b3018e5af87adae943f0ae088db91c10b511d28470b4fbbadba4289263de2a86

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 23:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b3018e5af87adae943f0ae088db91c10b511d28470b4fbbadba4289263de2a86.exe
Size 6.0MB
Sample260719-3rw5labv3t
SHA256 b3018e5af87adae943f0ae088db91c10b511d28470b4fbbadba4289263de2a86
MD5 f7ca38f5701177bffd21929abe88ac79
SHA1 19da35e39160007188e484b8d7810cbca1b934b0
SHA512 05b04472570ee4cc8b52be2b415fe3954bf41c3e273d84885c8daf93e25eccfb8c8dd36e666717522ae68d2eafe25e0b5e98e1b0e9a6a84c0174fcae198af876
SSDEEP 98304:o2wvB0nCbA/TR6TG4uWVtdgvgkE1wsYalcd/nResJoFZnTcaTLyAzNFh7:o2SsR+u8Gvgop1n8s2F54oLyEFh
TLSH
T1625633288839675EC63F167818A2075ADF7B322556B45BD904F0C6221F10FA787BAF7C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3344	powershell.exe
3344	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2768	COM Surrogate.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\runtime\COM Surrogate.exe	b3018e5af87adae943f0ae088db91c10b511d28470b4fbbadba4289263de2a86.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer	b3018e5af87adae943f0ae088db91c10b511d28470b4fbbadba4289263de2a86.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
932	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3344	powershell.exe
3344	powershell.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	3344	powershell.exe
Token: SeIncreaseQuotaPrivilege	3344	powershell.exe
Token: SeSecurityPrivilege	3344	powershell.exe
Token: SeTakeOwnershipPrivilege	3344	powershell.exe
Token: SeLoadDriverPrivilege	3344	powershell.exe
Token: SeSystemProfilePrivilege	3344	powershell.exe
Token: SeSystemtimePrivilege	3344	powershell.exe
Token: SeProfSingleProcessPrivilege	3344	powershell.exe
Token: SeIncBasePriorityPrivilege	3344	powershell.exe
Token: SeCreatePagefilePrivilege	3344	powershell.exe
Token: SeBackupPrivilege	3344	powershell.exe
Token: SeRestorePrivilege	3344	powershell.exe
Token: SeShutdownPrivilege	3344	powershell.exe
Token: SeDebugPrivilege	3344	powershell.exe
Token: SeSystemEnvironmentPrivilege	3344	powershell.exe
Token: SeRemoteShutdownPrivilege	3344	powershell.exe
Token: SeUndockPrivilege	3344	powershell.exe
Token: SeManageVolumePrivilege	3344	powershell.exe
Token: 33	3344	powershell.exe
Token: 34	3344	powershell.exe
Token: 35	3344	powershell.exe
Token: 36	3344	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 3344	5000	b3018e5af87adae943f0ae088db91c10b511d28470b4fbbadba4289263de2a86.exe	90
PID 5000 wrote to memory of 932	5000	b3018e5af87adae943f0ae088db91c10b511d28470b4fbbadba4289263de2a86.exe	93
PID 5000 wrote to memory of 2768	5000	b3018e5af87adae943f0ae088db91c10b511d28470b4fbbadba4289263de2a86.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b3018e5af87adae943f0ae088db91c10b511d28470b4fbbadba4289263de2a86.exe
"C:\Users\Admin\AppData\Local\Temp\b3018e5af87adae943f0ae088db91c10b511d28470b4fbbadba4289263de2a86.exe"
1⤵
- Drops file in Program Files directory
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files\runtime'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3344
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /create /tn "COM Surrogate Task" /tr "C:\Program Files\runtime\COM Surrogate.exe" /sc onlogon /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:932
- C:\Program Files\runtime\COM Surrogate.exe
  "C:\Program Files\runtime\COM Surrogate.exe"
  2⤵
  - Executes dropped EXE
  PID:2768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

COM Surrogate.exe

Path C:\Program Files\runtime\COM Surrogate.exe
Size 6.0MB
SHA256 43022961cb401814a9899e46269705b3b55c1b364cccfd291445b809304e872a
MD5 cb545a86d5c42c0c903ee065462bb9c9
SHA1 6b6cf8156f38ce4884f29f6cb9029e546db183b8
SHA512 a1f2e14480e11ad3555a0604ac492b5b1829955399de87883b3aaea8bb99bf7a4c1a4e7ddab0a344310dcfc05b93fcc074f6f231e046a79372ee4dda17cb8dd4
SSDEEP 49152:gil9Wh8OwxW1yJasiFC2gAq5zcQsXnAdSsmkf60+Ko6D8j85EPPvPHeJBa5mqmC:i8naDhpnAdS842dE3vPwM51
TLSH
T12B564B47FCA545E8C0AED2358A629253BA71BC485B3423D73B50F7382F76BD46AB9340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3344-12-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/3344-15-0x00000267EC760000-0x00000267EC77E000-memory.dmp

Download

memory/3344-5-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/3344-6-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/3344-7-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/3344-8-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/3344-9-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/3344-10-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/3344-11-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/3344-0-0x00007FFCF55BF000-0x00007FFCF55C0000-memory.dmp

Download

memory/3344-3-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/3344-17-0x00000267EC780000-0x00000267EC78A000-memory.dmp

Download

memory/3344-16-0x00000267EC9B0000-0x00000267ECA62000-memory.dmp

Download

memory/3344-18-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/3344-19-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/3344-20-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/3344-21-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/3344-23-0x00000267EC7A9000-0x00000267EC7AF000-memory.dmp

Download

memory/3344-24-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/3344-4-0x00000267EC6D0000-0x00000267EC6F2000-memory.dmp

Download

memory/3344-29-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download