Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

1

ReShadePre...ub.ini

windows11-21h2-x64

9

Resubmissions

29/02/2024, 08:49

240229-krdddabh2z 3

29/02/2024, 08:48

240229-kqvahacb37 1

29/02/2024, 08:48

240229-kqj5jabg9w 1

28/02/2024, 22:46

240228-2pyd7sfg42 3

28/02/2024, 22:09

240228-127mzafb36 7

28/02/2024, 21:51

240228-1qvh9seg5w 8

28/02/2024, 21:48

240228-1n26bseg2x 8

28/02/2024, 21:48

240228-1nsxnaeg44 1

28/02/2024, 21:38

240228-1g8pjaee4z 4

28/02/2024, 21:02

240228-zvfegadg7z 9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ReShadePreset_by_GamboHub.ini

  • Size

    31KB

  • Sample

    240228-zvfegadg7z

  • MD5

    753ffc0af0fc2bb5dcd1dd978c2f0f52

  • SHA1

    13fc43c0d9ae481a4462a3e15be2b41b2b7ba39f

  • SHA256

    03021483f92262ea3b1582550ded8599d000638f50eb0990743a124dc7437c80

  • SHA512

    24bf5ce5b842395178b8137d827af72a289f14b524220c2056e23ab225854dce742c7c72464644a50c4b5ba56da16417a422e51df46599cf168c9e8c6bb40052

  • SSDEEP

    768:Eq8x58pWIcRU1ytawZwzZmQcpZJ6V0h2WkXW:EjrDtaIH6V0QWkm

Score
9/10
discoverypersistenceransomware

Malware Config

Targets

    • Target

      ReShadePreset_by_GamboHub.ini

    • Size

      31KB

    • MD5

      753ffc0af0fc2bb5dcd1dd978c2f0f52

    • SHA1

      13fc43c0d9ae481a4462a3e15be2b41b2b7ba39f

    • SHA256

      03021483f92262ea3b1582550ded8599d000638f50eb0990743a124dc7437c80

    • SHA512

      24bf5ce5b842395178b8137d827af72a289f14b524220c2056e23ab225854dce742c7c72464644a50c4b5ba56da16417a422e51df46599cf168c9e8c6bb40052

    • SSDEEP

      768:Eq8x58pWIcRU1ytawZwzZmQcpZJ6V0h2WkXW:EjrDtaIH6V0QWkm

    Score
    9/10
    discoverypersistenceransomware

    • Renames multiple (124) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Registers COM server for autorun

      persistence

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks