56f137e052d0df3f53d4399e5a91afc7494a1a33dc2a734a3ef211d0e43b31fc | Triage

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 21:01

Sharing

Report Analysis Logs

General

Target

DeSmuME_0.9.11_x86.exe
Size

3.0MB
MD5

4dbb54975ebb94fe9f72ca741752b51c
SHA1

97c381a0d6862a26ea619dad2470a82e2fa512fd
SHA256

56f137e052d0df3f53d4399e5a91afc7494a1a33dc2a734a3ef211d0e43b31fc
SHA512

5f260267b1e6c2bff992f9471d6c9b660b708961e737d358f106adca3a7a803979c228a941de4d2990b3025207a3dec1d9eca87c80611f75c1270cb6a3d8ffe7
SSDEEP

49152:fBIuLYWxQ5J0t8Bo8Dd95d0FZTspOZf6L:fpLYHD0t8C0d95dw4

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3212	DeSmuME_0.9.11_x86.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2536	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2536	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3212	DeSmuME_0.9.11_x86.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3212	DeSmuME_0.9.11_x86.exe
1632	OpenWith.exe

C:\Users\Admin\AppData\Local\Temp\DeSmuME_0.9.11_x86.exe
"C:\Users\Admin\AppData\Local\Temp\DeSmuME_0.9.11_x86.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3212

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x50c 0x2dc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2536

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\DeSmuME\desmume.ini

Filesize
77B

MD5
6a7131f6c415e1f44ece098076341bc5

SHA1
eab6547c4d306763081770f0a72971de39c97f95

SHA256
f4b73f5e24c19dc212dce8cd35a0a06ea8c7f781e59c1746349516afe0962c38

SHA512
f58209ef6844302764ece9c3acd94a0234f23a4048d4e2e2e1bf3332275d112dae2b8afa75922406eef084ffe525217e6c897ee7d3b268e3b5f987c710e96bd4

Download Submit