2cc1f96afbf607eaf8cfc77a7128edeb1b2340c9fef9e7b9e33c5c03f5973bcb

Analysis

max time kernel
149s
max time network
158s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/06/2026, 04:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MasonClient (1).exe
Size 586KB
Sample260628-feey8afs7s
SHA256 2cc1f96afbf607eaf8cfc77a7128edeb1b2340c9fef9e7b9e33c5c03f5973bcb
MD5 0df77b250888dcdeeed2031612498d6a
SHA1 44de0c6859896702dff08e2713ef3ed6b8484657
SHA512 0397dab116f923a03fd87cbabfc7b4941978036727964cf0767296967a2cfd10b4fbb054ac3d431cf7b70e7a8dc01353883d329e8e8eba15b5602846d7875efb
SSDEEP 6144:0k18MMw8e4jWp3IVVcg217qsBWQ/23SloBIVR4eWC4CTSy+wUSz4MKI:L/Mv1jakVcpP/oBIb6bCTRZP
TLSH
T140D41987FA53A1BCD51B81714BEB6633B932B95841357D7F4B048B7A7EA0E400638F26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3144	CertEnrollAgent.exe
5784	CertEnrollAgent.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2892	cmd.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 3144	2704	MasonClient (1).exe	80
PID 3144 wrote to memory of 5784	3144	CertEnrollAgent.exe	81
PID 3144 wrote to memory of 1172	3144	CertEnrollAgent.exe	82
PID 1172 wrote to memory of 3392	1172	cmd.exe	84
PID 3144 wrote to memory of 2892	3144	CertEnrollAgent.exe	85
PID 2892 wrote to memory of 2588	2892	cmd.exe	87
PID 2892 wrote to memory of 4508	2892	cmd.exe	88

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4508	attrib.exe

C:\Users\Admin\AppData\Local\Temp\MasonClient (1).exe
"C:\Users\Admin\AppData\Local\Temp\MasonClient (1).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\CertEnrollAgent.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Network\CertEnrollAgent.exe" --r
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3144
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\CertEnrollAgent.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Network\CertEnrollAgent.exe" --wd 3144
    3⤵
    - Executes dropped EXE
    PID:5784
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c chcp 65001 >nul && Á¼¤F-{?„íPºTqP–À¼§3rù¬Ôºwí3rR/ †eo-[&ÝÚa ˆºT´@Wc<ê˜ªðy¡h>%‰¼’ŸÖœo¥d,Ž¨v'Z-U`ìcýL‹ÒÒ#éŸåÝÉF\ºÍÜÓŸÐà‡ ÜM)Õqç:QÚÓ4Œ°o¬GÍ&FÓÿ’JXâñ~›ß[‹¬šTÓœFó–j¼ÈŸ‘ÎR¦¶þ~n‹HÀO#ÃMC¥•,Fª¶iòÇ65H~¤tj°w7‰ú±U=óVç¶fú˜¯-Ô©þ^#P…)ïÑþÞ=i«2oþ±¥.žš}ëæl-U”ùÿrTöj‚«$,ÚSÛ¿ÚXfH °ŽÒNT¦ÿ^å`nòD
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1172
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:3392
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c chcp 65001 >nul && attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Network\CertEnrollAgent.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:2892
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2588
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Network\CertEnrollAgent.exe"
      4⤵
      Views/modifies file attributes
      PID:4508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CertEnrollAgent.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Network\CertEnrollAgent.exe
Size 586KB
SHA256 2cc1f96afbf607eaf8cfc77a7128edeb1b2340c9fef9e7b9e33c5c03f5973bcb
MD5 0df77b250888dcdeeed2031612498d6a
SHA1 44de0c6859896702dff08e2713ef3ed6b8484657
SHA512 0397dab116f923a03fd87cbabfc7b4941978036727964cf0767296967a2cfd10b4fbb054ac3d431cf7b70e7a8dc01353883d329e8e8eba15b5602846d7875efb
SSDEEP 6144:0k18MMw8e4jWp3IVVcg217qsBWQ/23SloBIVR4eWC4CTSy+wUSz4MKI:L/Mv1jakVcpP/oBIb6bCTRZP
TLSH
T140D41987FA53A1BCD51B81714BEB6633B932B95841357D7F4B048B7A7EA0E400638F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2704-6-0x00007FF7FAC60000-0x00007FF7FAD0E000-memory.dmp

Download

memory/3144-7-0x00007FF65E530000-0x00007FF65E5DE000-memory.dmp

Download

memory/3144-9-0x00007FF65E530000-0x00007FF65E5DE000-memory.dmp

Download

memory/3144-11-0x00007FF65E530000-0x00007FF65E5DE000-memory.dmp

Download

memory/3144-13-0x00007FF65E530000-0x00007FF65E5DE000-memory.dmp

Download

memory/3144-17-0x00007FF65E530000-0x00007FF65E5DE000-memory.dmp

Download

memory/3144-21-0x00007FF65E530000-0x00007FF65E5DE000-memory.dmp

Download

memory/3144-25-0x00007FF65E530000-0x00007FF65E5DE000-memory.dmp

Download

memory/3144-29-0x00007FF65E530000-0x00007FF65E5DE000-memory.dmp

Download

memory/5784-8-0x00007FF65E530000-0x00007FF65E5DE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads