Analysis

  • max time kernel
    197s
  • max time network
    32s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    03-05-2023 21:09

General

  • Target

    publish/Ryujinx.exe

  • Size

    48.4MB

  • MD5

    147149000fc338265020784f710db689

  • SHA1

    cf030c46b6ba79a7d53f4b1d52afbe445648152b

  • SHA256

    506e62f16c34a710b17304ee1285ea44c47265e0aadfb02bae4021e54753331b

  • SHA512

    fe9e658fea4f08d240269d479152f1337530d8f7f5210e2d09a2e2fb97360a6589c92c54ace0e49af3d0fd27a21d327da053139188bd82cd21dc882551762ea9

  • SSDEEP

    393216:2atW17zli9by6plIMlavMV9+qOOTvq49GR:Tsk9yOxvAnIvq49GR

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\publish\Ryujinx.exe
    "C:\Users\Admin\AppData\Local\Temp\publish\Ryujinx.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1540

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Ryujinx\bis\system\save\8000000000000000\ExtraData1

    Filesize

    512B

    MD5

    952afbd8945b9b1f4f8413ec53141a5a

    SHA1

    4d6a925f3ac481b7efeb11c59fd0458227337363

    SHA256

    759109dbb35dd1936f35de6c695815cc1667bcec35c072d397952bf269380c95

    SHA512

    dad35365fcc79332536598f8d1b5616f8287fb9e256451787223a4c41098cd5291583e74e80d33202c6bb4012a5316c041014abfeae3b342c96bb3cc6602c37e

  • memory/1540-55-0x00000000048F0000-0x0000000004A68000-memory.dmp

    Filesize

    1.5MB

  • memory/1540-56-0x0000000070EC0000-0x0000000070FF0000-memory.dmp

    Filesize

    1.2MB

  • memory/1540-57-0x000000006CF40000-0x000000006CF51000-memory.dmp

    Filesize

    68KB

  • memory/1540-59-0x0000000061440000-0x000000006145C000-memory.dmp

    Filesize

    112KB

  • memory/1540-58-0x0000000068DC0000-0x0000000068EBE000-memory.dmp

    Filesize

    1016KB

  • memory/1540-60-0x0000000064940000-0x0000000064955000-memory.dmp

    Filesize

    84KB

  • memory/1540-61-0x0000000064F80000-0x0000000064FCE000-memory.dmp

    Filesize

    312KB

  • memory/1540-62-0x0000000068F40000-0x0000000068F86000-memory.dmp

    Filesize

    280KB

  • memory/1540-63-0x00000000693C0000-0x0000000069473000-memory.dmp

    Filesize

    716KB

  • memory/1540-64-0x00000000626C0000-0x00000000626DA000-memory.dmp

    Filesize

    104KB

  • memory/1540-65-0x0000000061600000-0x0000000061712000-memory.dmp

    Filesize

    1.1MB

  • memory/1540-66-0x00000000649C0000-0x0000000064AE5000-memory.dmp

    Filesize

    1.1MB

  • memory/1540-67-0x0000000061CC0000-0x0000000061CE8000-memory.dmp

    Filesize

    160KB

  • memory/1540-68-0x0000000066000000-0x000000006610B000-memory.dmp

    Filesize

    1.0MB

  • memory/1540-69-0x0000000069140000-0x000000006918E000-memory.dmp

    Filesize

    312KB

  • memory/1540-70-0x0000000070540000-0x000000007056D000-memory.dmp

    Filesize

    180KB

  • memory/1540-71-0x000000006FC40000-0x000000006FDA5000-memory.dmp

    Filesize

    1.4MB

  • memory/1540-73-0x0000000062E80000-0x0000000062E9F000-memory.dmp

    Filesize

    124KB

  • memory/1540-74-0x0000000063500000-0x00000000635AC000-memory.dmp

    Filesize

    688KB

  • memory/1540-76-0x000000006B740000-0x000000006B750000-memory.dmp

    Filesize

    64KB

  • memory/1540-75-0x0000000067F00000-0x0000000067F57000-memory.dmp

    Filesize

    348KB

  • memory/1540-79-0x000000006F740000-0x000000006F770000-memory.dmp

    Filesize

    192KB

  • memory/1540-78-0x0000000002DD0000-0x0000000002DFB000-memory.dmp

    Filesize

    172KB

  • memory/1540-80-0x00000000048F0000-0x0000000004A68000-memory.dmp

    Filesize

    1.5MB

  • memory/1540-77-0x000000006D880000-0x000000006DA24000-memory.dmp

    Filesize

    1.6MB

  • memory/1540-72-0x0000000068B40000-0x0000000068B80000-memory.dmp

    Filesize

    256KB

  • memory/1540-106-0x0000000066400000-0x0000000066A43000-memory.dmp

    Filesize

    6.3MB

  • memory/1540-107-0x0000000070EC0000-0x0000000070FF0000-memory.dmp

    Filesize

    1.2MB

  • memory/1540-108-0x000000006CF40000-0x000000006CF51000-memory.dmp

    Filesize

    68KB

  • memory/1540-109-0x0000000068DC0000-0x0000000068EBE000-memory.dmp

    Filesize

    1016KB

  • memory/1540-112-0x0000000064F80000-0x0000000064FCE000-memory.dmp

    Filesize

    312KB

  • memory/1540-111-0x0000000064940000-0x0000000064955000-memory.dmp

    Filesize

    84KB

  • memory/1540-113-0x0000000068F40000-0x0000000068F86000-memory.dmp

    Filesize

    280KB

  • memory/1540-110-0x0000000061440000-0x000000006145C000-memory.dmp

    Filesize

    112KB

  • memory/1540-114-0x00000000693C0000-0x0000000069473000-memory.dmp

    Filesize

    716KB

  • memory/1540-115-0x00000000626C0000-0x00000000626DA000-memory.dmp

    Filesize

    104KB

  • memory/1540-116-0x0000000061600000-0x0000000061712000-memory.dmp

    Filesize

    1.1MB

  • memory/1540-117-0x00000000649C0000-0x0000000064AE5000-memory.dmp

    Filesize

    1.1MB

  • memory/1540-119-0x0000000066000000-0x000000006610B000-memory.dmp

    Filesize

    1.0MB

  • memory/1540-120-0x0000000069140000-0x000000006918E000-memory.dmp

    Filesize

    312KB

  • memory/1540-121-0x0000000070540000-0x000000007056D000-memory.dmp

    Filesize

    180KB

  • memory/1540-122-0x000000006FC40000-0x000000006FDA5000-memory.dmp

    Filesize

    1.4MB

  • memory/1540-123-0x0000000068B40000-0x0000000068B80000-memory.dmp

    Filesize

    256KB

  • memory/1540-124-0x0000000062E80000-0x0000000062E9F000-memory.dmp

    Filesize

    124KB

  • memory/1540-125-0x0000000063500000-0x00000000635AC000-memory.dmp

    Filesize

    688KB

  • memory/1540-126-0x0000000067F00000-0x0000000067F57000-memory.dmp

    Filesize

    348KB

  • memory/1540-118-0x0000000061CC0000-0x0000000061CE8000-memory.dmp

    Filesize

    160KB

  • memory/1540-130-0x000000006F740000-0x000000006F770000-memory.dmp

    Filesize

    192KB

  • memory/1540-131-0x00000000048F0000-0x0000000004A68000-memory.dmp

    Filesize

    1.5MB

  • memory/1540-132-0x0000000066C40000-0x0000000066C4F000-memory.dmp

    Filesize

    60KB

  • memory/1540-133-0x000000006D240000-0x000000006D288000-memory.dmp

    Filesize

    288KB

  • memory/1540-134-0x00000000038C0000-0x00000000038D9000-memory.dmp

    Filesize

    100KB

  • memory/1540-136-0x0000000065880000-0x0000000065898000-memory.dmp

    Filesize

    96KB

  • memory/1540-137-0x000000006E7C0000-0x000000006E7DC000-memory.dmp

    Filesize

    112KB

  • memory/1540-138-0x00000000676C0000-0x00000000676E1000-memory.dmp

    Filesize

    132KB

  • memory/1540-139-0x000000006BD40000-0x000000006BD69000-memory.dmp

    Filesize

    164KB

  • memory/1540-140-0x000000006A380000-0x000000006A390000-memory.dmp

    Filesize

    64KB

  • memory/1540-135-0x0000000068AC0000-0x0000000068AD1000-memory.dmp

    Filesize

    68KB