Analysis
- max time kernel
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
22/06/2026, 06:08
General
- Target MasonProtector.exe
- Size 1.8MB
- Sample260622-gv4syshs9l
- SHA256 964823e2aa0adaed0d62613cfeae27bdb6ed989ae62a9d7579123deb56117af3
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies Internet Explorer settings 1 TTPs 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MasonProtector.exe"C:\Users\Admin\AppData\Local\Temp\MasonProtector.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 22722⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2720 -ip 27201⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2720-0-0x0000000000DA0000-0x0000000000F7C000-memory.dmp
memory/2720-1-0x00000000060C0000-0x0000000006666000-memory.dmp
memory/2720-2-0x0000000005A30000-0x0000000005AC2000-memory.dmp
memory/2720-3-0x0000000005B00000-0x0000000005B10000-memory.dmp
memory/2720-4-0x0000000005B10000-0x0000000005C36000-memory.dmp
memory/2720-5-0x0000000005CA0000-0x0000000005CAA000-memory.dmp
memory/2720-6-0x0000000005B00000-0x0000000005B10000-memory.dmp
memory/2720-7-0x000000000A740000-0x000000000AEE6000-memory.dmp