d8900901ceb3cc4275c53066f9bc8ccf685e1737ad3cb7392bc19c63a3118661

Analysis

max time kernel
76s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2023, 21:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Ryujinx.exe
Size

48.5MB
MD5

c312ce73b59d776cd98780cbcbb65542
SHA1

1ed7f7561a8e6f8d697451d64d3e6c7930112e31
SHA256

d8900901ceb3cc4275c53066f9bc8ccf685e1737ad3cb7392bc19c63a3118661
SHA512

002fe7b10399354fd7cd227a2ccca83d9ca19f2734e777a816b2bf26f1ba3cef62cc17a94bb32f9c195a53cb1d117b9c4388948c1ed1b69ffbdb2ecf14ce05f6
SSDEEP

393216:mlk6fuOyE4GIMlavMmzTVx6QPo1CSM1vM:2B6E1xITmf1CSM1vM

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000\Control Panel\International\Geo\Nation	Ryujinx.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
396	1192	WerFault.exe	82

C:\Users\Admin\AppData\Local\Temp\Ryujinx.exe
"C:\Users\Admin\AppData\Local\Temp\Ryujinx.exe"
1⤵
- Checks computer location settings
PID:1192
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1192 -s 1308
  2⤵
  - Program crash
  PID:396

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 368 -p 1192 -ip 1192
1⤵
PID:2316

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads