Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
03-12-2024 10:11
General
-
Target
COMSurrogate.exe
-
Size
164KB
-
MD5
77334f046a50530cdc6e585e59165264
-
SHA1
657a584eafe86df36e719526d445b570e135d217
-
SHA256
eb6c487307c52793e0bc4d6a74770bbea2322f32edc466b25abacec3dd0e9c08
-
SHA512
97936dd74d7eef8d69dae0d83b6d1554bd54d5302b5b2ff886ff66c040b083d7d086089de12b57a491cf7269a7d076e4d2a52839aaac519386b77297bc3a5c90
-
SSDEEP
3072:DlxjOCto1mb719Iz9cIp23YWMBjk3RzYISn7ApmHVVjKu:5xjD+sF9IKIgnwkRUbAI1F
Score
10/10
Malware Config
Signatures
-
TA505
Cybercrime group active since 2015, responsible for families like Dridex and Locky.
-
Ta505 family
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\COMSurrogate.exe"C:\Users\Admin\AppData\Local\Temp\COMSurrogate.exe"1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
184KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB