Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
29/02/2024, 08:49
240229-krdddabh2z 329/02/2024, 08:48
240229-kqvahacb37 129/02/2024, 08:48
240229-kqj5jabg9w 128/02/2024, 22:46
240228-2pyd7sfg42 328/02/2024, 22:09
240228-127mzafb36 728/02/2024, 21:51
240228-1qvh9seg5w 828/02/2024, 21:48
240228-1n26bseg2x 828/02/2024, 21:48
240228-1nsxnaeg44 128/02/2024, 21:38
240228-1g8pjaee4z 428/02/2024, 21:02
240228-zvfegadg7z 9Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
28/02/2024, 22:46
Static task
static1
Behavioral task
behavioral1
Sample
ReShadePreset_by_GamboHub.ini
Resource
win11-20240221-en
General
-
Target
ReShadePreset_by_GamboHub.ini
-
Size
31KB
-
MD5
753ffc0af0fc2bb5dcd1dd978c2f0f52
-
SHA1
13fc43c0d9ae481a4462a3e15be2b41b2b7ba39f
-
SHA256
03021483f92262ea3b1582550ded8599d000638f50eb0990743a124dc7437c80
-
SHA512
24bf5ce5b842395178b8137d827af72a289f14b524220c2056e23ab225854dce742c7c72464644a50c4b5ba56da16417a422e51df46599cf168c9e8c6bb40052
-
SSDEEP
768:Eq8x58pWIcRU1ytawZwzZmQcpZJ6V0h2WkXW:EjrDtaIH6V0QWkm
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1637591879-962683004-3585269084-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1637591879-962683004-3585269084-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3132 OpenWith.exe