597fe7dd458e4ca03b2ff8bc3c7875de51d4e5ab607490dec82fdcc380386f69

Analysis

max time kernel
151s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 04:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Surge-Setup-1.0.2.exe
Size 117.8MB
Sample260719-fb3acaex2t
SHA256 597fe7dd458e4ca03b2ff8bc3c7875de51d4e5ab607490dec82fdcc380386f69
MD5 4ccd307797ac9b5ed87dcc6e969f3e08
SHA1 66dd34d8e947d119079780c150e4313312c83552
SHA512 7271790342378b11e7119a5f85bba05f3861f06b875c2d32cc163bdd1cfffccff22a296627b46e34653deeedbe13bb33199c48fac71fdad9aa63d4afdf8861d1
SSDEEP 3145728:rwT+Lg2Xzl1oscJfNfUkddXF98mlCH0wbYXBs1n:I+Lbjo7tNvdz6mbcQs1n
TLSH
T1BE483332D7ACBB3DC8AD6DBD9B515F9484400EE66664C48AC1FDF79C63FA3406E06821
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
4572	Surge.exe
2280	Surge.exe
4320	Surge.exe
3276	Surge.exe
1740	Surge.exe

Loads dropped DLL 19 IoCs

pid	Process
3448	Surge-Setup-1.0.2.exe
3448	Surge-Setup-1.0.2.exe
3448	Surge-Setup-1.0.2.exe
3448	Surge-Setup-1.0.2.exe
3448	Surge-Setup-1.0.2.exe
3448	Surge-Setup-1.0.2.exe
3448	Surge-Setup-1.0.2.exe
3448	Surge-Setup-1.0.2.exe
3448	Surge-Setup-1.0.2.exe
3448	Surge-Setup-1.0.2.exe
3448	Surge-Setup-1.0.2.exe
3448	Surge-Setup-1.0.2.exe
4320	Surge.exe
4320	Surge.exe
4320	Surge.exe
3276	Surge.exe
4320	Surge.exe
4320	Surge.exe
4320	Surge.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1848	powershell.exe
4692	powershell.exe
1960	powershell.exe
1980	powershell.exe
6020	powershell.exe
5560	powershell.exe
416	powershell.exe
5688	powershell.exe
236	powershell.exe
1212	powershell.exe
3480	powershell.exe
2964	powershell.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5164	powershell.exe
1920	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2924	cmd.exe
2940	cmd.exe
1180	cmd.exe
3904	cmd.exe
5476	cmd.exe
1016	cmd.exe
3796	cmd.exe
2952	cmd.exe
5472	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Surge-Setup-1.0.2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Surge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Surge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Surge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Surge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Surge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Surge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Surge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Surge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Surge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Surge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Surge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Surge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Surge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Surge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Surge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Surge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Surge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Surge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Surge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Surge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Surge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Surge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Surge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Surge.exe

Gathers network information 2 TTPs 4 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4280	NETSTAT.EXE
5652	NETSTAT.EXE
4384	NETSTAT.EXE
4916	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5164	powershell.exe
5164	powershell.exe
4692	powershell.exe
4692	powershell.exe
3448	Surge-Setup-1.0.2.exe
3448	Surge-Setup-1.0.2.exe
236	powershell.exe
236	powershell.exe
1960	powershell.exe
1960	powershell.exe
1960	powershell.exe
1212	powershell.exe
1212	powershell.exe
1980	powershell.exe
1980	powershell.exe
1212	powershell.exe
1980	powershell.exe
3480	powershell.exe
3480	powershell.exe
416	powershell.exe
416	powershell.exe
5688	powershell.exe
5688	powershell.exe
6020	powershell.exe
6020	powershell.exe
5560	powershell.exe
5560	powershell.exe
416	powershell.exe
3480	powershell.exe
6020	powershell.exe
5688	powershell.exe
2964	powershell.exe
2964	powershell.exe
2964	powershell.exe
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5164	powershell.exe
Token: SeDebugPrivilege	4692	powershell.exe
Token: SeDebugPrivilege	236	powershell.exe
Token: SeIncreaseQuotaPrivilege	236	powershell.exe
Token: SeSecurityPrivilege	236	powershell.exe
Token: SeTakeOwnershipPrivilege	236	powershell.exe
Token: SeLoadDriverPrivilege	236	powershell.exe
Token: SeSystemProfilePrivilege	236	powershell.exe
Token: SeSystemtimePrivilege	236	powershell.exe
Token: SeProfSingleProcessPrivilege	236	powershell.exe
Token: SeIncBasePriorityPrivilege	236	powershell.exe
Token: SeCreatePagefilePrivilege	236	powershell.exe
Token: SeBackupPrivilege	236	powershell.exe
Token: SeRestorePrivilege	236	powershell.exe
Token: SeShutdownPrivilege	236	powershell.exe
Token: SeDebugPrivilege	236	powershell.exe
Token: SeSystemEnvironmentPrivilege	236	powershell.exe
Token: SeRemoteShutdownPrivilege	236	powershell.exe
Token: SeUndockPrivilege	236	powershell.exe
Token: SeManageVolumePrivilege	236	powershell.exe
Token: 33	236	powershell.exe
Token: 34	236	powershell.exe
Token: 35	236	powershell.exe
Token: 36	236	powershell.exe
Token: SeSecurityPrivilege	3448	Surge-Setup-1.0.2.exe
Token: SeDebugPrivilege	1960	powershell.exe
Token: SeDebugPrivilege	1212	powershell.exe
Token: SeDebugPrivilege	1980	powershell.exe
Token: SeShutdownPrivilege	4572	Surge.exe
Token: SeCreatePagefilePrivilege	4572	Surge.exe
Token: SeShutdownPrivilege	4572	Surge.exe
Token: SeCreatePagefilePrivilege	4572	Surge.exe
Token: SeIncreaseQuotaPrivilege	1212	powershell.exe
Token: SeSecurityPrivilege	1212	powershell.exe
Token: SeTakeOwnershipPrivilege	1212	powershell.exe
Token: SeLoadDriverPrivilege	1212	powershell.exe
Token: SeSystemProfilePrivilege	1212	powershell.exe
Token: SeSystemtimePrivilege	1212	powershell.exe
Token: SeProfSingleProcessPrivilege	1212	powershell.exe
Token: SeIncBasePriorityPrivilege	1212	powershell.exe
Token: SeCreatePagefilePrivilege	1212	powershell.exe
Token: SeBackupPrivilege	1212	powershell.exe
Token: SeRestorePrivilege	1212	powershell.exe
Token: SeShutdownPrivilege	1212	powershell.exe
Token: SeDebugPrivilege	1212	powershell.exe
Token: SeSystemEnvironmentPrivilege	1212	powershell.exe
Token: SeRemoteShutdownPrivilege	1212	powershell.exe
Token: SeUndockPrivilege	1212	powershell.exe
Token: SeManageVolumePrivilege	1212	powershell.exe
Token: 33	1212	powershell.exe
Token: 34	1212	powershell.exe
Token: 35	1212	powershell.exe
Token: 36	1212	powershell.exe
Token: SeIncreaseQuotaPrivilege	1980	powershell.exe
Token: SeSecurityPrivilege	1980	powershell.exe
Token: SeTakeOwnershipPrivilege	1980	powershell.exe
Token: SeLoadDriverPrivilege	1980	powershell.exe
Token: SeSystemProfilePrivilege	1980	powershell.exe
Token: SeSystemtimePrivilege	1980	powershell.exe
Token: SeProfSingleProcessPrivilege	1980	powershell.exe
Token: SeIncBasePriorityPrivilege	1980	powershell.exe
Token: SeCreatePagefilePrivilege	1980	powershell.exe
Token: SeBackupPrivilege	1980	powershell.exe
Token: SeRestorePrivilege	1980	powershell.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 5164	3448	Surge-Setup-1.0.2.exe	89
PID 3448 wrote to memory of 4692	3448	Surge-Setup-1.0.2.exe	91
PID 3448 wrote to memory of 236	3448	Surge-Setup-1.0.2.exe	93
PID 4572 wrote to memory of 1016	4572	Surge.exe	99
PID 1016 wrote to memory of 4072	1016	cmd.exe	101
PID 4572 wrote to memory of 1960	4572	Surge.exe	102
PID 4572 wrote to memory of 3796	4572	Surge.exe	103
PID 3796 wrote to memory of 4280	3796	cmd.exe	106
PID 4280 wrote to memory of 5472	4280	NETSTAT.EXE	107
PID 5472 wrote to memory of 2372	5472	cmd.exe	108
PID 4572 wrote to memory of 1212	4572	Surge.exe	109
PID 4572 wrote to memory of 1980	4572	Surge.exe	110
PID 4572 wrote to memory of 2280	4572	Surge.exe	113
PID 4572 wrote to memory of 4320	4572	Surge.exe	114
PID 4572 wrote to memory of 4320	4572	Surge.exe	114
PID 4572 wrote to memory of 3276	4572	Surge.exe	115
PID 4572 wrote to memory of 3276	4572	Surge.exe	115
PID 4572 wrote to memory of 2924	4572	Surge.exe	116
PID 2924 wrote to memory of 5652	2924	cmd.exe	118
PID 5652 wrote to memory of 2940	5652	NETSTAT.EXE	120
PID 2940 wrote to memory of 1540	2940	cmd.exe	121
PID 4572 wrote to memory of 5688	4572	Surge.exe	122
PID 4572 wrote to memory of 416	4572	Surge.exe	123
PID 4572 wrote to memory of 3480	4572	Surge.exe	124
PID 4572 wrote to memory of 6020	4572	Surge.exe	125
PID 4572 wrote to memory of 5560	4572	Surge.exe	129
PID 4572 wrote to memory of 2964	4572	Surge.exe	132
PID 4572 wrote to memory of 1920	4572	Surge.exe	136
PID 4572 wrote to memory of 1740	4572	Surge.exe	138
PID 4572 wrote to memory of 1740	4572	Surge.exe	138
PID 4572 wrote to memory of 1180	4572	Surge.exe	141
PID 1180 wrote to memory of 4384	1180	cmd.exe	143
PID 4384 wrote to memory of 3904	4384	NETSTAT.EXE	144
PID 3904 wrote to memory of 5576	3904	cmd.exe	145
PID 4572 wrote to memory of 1848	4572	Surge.exe	146
PID 4572 wrote to memory of 5476	4572	Surge.exe	148
PID 5476 wrote to memory of 964	5476	cmd.exe	150
PID 4572 wrote to memory of 2952	4572	Surge.exe	151
PID 2952 wrote to memory of 4916	2952	cmd.exe	153

C:\Users\Admin\AppData\Local\Temp\Surge-Setup-1.0.2.exe
"C:\Users\Admin\AppData\Local\Temp\Surge-Setup-1.0.2.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5164
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4692
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\Surge', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:236

C:\Users\Admin\AppData\Local\Programs\Surge\Surge.exe
"C:\Users\Admin\AppData\Local\Programs\Surge\Surge.exe"
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "chcp"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1016
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:4072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command [bool](([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator))
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netstat -r"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\Windows\system32\NETSTAT.EXE
    netstat -r
    3⤵
    - Gathers network information
    - Suspicious use of WriteProcessMemory
    PID:4280
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5472
    - - C:\Windows\system32\ROUTE.EXE
        
        C:\Windows\system32\route.exe print
        5⤵
        
        PID:2372
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | ConvertTo-Json -compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1212
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance Win32_PerfRawData_Tcpip_NetworkInterface | select Name,BytesReceivedPersec,PacketsReceivedErrors,PacketsReceivedDiscarded,BytesSentPersec,PacketsOutboundErrors,PacketsOutboundDiscarded | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1980
- C:\Users\Admin\AppData\Local\Programs\Surge\Surge.exe
  "C:\Users\Admin\AppData\Local\Programs\Surge\Surge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\surge" --standard-schemes=app --secure-schemes=app --cors-schemes=app --fetch-schemes=app --service-worker-schemes=app --streaming-schemes=app --code-cache-schemes=app --field-trial-handle=2020,i,12513280647128824738,12834212413552517863,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2028,i,14044517235842297239,6072453930993042089,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2068 /prefetch:11
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Users\Admin\AppData\Local\Programs\Surge\Surge.exe
  "C:\Users\Admin\AppData\Local\Programs\Surge\Surge.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\surge" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2020,i,12513280647128824738,12834212413552517863,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2028,i,14044517235842297239,6072453930993042089,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4320
- C:\Users\Admin\AppData\Local\Programs\Surge\Surge.exe
  "C:\Users\Admin\AppData\Local\Programs\Surge\Surge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\surge" --standard-schemes=app --secure-schemes=app --cors-schemes=app --fetch-schemes=app --service-worker-schemes=app --streaming-schemes=app --code-cache-schemes=app --app-user-model-id=com.surge.app --app-path="C:\Users\Admin\AppData\Local\Programs\Surge\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1784435916699717 --launch-time-ticks=617817485 --field-trial-handle=2020,i,12513280647128824738,12834212413552517863,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2028,i,14044517235842297239,6072453930993042089,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netstat -r"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Windows\system32\NETSTAT.EXE
    netstat -r
    3⤵
    - Gathers network information
    - Suspicious use of WriteProcessMemory
    PID:5652
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2940
    - - C:\Windows\system32\ROUTE.EXE
        
        C:\Windows\system32\route.exe print
        5⤵
        
        PID:1540
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance Win32_PageFileUsage | Select AllocatedBaseSize, CurrentUsage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5688
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-WmiObject Win32_logicaldisk | select Access,Caption,FileSystem,FreeSpace,Size | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:416
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | ConvertTo-Json -compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3480
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance Win32_PerfRawData_Tcpip_NetworkInterface | select Name,BytesReceivedPersec,PacketsReceivedErrors,PacketsReceivedDiscarded,BytesSentPersec,PacketsOutboundErrors,PacketsOutboundDiscarded | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:6020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Programs\Surge\resources\app.asar\main\helpers\startup-query.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5560
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | ConvertTo-Json -compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $titles = Get-Process -Id 968,588,1052,1120,1264,1352,1432,1456,1480,1520,1580,1684,1708,1768,1788,1972,2040,1288,2148,2156,2196,2336,2432,2464 -ErrorAction SilentlyContinue | Where-Object { $_.MainWindowTitle } | Sort-Object { $_.CPU } -Descending | Select-Object -First 1 -ExpandProperty MainWindowTitle if ($titles) { $titles } "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:1920
- C:\Users\Admin\AppData\Local\Programs\Surge\Surge.exe
  "C:\Users\Admin\AppData\Local\Programs\Surge\Surge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --user-data-dir="C:\Users\Admin\AppData\Roaming\surge" --standard-schemes=app --secure-schemes=app --cors-schemes=app --fetch-schemes=app --service-worker-schemes=app --streaming-schemes=app --code-cache-schemes=app --field-trial-handle=2020,i,12513280647128824738,12834212413552517863,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2028,i,14044517235842297239,6072453930993042089,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3904 /prefetch:14
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netstat -r"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1180
- - C:\Windows\system32\NETSTAT.EXE
    netstat -r
    3⤵
    - Gathers network information
    - Suspicious use of WriteProcessMemory
    PID:4384
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3904
    - - C:\Windows\system32\ROUTE.EXE
        
        C:\Windows\system32\route.exe print
        5⤵
        
        PID:5576
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance Win32_NetworkAdapter | fl *; echo '#-#-#-#';Get-CimInstance Win32_NetworkAdapterConfiguration | fl DHCPEnabled"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5476
- - C:\Windows\system32\netsh.exe
    netsh lan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:4916

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact