Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
3kiwi's rob...er.bat
windows10-2004-x64
1kiwi's rob...UI.exe
windows10-2004-x64
1kiwi's rob...PI.dll
windows10-2004-x64
1kiwi's rob...ut.dll
windows10-2004-x64
1kiwi's rob...UI.exe
windows10-2004-x64
1kiwi's rob...PI.dll
windows10-2004-x64
1kiwi's rob...ut.dll
windows10-2004-x64
1kiwi's rob...or.exe
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 14:47
Static task
static1
Behavioral task
behavioral1
Sample
kiwi's roblox shaders/Kiwi's Shaders Installer.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
kiwi's roblox shaders/dwmlutW10/DwmLutGUI.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
kiwi's roblox shaders/dwmlutW10/WindowsDisplayAPI.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral4
Sample
kiwi's roblox shaders/dwmlutW10/dwm_lut.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
kiwi's roblox shaders/dwmlutW11/DwmLutGUI.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral6
Sample
kiwi's roblox shaders/dwmlutW11/WindowsDisplayAPI.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
kiwi's roblox shaders/dwmlutW11/dwm_lut.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral8
Sample
kiwi's roblox shaders/nvPI/nvidiaProfileInspector.exe
Resource
win10v2004-20240426-en
General
-
Target
kiwi's roblox shaders/dwmlutW10/DwmLutGUI.exe
-
Size
41KB
-
MD5
3b4757e1a391ad8afe84a433ea044335
-
SHA1
1d04873b685e26377ed7be16f1dea43f149dd07e
-
SHA256
5bd14307f344f802ba2a43f18b118cd15fd2056c2e01dfeaa7b16afbe637e280
-
SHA512
a4f95040ebb2839b6f87dacd687e22110e6f02c5a7032f4d9645c20b4bfe58cd8fb39eec9e1c59f4cb7fb6e6a23aa89e06d16713fa5fed337f0b192353574a3a
-
SSDEEP
768:Xu3QbzTyrqZmr3dYzBA9dMFciV5yQIXXFABQJVDDDDDRVDDDDDsetYcFwVc6K:XaQXurqZmr3dEKjit5yQIXVABQ0iwVcl
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3952 DwmLutGUI.exe Token: SeDebugPrivilege 3952 DwmLutGUI.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 3952 DwmLutGUI.exe 3952 DwmLutGUI.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\kiwi's roblox shaders\dwmlutW10\DwmLutGUI.exe"C:\Users\Admin\AppData\Local\Temp\kiwi's roblox shaders\dwmlutW10\DwmLutGUI.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3952
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4340,i,17096020621006928097,15544233752327415349,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:81⤵PID:1448