General
- Target ReShade Pro Forza Horizon 6 (2K-4K)-246-1-1780245579.rar
- Size 7KB
- Sample260620-e51g6sc19l
- SHA256 6f0838ba970a0b1081d6e8ea3600775cf325c7e517455786d108c752c9d01338
- MD5 b188b652db71d243e115bfbc7ce6d353
- SHA1 b879b3ecdc71640f9558899c783bd9b05ff30450
- SHA512 b5a17f5a8b3a741404c58291df34e2903813fc1eb9a089d35fc2c2b1d3ef883907709183a5ffe2f251312c32e4794c2c1f9195c9a8f955afddc5ff6c944d3e90
- SSDEEP 192:DmDXwhUL6AJAOqWdsS4iXyATlygKeUdE5bQvF:SsS6WAyd4+yATAgbSF
- TLSH T193E18E6866CA4A21CBBD032AB385972829550BBBE3DF6CB4446712564B51E20C7C2FE3
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
ReShade Pro Forza Horizon 6 (2K-4K)-246-1-1780245579.rar
Resource
win11-20260513-en
22 signatures
900 seconds
Behavioral task
behavioral2
Sample
ReShade Pro 2k-4k Forza Horizon 6.ini
Resource
win11-20260513-en
3 signatures
900 seconds
Malware Config
Targets
-
- Target ReShade Pro Forza Horizon 6 (2K-4K)-246-1-1780245579.rar
- Size 7KB
- SHA256 6f0838ba970a0b1081d6e8ea3600775cf325c7e517455786d108c752c9d01338
- MD5 b188b652db71d243e115bfbc7ce6d353
- SHA1 b879b3ecdc71640f9558899c783bd9b05ff30450
- SHA512 b5a17f5a8b3a741404c58291df34e2903813fc1eb9a089d35fc2c2b1d3ef883907709183a5ffe2f251312c32e4794c2c1f9195c9a8f955afddc5ff6c944d3e90
- SSDEEP 192:DmDXwhUL6AJAOqWdsS4iXyATlygKeUdE5bQvF:SsS6WAyd4+yATAgbSF
- TLSH T193E18E6866CA4A21CBBD032AB385972829550BBBE3DF6CB4446712564B51E20C7C2FE3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Modifies WinLogon for persistence
-
UAC bypass
-
Disables RegEdit via registry modification
-
Loads dropped DLL
-
Drops desktop.ini file(s)
-
Sets desktop wallpaper using registry
-
- Target ReShade Pro 2k-4k Forza Horizon 6.ini
- Size 21KB
- SHA256 7229e2ea9915c41c2d6a3f42129c63774845a9c6ec2763e76f24b3d1cf7fb108
- MD5 c473908a81bab1e7ef9c5781ca2fcc40
- SHA1 54e802528a585f5b910bcdc0572f4b60bb9e85b5
- SHA512 16c45bb386c65eb786a3dc8ad78b215564b8a3b2402d5ea6e933f9d526c0d0c5befaeef3b7227f838a345a3a7fc7e50e40016b6149767320a33fd2889c51b1ea
- SSDEEP 384:U02CTarQU4QmfYhiWs3e6jqTuVQPYKRDvbQc2jwuv/xSTSTNjj2cHmu4:IrrQ2mffWs3Xjqfkjwuv/xSTSTda84
- TLSH T18CA209DBDB2909C6FC42A18EECF679F018F6359F8CCC96545DD8202A7CE1E4D150A926
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3