Analysis

  • max time kernel
    125s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    22/04/2023, 22:24

General

  • Target

    DeSmuME_0.9.13_x64.exe

  • Size

    38.3MB

  • MD5

    2cc20871992a412fc0d50a68b0461100

  • SHA1

    54339be244cc7ab8072652f77613634fa2cb178d

  • SHA256

    1ca4e771b92f38a1cef4fc2a61f7d729a638f94d0e56f7948eeeb472000cf32c

  • SHA512

    7be15c5fedb11bf63896ce866baf7377fc26eb622c583cb7589ff17f1890f0fc04fda1c450da848a48aecfb34f8efd0d285006ca73d3a4d09e74c4d525dd2ae9

  • SSDEEP

    49152:8Xvil5QafIWd0uPXKA1avMfa5W3hhlDXGA5mdwFrMvOE1EoIKtHtwqVOyQuq+mik:O+sMS5KGFOsIDp5wuVPkfFSh/hsmQZ4

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 28 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DeSmuME_0.9.13_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\DeSmuME_0.9.13_x64.exe"
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:920
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x148
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1656

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\DeSmuME\desmume.ini

    Filesize

    18B

    MD5

    b8d4fc464e021b73b7281d921592fa85

    SHA1

    864d8c96deff54c6107a28bb7d8a276e338319cb

    SHA256

    712541cddf2d5d5731c6de8b23d2d73d825de8b903eacd23cfc1daccf2eec830

    SHA512

    a741db0b60d02a79e03bf5cd161f69483b665eddfef0bee635b6fd34aef7342d18f95aedacfb14f56391866aadf7a117171de2fe831e4221e4507f47ed786926

  • C:\Users\Admin\AppData\Local\DeSmuME\desmume.ini

    Filesize

    77B

    MD5

    6a7131f6c415e1f44ece098076341bc5

    SHA1

    eab6547c4d306763081770f0a72971de39c97f95

    SHA256

    f4b73f5e24c19dc212dce8cd35a0a06ea8c7f781e59c1746349516afe0962c38

    SHA512

    f58209ef6844302764ece9c3acd94a0234f23a4048d4e2e2e1bf3332275d112dae2b8afa75922406eef084ffe525217e6c897ee7d3b268e3b5f987c710e96bd4

  • memory/920-85-0x00000000084D0000-0x00000000084E0000-memory.dmp

    Filesize

    64KB

  • memory/920-86-0x00000000084C0000-0x00000000084C1000-memory.dmp

    Filesize

    4KB