Analysis
- user interaction
yes - max time kernel
61s - max time network
63s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
21/06/2026, 00:33
General
- Target MasonProtector.exe
- Size 1.8MB
- Sample260621-awkcdaay3j
- SHA256 964823e2aa0adaed0d62613cfeae27bdb6ed989ae62a9d7579123deb56117af3
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies Internet Explorer settings 1 TTPs 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MasonProtector.exe"C:\Users\Admin\AppData\Local\Temp\MasonProtector.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 21722⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4592 -ip 45921⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4592-0-0x0000000000D10000-0x0000000000EEC000-memory.dmp
memory/4592-1-0x0000000005DC0000-0x0000000006366000-memory.dmp
memory/4592-2-0x00000000058B0000-0x0000000005942000-memory.dmp
memory/4592-3-0x0000000005800000-0x0000000005810000-memory.dmp
memory/4592-4-0x0000000005950000-0x0000000005A76000-memory.dmp
memory/4592-5-0x0000000005850000-0x000000000585A000-memory.dmp
memory/4592-6-0x0000000005800000-0x0000000005810000-memory.dmp
memory/4592-7-0x000000000A770000-0x000000000AF16000-memory.dmp