Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
21/06/2026, 00:33
General
- Target MasonProtector.exe
- Size 1.8MB
- Sample260621-awkcdaay3j
- SHA256 964823e2aa0adaed0d62613cfeae27bdb6ed989ae62a9d7579123deb56117af3
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies Internet Explorer settings 1 TTPs 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MasonProtector.exe"C:\Users\Admin\AppData\Local\Temp\MasonProtector.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 22482⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3124 -ip 31241⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3124-0-0x00000000002E0000-0x00000000004BC000-memory.dmp
memory/3124-1-0x00000000055E0000-0x0000000005B86000-memory.dmp
memory/3124-2-0x0000000004F70000-0x0000000005002000-memory.dmp
memory/3124-3-0x0000000004EB0000-0x0000000004EC0000-memory.dmp
memory/3124-4-0x0000000005030000-0x0000000005156000-memory.dmp
memory/3124-5-0x00000000052D0000-0x00000000052DA000-memory.dmp
memory/3124-6-0x0000000004EB0000-0x0000000004EC0000-memory.dmp
memory/3124-7-0x0000000004EB0000-0x0000000004EC0000-memory.dmp
memory/3124-8-0x0000000009C70000-0x000000000A416000-memory.dmp