Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
3kiwi's rob...er.bat
windows10-2004-x64
1kiwi's rob...UI.exe
windows10-2004-x64
1kiwi's rob...PI.dll
windows10-2004-x64
1kiwi's rob...ut.dll
windows10-2004-x64
1kiwi's rob...UI.exe
windows10-2004-x64
1kiwi's rob...PI.dll
windows10-2004-x64
1kiwi's rob...ut.dll
windows10-2004-x64
1kiwi's rob...or.exe
windows10-2004-x64
1Analysis
-
max time kernel
151s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 14:47
Static task
static1
Behavioral task
behavioral1
Sample
kiwi's roblox shaders/Kiwi's Shaders Installer.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
kiwi's roblox shaders/dwmlutW10/DwmLutGUI.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
kiwi's roblox shaders/dwmlutW10/WindowsDisplayAPI.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral4
Sample
kiwi's roblox shaders/dwmlutW10/dwm_lut.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
kiwi's roblox shaders/dwmlutW11/DwmLutGUI.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral6
Sample
kiwi's roblox shaders/dwmlutW11/WindowsDisplayAPI.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
kiwi's roblox shaders/dwmlutW11/dwm_lut.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral8
Sample
kiwi's roblox shaders/nvPI/nvidiaProfileInspector.exe
Resource
win10v2004-20240426-en
General
-
Target
kiwi's roblox shaders/dwmlutW11/DwmLutGUI.exe
-
Size
49KB
-
MD5
63f7f666bfa56cacba56fc0129a0acd8
-
SHA1
8543846c7732b0c18a9683c0f1e325e73cfd1ef6
-
SHA256
0cd2d1a215c1e9e8e58a4c9186df8c9cd7b270aec96b841816eaac67988855e8
-
SHA512
061df5e4e13d2da6a5fc0fb4a70eb8fbb01c7d99213d3d2cacf1e80733a9d0cf6e483789b06f3d36fbbf1afda80b2e94f9b760767afb16246455fcf3d2c006de
-
SSDEEP
768:S0jb/3L2WTtbFKChJ0i5zv3RdNrICIB31CxEH8kSiJVDDDDDRVDDDDDsStYcFwVY:vBTVFKCP3z3NrICIBlT8kSi0+wVcl
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4856 DwmLutGUI.exe Token: SeDebugPrivilege 4856 DwmLutGUI.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 4856 DwmLutGUI.exe 4856 DwmLutGUI.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4856 DwmLutGUI.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\kiwi's roblox shaders\dwmlutW11\DwmLutGUI.exe"C:\Users\Admin\AppData\Local\Temp\kiwi's roblox shaders\dwmlutW11\DwmLutGUI.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4856
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:81⤵PID:3556