Analysis
- max time kernel
149s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
08/06/2026, 18:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ReshadeSetup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
ReshadeSetup.exe
Resource
win11-20260513-en
windows11-21h2-x64
5 signatures
150 seconds
General
- Target ReshadeSetup.exe
- Size 1018KB
- Sample260608-w9769aex6p
- SHA256 93f49fca0ba98d49a6f8f4ebfbc44fe9cee59837abee458bb5c894f416604636
- MD5 b96b67268bff22a7bce25e94b642c020
- SHA1 bac611bc5ded862c764619eed24937d719763d4c
- SHA512 a0acde46fb3707f786cb366256b3d97bbcfc60b905a98fa3f0282fe13ba2fd3d9611fb7ce76d4a5d5be5f533c79c8f731aa4b58a00d66b7c446572e11c3a350a
- SSDEEP 24576:XxTMq5qe9XPUk7cHxMPNz087Vr/iAk4FJ9JGD+W:6u7cH8VFJQ+W
- TLSH T1A6256BA2A6A511FDD1BBC135C7464A5AFAB5B4090B314BFB03A182D61F337E09B3E315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\System32\drivers\UMDF\winplatdiaghost.dll ReshadeSetup.exe - Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinPlatDiagHost\Parameters\ServiceDll = "%systemroot%\\system32\\drivers\\UMDF\\winplatdiaghost.dll" ReshadeSetup.exe - Modifies trusted root certificate store through registry 1 TTPs 4 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E5F6195DBEC2B0E57D64F9DED00128D862A54A98\Blob = 030000000100000014000000e5f6195dbec2b0e57d64f9ded00128d862a54a982000000001000000ae020000308202aa3082022fa003020102021455eb60f18c68fc2e015821ed10b82986a021cfca300a06082a8648ce3d0403033061310b3009060355040613025553310d300b06035504080c0455746168310d300b06035504070c044c65686931153013060355040a0c0c446967694365727420496e63311d301b06035504030c14446967694365727420476c6f62616c20526f6f74301e170d3236303231323231333635355a170d3338303131353233353935395a3061310b3009060355040613025553310d300b06035504080c0455746168310d300b06035504070c044c65686931153013060355040a0c0c446967694365727420496e63311d301b06035504030c14446967694365727420476c6f62616c20526f6f743076301006072a8648ce3d020106052b8104002203620004fd76e342d4963d946253211617c7eaf4ea947b7e0e15cd0bde652b944bde43a1953e27aa33a5da17dceab7a760feeedd6c8625857df4d81e88081e7fa7f01e28b2ccb2302a89280e32b66e6bb1b8cd96b66572bb8d8a43e48332d7c923bce46fa381a73081a4301f0603551d23041830168014433423625a456390b28a6b0f20dfea16634de7f4301d0603551d0e04160414433423625a456390b28a6b0f20dfea16634de7f430120603551d130101ff040830060101ff020101300e0603551d0f0101ff040403020186303e0603551d250101ff0434303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308300a06082a8648ce3d0403030369003066023100f31dd95a007effeac870d7140b779e832a6a6c4a83bc50b108a3b5d97da7c88b1b7d54befad76929f633c0b99ca9c298023100a14893ca204b7f8d4cabf99f47f7ff73fa81dbc983d79c2ab28f0bdcbf661769e5a2df34ccdf6d5b16307aa29b16ede5 ReshadeSetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E5F6195DBEC2B0E57D64F9DED00128D862A54A98\Blob = 0b000000010000002a00000044006900670069004300650072007400200047006c006f00620061006c00200052006f006f0074000000030000000100000014000000e5f6195dbec2b0e57d64f9ded00128d862a54a982000000001000000ae020000308202aa3082022fa003020102021455eb60f18c68fc2e015821ed10b82986a021cfca300a06082a8648ce3d0403033061310b3009060355040613025553310d300b06035504080c0455746168310d300b06035504070c044c65686931153013060355040a0c0c446967694365727420496e63311d301b06035504030c14446967694365727420476c6f62616c20526f6f74301e170d3236303231323231333635355a170d3338303131353233353935395a3061310b3009060355040613025553310d300b06035504080c0455746168310d300b06035504070c044c65686931153013060355040a0c0c446967694365727420496e63311d301b06035504030c14446967694365727420476c6f62616c20526f6f743076301006072a8648ce3d020106052b8104002203620004fd76e342d4963d946253211617c7eaf4ea947b7e0e15cd0bde652b944bde43a1953e27aa33a5da17dceab7a760feeedd6c8625857df4d81e88081e7fa7f01e28b2ccb2302a89280e32b66e6bb1b8cd96b66572bb8d8a43e48332d7c923bce46fa381a73081a4301f0603551d23041830168014433423625a456390b28a6b0f20dfea16634de7f4301d0603551d0e04160414433423625a456390b28a6b0f20dfea16634de7f430120603551d130101ff040830060101ff020101300e0603551d0f0101ff040403020186303e0603551d250101ff0434303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308300a06082a8648ce3d0403030369003066023100f31dd95a007effeac870d7140b779e832a6a6c4a83bc50b108a3b5d97da7c88b1b7d54befad76929f633c0b99ca9c298023100a14893ca204b7f8d4cabf99f47f7ff73fa81dbc983d79c2ab28f0bdcbf661769e5a2df34ccdf6d5b16307aa29b16ede5 ReshadeSetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\E30D83CFB9E60DE864DC9CB43DB707E966058481\Blob = 030000000100000014000000e30d83cfb9e60de864dc9cb43db707e9660584812000000001000000af020000308202ab30820230a0030201020214649f701e7ea70e67c5d2dcede6d40f2914fc466a300a06082a8648ce3d0403033061310b3009060355040613025553310d300b06035504080c0455746168310d300b06035504070c044c65686931153013060355040a0c0c446967694365727420496e63311d301b06035504030c14446967694365727420476c6f62616c20526f6f74301e170d3236303231323231333635355a170d3338303131353233353935395a3062310b3009060355040613025553310d300b06035504080c0455746168310d300b06035504070c044c65686931153013060355040a0c0c446967694365727420496e63311e301c06035504030c15446967694365727420436f6465205369676e696e673076301006072a8648ce3d020106052b8104002203620004610650460c68f891d87655b3dd64bc99cd0aaa6c3ef028095192284c9b90e7c4d6b6730e2e814445fb9f338fd0f4d62f59b66d9e26b99fdc181c0ab7fe37381e0a7f894299979f90c4c0e957d18042f457df135311acf65a45a5380169266e89a381a73081a4301f0603551d23041830168014433423625a456390b28a6b0f20dfea16634de7f4301d0603551d0e041604142500cac1562ec95501e0227c5f643cafb9b48c8130120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020186303e0603551d250101ff0434303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308300a06082a8648ce3d0403030369003066023100828b7cc7d8db271720e0247e367bbf8337394b5d00b47f8757f36f495525488ab8201c7eaf16fa3c42bd3673e1725f5e023100c36b2336ba7714d0673315af4eba1a920f3284a84e1f55504d0148a6957a70031cf9e680c7cde7d2197896787d6c652c ReshadeSetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\E30D83CFB9E60DE864DC9CB43DB707E966058481\Blob = 0b000000010000002c00000044006900670069004300650072007400200043006f006400650020005300690067006e0069006e0067000000030000000100000014000000e30d83cfb9e60de864dc9cb43db707e9660584812000000001000000af020000308202ab30820230a0030201020214649f701e7ea70e67c5d2dcede6d40f2914fc466a300a06082a8648ce3d0403033061310b3009060355040613025553310d300b06035504080c0455746168310d300b06035504070c044c65686931153013060355040a0c0c446967694365727420496e63311d301b06035504030c14446967694365727420476c6f62616c20526f6f74301e170d3236303231323231333635355a170d3338303131353233353935395a3062310b3009060355040613025553310d300b06035504080c0455746168310d300b06035504070c044c65686931153013060355040a0c0c446967694365727420496e63311e301c06035504030c15446967694365727420436f6465205369676e696e673076301006072a8648ce3d020106052b8104002203620004610650460c68f891d87655b3dd64bc99cd0aaa6c3ef028095192284c9b90e7c4d6b6730e2e814445fb9f338fd0f4d62f59b66d9e26b99fdc181c0ab7fe37381e0a7f894299979f90c4c0e957d18042f457df135311acf65a45a5380169266e89a381a73081a4301f0603551d23041830168014433423625a456390b28a6b0f20dfea16634de7f4301d0603551d0e041604142500cac1562ec95501e0227c5f643cafb9b48c8130120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020186303e0603551d250101ff0434303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308300a06082a8648ce3d0403030369003066023100828b7cc7d8db271720e0247e367bbf8337394b5d00b47f8757f36f495525488ab8201c7eaf16fa3c42bd3673e1725f5e023100c36b2336ba7714d0673315af4eba1a920f3284a84e1f55504d0148a6957a70031cf9e680c7cde7d2197896787d6c652c ReshadeSetup.exe - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E5F6195DBEC2B0E57D64F9DED00128D862A54A98 ReshadeSetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\E30D83CFB9E60DE864DC9CB43DB707E966058481 ReshadeSetup.exe - Suspicious use of AdjustPrivilegeToken 25 IoCs
description pid Process Token: SeDebugPrivilege 2832 ReshadeSetup.exe Token: SeIncreaseQuotaPrivilege 2832 ReshadeSetup.exe Token: SeSecurityPrivilege 2832 ReshadeSetup.exe Token: SeTakeOwnershipPrivilege 2832 ReshadeSetup.exe Token: SeLoadDriverPrivilege 2832 ReshadeSetup.exe Token: SeSystemProfilePrivilege 2832 ReshadeSetup.exe Token: SeSystemtimePrivilege 2832 ReshadeSetup.exe Token: SeProfSingleProcessPrivilege 2832 ReshadeSetup.exe Token: SeIncBasePriorityPrivilege 2832 ReshadeSetup.exe Token: SeCreatePagefilePrivilege 2832 ReshadeSetup.exe Token: SeBackupPrivilege 2832 ReshadeSetup.exe Token: SeRestorePrivilege 2832 ReshadeSetup.exe Token: SeShutdownPrivilege 2832 ReshadeSetup.exe Token: SeDebugPrivilege 2832 ReshadeSetup.exe Token: SeSystemEnvironmentPrivilege 2832 ReshadeSetup.exe Token: SeChangeNotifyPrivilege 2832 ReshadeSetup.exe Token: SeRemoteShutdownPrivilege 2832 ReshadeSetup.exe Token: SeUndockPrivilege 2832 ReshadeSetup.exe Token: SeManageVolumePrivilege 2832 ReshadeSetup.exe Token: SeImpersonatePrivilege 2832 ReshadeSetup.exe Token: SeCreateGlobalPrivilege 2832 ReshadeSetup.exe Token: 33 2832 ReshadeSetup.exe Token: 34 2832 ReshadeSetup.exe Token: 35 2832 ReshadeSetup.exe Token: 36 2832 ReshadeSetup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ReshadeSetup.exe"C:\Users\Admin\AppData\Local\Temp\ReshadeSetup.exe"1⤵
- Drops file in Drivers directory
- Server Software Component: Terminal Services DLL
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:2832
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WinPlatDiagGroup1⤵PID:1532