25eff2e6f410be792a5efbb554bbef565c8be2c4344c6dc028bc8f6fe357ae0a | Triage

Analysis

max time kernel
11s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 16:24

Sharing

Report Analysis Logs

General

Target

Cemu_2.1/Cemu.exe
Size

23.2MB
MD5

718f5752a0a65845845e6116cd05b101
SHA1

2dc6e35fccc2fa694b44856a9dea230ef6c408d7
SHA256

a743fe5b62d31db12092b994f04b03b66cbb48e94c7140efaa2e7bbd7205bf24
SHA512

d3ce3bafaa0b606cf0f965c13e968fa21463286ed5177c26b72cf7a0e8d5c8208283c488b08e2a199ddfcd8f7c3720ef0485ba126a40db0fd6cfe3f38a447490
SSDEEP

393216:4kJtsucyEmXGHJg9lIKYs7jZMIWds8uvfA/b0:4v3+fh3U0

Score

1^/10

Malware Config

Signatures

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\discord-460807638964371468\URL Protocol	Cemu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\discord-460807638964371468\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Cemu_2.1\\Cemu.exe"	Cemu.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\discord-460807638964371468\shell\open\command	Cemu.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\discord-460807638964371468\shell	Cemu.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\discord-460807638964371468\shell\open	Cemu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\discord-460807638964371468\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Cemu_2.1\\Cemu.exe"	Cemu.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\discord-460807638964371468	Cemu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\discord-460807638964371468\ = "URL:Run game 460807638964371468 protocol"	Cemu.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\discord-460807638964371468\DefaultIcon	Cemu.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
792	Cemu.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
792	Cemu.exe
792	Cemu.exe
792	Cemu.exe

C:\Users\Admin\AppData\Local\Temp\Cemu_2.1\Cemu.exe
"C:\Users\Admin\AppData\Local\Temp\Cemu_2.1\Cemu.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Cemu\settings.xml_334.tmp

Filesize
3KB

MD5
78b717ebd498edf0b7ba46a5f92e26ef

SHA1
7cbc88a1724dfc77be231c88d3f9a5a11ab58c7b

SHA256
3f64f2d963c1f04f42ef8a69675a9cda93f6c7617d608273880dc128372136c5

SHA512
d2930e021df521ed08c0ecd482d02533a248b1fa858d28616712906d31e006378963b385e17241b7f0927ec4a235881f321400a8cab79b8d79accb4d0fdefffe

Download Submit