20cb6c3d569c50725e23085b16dbce60ff362647ccb6b9c84670e67e227b2e42

Analysis

max time kernel
150s
max time network
152s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
12/07/2026, 00:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MasonClient (1).exe
Size 605KB
Sample260712-awsnrady3z
SHA256 20cb6c3d569c50725e23085b16dbce60ff362647ccb6b9c84670e67e227b2e42
MD5 7f4573708f76e2673f2679ffaa09fb95
SHA1 e81206092f494173c80ccf1ce6b2768109ec0928
SHA512 92827d90d2c5422b1046459169229a6ff7c488f4623f6375ad2adedf9f0a4bebfb4dcaf5ac12a3a49fe5a45080c29d90afcb92d92a78ef1f9cae8ceca002e4aa
SSDEEP 6144:4nYCBt7ODM0iY0G5xubcJINdLCUxcQytbwPwTom7NpQV/i5bcUSQCT4:OYCCDMOMwGeToKnQV/i5bjCE
TLSH
T1D4D4198AFA53A17CD51BC1758BAB6633B932B94C42357D7F4A14C7797EA0E000638F26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4556	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4556	powershell.exe
4556	powershell.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	4556	powershell.exe
Token: SeIncreaseQuotaPrivilege	4556	powershell.exe
Token: SeSecurityPrivilege	4556	powershell.exe
Token: SeTakeOwnershipPrivilege	4556	powershell.exe
Token: SeLoadDriverPrivilege	4556	powershell.exe
Token: SeSystemProfilePrivilege	4556	powershell.exe
Token: SeSystemtimePrivilege	4556	powershell.exe
Token: SeProfSingleProcessPrivilege	4556	powershell.exe
Token: SeIncBasePriorityPrivilege	4556	powershell.exe
Token: SeCreatePagefilePrivilege	4556	powershell.exe
Token: SeBackupPrivilege	4556	powershell.exe
Token: SeRestorePrivilege	4556	powershell.exe
Token: SeShutdownPrivilege	4556	powershell.exe
Token: SeDebugPrivilege	4556	powershell.exe
Token: SeSystemEnvironmentPrivilege	4556	powershell.exe
Token: SeRemoteShutdownPrivilege	4556	powershell.exe
Token: SeUndockPrivilege	4556	powershell.exe
Token: SeManageVolumePrivilege	4556	powershell.exe
Token: 33	4556	powershell.exe
Token: 34	4556	powershell.exe
Token: 35	4556	powershell.exe
Token: 36	4556	powershell.exe
Token: SeIncreaseQuotaPrivilege	4556	powershell.exe
Token: SeSecurityPrivilege	4556	powershell.exe
Token: SeTakeOwnershipPrivilege	4556	powershell.exe
Token: SeLoadDriverPrivilege	4556	powershell.exe
Token: SeSystemProfilePrivilege	4556	powershell.exe
Token: SeSystemtimePrivilege	4556	powershell.exe
Token: SeProfSingleProcessPrivilege	4556	powershell.exe
Token: SeIncBasePriorityPrivilege	4556	powershell.exe
Token: SeCreatePagefilePrivilege	4556	powershell.exe
Token: SeBackupPrivilege	4556	powershell.exe
Token: SeRestorePrivilege	4556	powershell.exe
Token: SeShutdownPrivilege	4556	powershell.exe
Token: SeDebugPrivilege	4556	powershell.exe
Token: SeSystemEnvironmentPrivilege	4556	powershell.exe
Token: SeRemoteShutdownPrivilege	4556	powershell.exe
Token: SeUndockPrivilege	4556	powershell.exe
Token: SeManageVolumePrivilege	4556	powershell.exe
Token: 33	4556	powershell.exe
Token: 34	4556	powershell.exe
Token: 35	4556	powershell.exe
Token: 36	4556	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 2940	4920	MasonClient (1).exe	92
PID 2940 wrote to memory of 1184	2940	cmd.exe	94
PID 2940 wrote to memory of 4556	2940	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\MasonClient (1).exe
"C:\Users\Admin\AppData\Local\Temp\MasonClient (1).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c chcp 65001 >nul && powershell -NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\mc_lc.ps1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1184
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\mc_lc.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_l22hxz5h.mj3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l22hxz5h.mj3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

mc_lc.ps1

Path C:\Users\Admin\AppData\Local\Temp\mc_lc.ps1
Size 773B
SHA256 90c2ec35850528fd459078e552a49e902b035fbc8f6d877071f25f28d5da52a9
MD5 767478346d3de0810f254ca5ca9525aa
SHA1 c9988232a121e630ca0f840dc9613e835ba870f6
SHA512 d686db10c79f62bd9821ee56040ff8c3e0c12f6f8d30c17bc1dbb299377b9ed44b3ac8a68a10405c34f14e40dd3123ff911801400b1dcc25d83b7e685ccad6a1
TLSH
T121012000526D4ADB7DD343BAFB4BA7277F8E004D5B152A40D5FC6F92B300E870A5AA5E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4556-7-0x0000013078300000-0x0000013078310000-memory.dmp

Download

memory/4556-6-0x0000013078300000-0x0000013078310000-memory.dmp

Download

memory/4556-13-0x0000013078310000-0x0000013078332000-memory.dmp

Download

memory/4556-17-0x0000013078300000-0x0000013078310000-memory.dmp

Download

memory/4556-19-0x0000013078300000-0x0000013078310000-memory.dmp

Download

memory/4556-20-0x000001307B7A0000-0x000001307B7CA000-memory.dmp

Download

memory/4556-21-0x000001307B7A0000-0x000001307B7C4000-memory.dmp

Download

memory/4920-0-0x00007FF7B27B0000-0x00007FF7B2862000-memory.dmp

Download

memory/4920-16-0x00007FF7B27B0000-0x00007FF7B2862000-memory.dmp

Download

memory/4920-24-0x00007FF7B27B0000-0x00007FF7B2862000-memory.dmp

Download