Analysis
- max time kernel
136s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
05/07/2026, 12:16
General
- Target sunwukongs.exe
- Size 3.1MB
- Sample260705-pfhaeaf16q
- SHA256 d172a7d40b90b60d152c59ceab774b9568ad90f82705fe4dc0ed92f9cb62d450
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
- Drops file in Windows directory 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies registry class 40 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
- Suspicious use of AdjustPrivilegeToken 32 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 41 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\sunwukongs.exe"C:\Users\Admin\AppData\Local\Temp\sunwukongs.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-fre --no-default-browser-check --disable-background-networking --disable-sync --disable-gpu --mute-audio --new-window2⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xb8,0x134,0x7ffdb590c728,0x7ffdb590c734,0x7ffdb590c7403⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1624,i,2196806133636975503,758908546139918707,262144 --field-trial-handle=1992,i,11655694511536418467,959786478340272505,262144 --variations-seed-version --mojo-platform-channel-handle=1988 /prefetch:23⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=1332,i,14757570436380931678,18032684108433013632,524288 --field-trial-handle=1992,i,11655694511536418467,959786478340272505,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=2228,i,8591315821508955386,13660325965196704730,524288 --field-trial-handle=1992,i,11655694511536418467,959786478340272505,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:133⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3064,i,15455971988362937641,17518676868787618913,2097152 --field-trial-handle=1992,i,11655694511536418467,959786478340272505,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3084,i,4212100389693494914,5221375853910225737,2097152 --field-trial-handle=1992,i,11655694511536418467,959786478340272505,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4592,i,838893495333580929,14325771676529200476,2097152 --field-trial-handle=1992,i,11655694511536418467,959786478340272505,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4764,i,12975748108688740002,294540129817502362,524288 --field-trial-handle=1992,i,11655694511536418467,959786478340272505,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4908,i,1694445289116305455,4167629193878261034,524288 --field-trial-handle=1992,i,11655694511536418467,959786478340272505,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:143⤵
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
SCT Auditing Pending Reports
Local State
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
memory/4108-1892-0x000001EA03A30000-0x000001EA03A50000-memory.dmp
memory/4108-1893-0x000001EA13E70000-0x000001EA13F70000-memory.dmp
memory/4108-1895-0x000001EA03C90000-0x000001EA03CB0000-memory.dmp
memory/4108-1908-0x000001EA14660000-0x000001EA14680000-memory.dmp
memory/4108-1887-0x000001EA001E0000-0x000001EA002E0000-memory.dmp
memory/4108-1885-0x000001EA001E0000-0x000001EA002E0000-memory.dmp
memory/4108-1886-0x000001EA001E0000-0x000001EA002E0000-memory.dmp
memory/5992-1014-0x00000000025F0000-0x0000000002685000-memory.dmp
memory/5992-980-0x00000000025F0000-0x0000000002685000-memory.dmp
memory/5992-921-0x00000000025F0000-0x0000000002685000-memory.dmp
memory/5992-951-0x00000000025F0000-0x0000000002685000-memory.dmp
memory/5992-981-0x00000000025F0000-0x0000000002685000-memory.dmp
memory/5992-997-0x00000000025F0000-0x0000000002685000-memory.dmp
memory/5992-0-0x00000000025F0000-0x0000000002685000-memory.dmp
memory/5992-1026-0x00000000025F0000-0x0000000002685000-memory.dmp
memory/5992-1049-0x00000000025F0000-0x0000000002685000-memory.dmp
memory/5992-1085-0x00000000025F0000-0x0000000002685000-memory.dmp
memory/5992-1122-0x00000000025F0000-0x0000000002685000-memory.dmp
memory/5992-1152-0x00000000025F0000-0x0000000002685000-memory.dmp
memory/5992-1147-0x00000000025F0000-0x0000000002685000-memory.dmp
memory/5992-1133-0x00000000025F0000-0x0000000002685000-memory.dmp
memory/5992-1140-0x00000000025F0000-0x0000000002685000-memory.dmp
memory/5992-1121-0x00000000025F0000-0x0000000002685000-memory.dmp
memory/5992-1113-0x00000000025F0000-0x0000000002685000-memory.dmp
memory/5992-1092-0x00000000025F0000-0x0000000002685000-memory.dmp
memory/5992-1099-0x00000000025F0000-0x0000000002685000-memory.dmp
memory/5992-1077-0x00000000025F0000-0x0000000002685000-memory.dmp
memory/5992-1070-0x00000000025F0000-0x0000000002685000-memory.dmp
memory/5992-1063-0x00000000025F0000-0x0000000002685000-memory.dmp
memory/5992-1056-0x00000000025F0000-0x0000000002685000-memory.dmp
memory/5992-1042-0x00000000025F0000-0x0000000002685000-memory.dmp
memory/5992-1035-0x00000000025F0000-0x0000000002685000-memory.dmp
memory/5992-1034-0x00000000025F0000-0x0000000002685000-memory.dmp
memory/5992-1004-0x00000000025F0000-0x0000000002685000-memory.dmp
memory/5992-990-0x00000000025F0000-0x0000000002685000-memory.dmp
memory/5992-974-0x00000000025F0000-0x0000000002685000-memory.dmp
memory/5992-912-0x000000007FCD0000-0x000000007FCD1000-memory.dmp
memory/5992-967-0x00000000025F0000-0x0000000002685000-memory.dmp
memory/5992-945-0x00000000025F0000-0x0000000002685000-memory.dmp
memory/5992-938-0x00000000025F0000-0x0000000002685000-memory.dmp
memory/5992-931-0x00000000025F0000-0x0000000002685000-memory.dmp
memory/5992-923-0x000000007FCD0000-0x000000007FCD1000-memory.dmp
memory/5992-910-0x000000007FCD0000-0x000000007FCD1000-memory.dmp
memory/5992-1167-0x000000007FE10000-0x000000007FE7E000-memory.dmp
memory/5992-1182-0x00000000027F0000-0x0000000002893000-memory.dmp
memory/5992-1181-0x00000000025A0000-0x00000000025A3000-memory.dmp
memory/5992-1180-0x000000007FE90000-0x000000007FE91000-memory.dmp
memory/5992-1425-0x00000000027F0000-0x0000000002893000-memory.dmp
memory/5992-1424-0x00000000027F0000-0x0000000002893000-memory.dmp
memory/5992-909-0x000000007FCD0000-0x000000007FCD1000-memory.dmp
memory/5992-918-0x000000007FCD0000-0x000000007FCD1000-memory.dmp
memory/5992-915-0x000000007FCD0000-0x000000007FCD1000-memory.dmp
memory/5992-1583-0x00000000027F0000-0x0000000002893000-memory.dmp
memory/5992-1584-0x00000000027F0000-0x0000000002893000-memory.dmp
memory/5992-1861-0x00000000027F0000-0x0000000002893000-memory.dmp
memory/5992-1862-0x00000000027F0000-0x0000000002893000-memory.dmp
memory/5992-1863-0x00000000027F0000-0x0000000002893000-memory.dmp
memory/5992-1864-0x00000000027F0000-0x0000000002893000-memory.dmp
memory/5992-889-0x0000000076F08000-0x0000000076F09000-memory.dmp
memory/5992-4-0x000000007FCD0000-0x000000007FCD1000-memory.dmp
memory/5992-6-0x000000007FCD0000-0x000000007FCD1000-memory.dmp
memory/5992-7-0x000000007FCD0000-0x000000007FCD1000-memory.dmp
memory/5992-11-0x000000007FCD0000-0x000000007FCD1000-memory.dmp
memory/5992-9-0x000000007FCD0000-0x000000007FCD1000-memory.dmp
memory/5992-15-0x000000007FCD0000-0x000000007FCD1000-memory.dmp
memory/5992-24-0x000000007FCD0000-0x000000007FCD1000-memory.dmp
memory/5992-1-0x000000007FCD0000-0x000000007FCD1000-memory.dmp