158d2172657a3f5f2116364adcb8083084011ce7fa256d7e74078a6d9b97708b | Triage

Analysis

max time kernel
19s
max time network
24s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/02/2024, 23:56

Sharing

Report Analysis Logs

General

Target

Cemu.exe
Size

22.8MB
MD5

42082106d07833517859d44284354a4a
SHA1

78030d1a3eef53acc5903e77a99f4c10c2544878
SHA256

158d2172657a3f5f2116364adcb8083084011ce7fa256d7e74078a6d9b97708b
SHA512

619589939f580db216c4feb9fce139ec45eb87f4e8849ce527170efe7e9b212cb9a412d794c9d505cc09d483e1022cb4ebfb7a3f358fbbdef24d18cead192268
SSDEEP

393216:Jcx0YbKSIVGsahOBSdbOWOtucEHCmqYAh+byBm4EQL9bF:JxaRh4EQV

Score

1^/10

Malware Config

Signatures

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\discord-460807638964371468\DefaultIcon	Cemu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\discord-460807638964371468\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Cemu.exe"	Cemu.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\discord-460807638964371468\shell\open\command	Cemu.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\discord-460807638964371468\shell\open	Cemu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\discord-460807638964371468\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Cemu.exe"	Cemu.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\discord-460807638964371468	Cemu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\discord-460807638964371468\ = "URL:Run game 460807638964371468 protocol"	Cemu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\discord-460807638964371468\URL Protocol	Cemu.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\discord-460807638964371468\shell	Cemu.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1468	Cemu.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1468	Cemu.exe
1468	Cemu.exe
1468	Cemu.exe

C:\Users\Admin\AppData\Local\Temp\Cemu.exe
"C:\Users\Admin\AppData\Local\Temp\Cemu.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads