General
- Target MasonClient.exe
- Size 48KB
- Sample260623-j5s6babw91
- SHA256 f4e73f71355f3fa268397040ff0bc4109aabcffa7ddd8270b4962e160cda1016
Score
10/10
Malware Config
Targets
-
- Target MasonClient.exe
- Size 48KB
- SHA256 f4e73f71355f3fa268397040ff0bc4109aabcffa7ddd8270b4962e160cda1016
Score10/10-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Modifies Windows Defender Real-time Protection settings
-
Disables one or more Microsoft Defender components
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Disables automatic submission of suspicious files to Microsoft by Windows Defender
Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.
-
Executes dropped EXE
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1