershell.exe
Token: SeUndockPrivilege	2976	powershell.exe
Token: SeManageVolumePrivilege	2976	powershell.exe
Token: 33	2976	powershell.exe
Token: 34	2976	powershell.exe
Token: 35	2976	powershell.exe
Token: 36	2976	powershell.exe
Token: SeIncreaseQuotaPrivilege	2976	powershell.exe
Token: SeSecurityPrivilege	2976	powershell.exe
Token: SeTakeOwnershipPrivilege	2976	powershell.exe
Token: SeLoadDriverPrivilege	2976	powershell.exe
Token: SeSystemProfilePrivilege	2976	powershell.exe
Token: SeSystemtimePrivilege	2976	powershell.exe
Token: SeProfSingleProcessPrivilege	2976	powershell.exe
Token: SeIncBasePriorityPrivilege	2976	powershell.exe
Token: SeCreatePagefilePrivilege	2976	powershell.exe
Token: SeBackupPrivilege	2976	powershell.exe
Token: SeRestorePrivilege	2976	powershell.exe
Token: SeShutdownPrivilege	2976	powershell.exe
Token: SeDebugPrivilege	2976	powershell.exe
Token: SeSystemEnvironmentPrivilege	2976	powershell.exe
Token: SeRemoteShutdownPrivilege	2976	powershell.exe
Token: SeUndockPrivilege	2976	powershell.exe
Token: SeManageVolumePrivilege	2976	powershell.exe
Token: 33	2976	powershell.exe
Token: 34	2976	powershell.exe
Token: 35	2976	powershell.exe
Token: 36	2976	powershell.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 1744	2796	ByPasswindowsv6.exe	81
PID 2796 wrote to memory of 3600	2796	ByPasswindowsv6.exe	82
PID 3600 wrote to memory of 4292	3600	SVCHOST.exe	83
PID 4292 wrote to memory of 4128	4292	StateManagerMgr.exe	84
PID 4292 wrote to memory of 4144	4292	StateManagerMgr.exe	85
PID 4144 wrote to memory of 2000	4144	cmd.exe	87
PID 4144 wrote to memory of 2976	4144	cmd.exe	88
PID 4292 wrote to memory of 2272	4292	StateManagerMgr.exe	90
PID 2272 wrote to memory of 2204	2272	cmd.exe	92
PID 2272 wrote to memory of 1600	2272	cmd.exe	93
PID 4292 wrote to memory of 1420	4292	StateManagerMgr.exe	94
PID 1420 wrote to memory of 2128	1420	cmd.exe	96
PID 1420 wrote to memory of 2492	1420	cmd.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2492	attrib.exe

C:\Users\Admin\AppData\Local\Temp\ByPasswindowsv6.exe
"C:\Users\Admin\AppData\Local\Temp\ByPasswindowsv6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Users\Admin\AppData\Local\Temp\mbaece585e86\MasonPatriot.exe
  "C:\Users\Admin\AppData\Local\Temp\mbaece585e86\MasonPatriot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1744
- C:\Users\Admin\AppData\Local\Temp\mbaece585e86\SVCHOST.exe
  "C:\Users\Admin\AppData\Local\Temp\mbaece585e86\SVCHOST.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3600
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\StateManagerMgr.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\StateManagerMgr.exe" --r
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4292
  - - C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\StateManagerMgr.exe
      "C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\StateManagerMgr.exe" --wd 4292
      4⤵
      Executes dropped EXE
      PID:4128
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c chcp 65001 >nul && powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\StateManagerMgr.exe';$t=New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 2);$s=New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0;Register-ScheduledTask -Force -TaskName '\Microsoft\Windows\Maintenance\PowerProfileMonitor' -Action $a -Trigger $t -Settings $s"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4144
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:2000
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\StateManagerMgr.exe';$t=New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 2);$s=New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0;Register-ScheduledTask -Force -TaskName '\Microsoft\Windows\Maintenance\PowerProfileMonitor' -Action $a -Trigger $t -Settings $s"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2976
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c chcp 65001 >nul && schtasks /create /f /sc minute /mo 1 /tn "StateManagerMgr" /tr "\"C:\Users\Admin\AppData\Roaming\StateManagerMgr.exe\""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2272
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:2204
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "StateManagerMgr" /tr "\"C:\Users\Admin\AppData\Roaming\StateManagerMgr.exe\""
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1600
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c chcp 65001 >nul && attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\StateManagerMgr.exe"
      4⤵
      Hide Artifacts: Hidden Files and Directories
      Suspicious use of WriteProcessMemory
      PID:1420
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:2128
    - - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\StateManagerMgr.exe"
        5⤵
        Views/modifies file attributes
        
        PID:2492

C:\Users\Admin\AppData\Roaming\StateManagerMgr.exe
"C:\Users\Admin\AppData\Roaming\StateManagerMgr.exe"
1⤵
- Executes dropped EXE
PID:1004

C:\Users\Admin\AppData\Roaming\StateManagerMgr.exe
C:\Users\Admin\AppData\Roaming\StateManagerMgr.exe
1⤵
- Executes dropped EXE
PID:5084

C:\Users\Admin\AppData\Roaming\StateManagerMgr.exe
C:\Users\Admin\AppData\Roaming\StateManagerMgr.exe
1⤵
- Executes dropped EXE
PID:4724

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\StateManagerMgr.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\StateManagerMgr.exe
1⤵
- Executes dropped EXE
PID:1836

C:\Users\Admin\AppData\Roaming\StateManagerMgr.exe
C:\Users\Admin\AppData\Roaming\StateManagerMgr.exe
1⤵
- Executes dropped EXE
PID:3096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_ecn5uhjz.0mk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ecn5uhjz.0mk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

MasonPatriot.exe

Path C:\Users\Admin\AppData\Local\Temp\mbaece585e86\MasonPatriot.exe
Size 33KB
SHA256 784acb9613cbb017945d83820924c0226f9221775dd1e86ac92161e131a99f9b
MD5 3f68f7a8600cd4b6390e2b1824b4eadb
SHA1 1e0434a9ae04c8fd2251a7139429da4849ed2bed
SHA512 c69d1203bec7e382bd0d9cc1c3fd263fd325f5ca00da25645ed889e0e918077f2bc3a752121d54c8be68270702e9e4869bb9d420e0b640222553f72a07366564
SSDEEP 384:CxoxHcKeOf23vQ1SHNVoGlDK+Yicf54O8wsjWnNFXKNrU/wLM+ES0:CR3hNwbsjaXKRqwlES0
TLSH
T10CF27F4B3E8C9551D8500077FEB68363276BA5B53A19359693DFF62FE460302AE2CD43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SVCHOST.exe

Path C:\Users\Admin\AppData\Local\Temp\mbaece585e86\SVCHOST.exe
Size 269KB
SHA256 4799b0c7123041c4be25fb275e8de388b7585b3f5082a1063ece767c6a1079f3
MD5 3684f16bd70c21368b51c03500a2fcf0
SHA1 54b0fe981f91668aeae1c110f72df7d7860b3a66
SHA512 911f8411a1c6e8d5e8bc1b784ed4b458415918e8600413ab0ffd1ff05ed9b30425c9e2968935cad11ba68323c336038fcaeefc16109f546c108d9523e1252f17
SSDEEP 3072:NygmgD8+r5bqAgLMXcgnX28k8+s0g9sJfotbnyJZRT8jaJ9XrQBUBNHy0qcM:NpPD8+r0AgasW5tbMajaJ9IUBxy0f
TLSH
T167442907FB5394EDC927C13483AFA233B531BC9E5230AE2A5798CB352D52E505A7DE18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1004-49-0x00007FF617540000-0x00007FF6175A2000-memory.dmp

Download

memory/1744-66-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/1744-102-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/1744-91-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/1744-82-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/1744-79-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/1744-69-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/1744-60-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/1744-50-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/1744-57-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/1836-97-0x00007FF71F430000-0x00007FF71F492000-memory.dmp

Download

memory/2796-44-0x00007FF726C60000-0x00007FF726C73000-memory.dmp

Download

memory/2976-21-0x0000023120A90000-0x0000023120AB2000-memory.dmp

Download

memory/2976-35-0x0000023122CD0000-0x0000023122CEC000-memory.dmp

Download

memory/2976-41-0x0000023107D10000-0x00000231087D2000-memory.dmp

Download

memory/2976-38-0x0000023122DE0000-0x0000023122DFC000-memory.dmp

Download

memory/2976-37-0x0000023122DB0000-0x0000023122DBA000-memory.dmp

Download

memory/2976-36-0x0000023122CF0000-0x0000023122DA3000-memory.dmp

Download

memory/3096-101-0x00007FF617540000-0x00007FF6175A2000-memory.dmp

Download

memory/3600-28-0x00007FF7D7EA0000-0x00007FF7D7F02000-memory.dmp

Download

memory/4128-52-0x00007FF71F430000-0x00007FF71F492000-memory.dmp

Download

memory/4292-51-0x00007FF71F430000-0x00007FF71F492000-memory.dmp

Download

memory/4724-76-0x00007FF617540000-0x00007FF6175A2000-memory.dmp

Download

memory/5084-56-0x00007FF617540000-0x00007FF6175A2000-memory.dmp

Download