Overview
overview
3Static
static
3ULTIMATE K....0.exe
windows7-x64
1ULTIMATE K....0.exe
windows10-2004-x64
1ULTIMATE K...or.exe
windows7-x64
3ULTIMATE K...or.exe
windows10-2004-x64
1ULTIMATE K...gs.url
windows7-x64
1ULTIMATE K...gs.url
windows10-2004-x64
1ULTIMATE K...ar.url
windows7-x64
1ULTIMATE K...ar.url
windows10-2004-x64
1ULTIMATE K...ns.url
windows7-x64
1ULTIMATE K...ns.url
windows10-2004-x64
1ULTIMATE K...th.url
windows7-x64
1ULTIMATE K...th.url
windows10-2004-x64
1ULTIMATE K...gs.url
windows7-x64
1ULTIMATE K...gs.url
windows10-2004-x64
1ULTIMATE K...ps.url
windows7-x64
1ULTIMATE K...ps.url
windows10-2004-x64
1ULTIMATE K...y).url
windows7-x64
1ULTIMATE K...y).url
windows10-2004-x64
1ULTIMATE K...PI.dll
windows7-x64
1ULTIMATE K...PI.dll
windows10-2004-x64
1ULTIMATE K...ut.dll
windows7-x64
1ULTIMATE K...ut.dll
windows10-2004-x64
1ULTIMATE K...UI.exe
windows7-x64
3ULTIMATE K...UI.exe
windows10-2004-x64
1ULTIMATE K...PI.dll
windows7-x64
1ULTIMATE K...PI.dll
windows10-2004-x64
1ULTIMATE K...ut.dll
windows7-x64
1ULTIMATE K...ut.dll
windows10-2004-x64
1ULTIMATE K...UI.exe
windows7-x64
1ULTIMATE K...UI.exe
windows10-2004-x64
1ULTIMATE K...PI.dll
windows7-x64
1ULTIMATE K...PI.dll
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/09/2024, 18:27
Static task
static1
Behavioral task
behavioral1
Sample
ULTIMATE KASU/ Install DEBLOATED GPU drivers/NVCleanstall_1.16.0.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
ULTIMATE KASU/ Install DEBLOATED GPU drivers/NVCleanstall_1.16.0.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
ULTIMATE KASU/ NVIDIA Profile Inspector settings/nvidiaProfileInspector.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral4
Sample
ULTIMATE KASU/ NVIDIA Profile Inspector settings/nvidiaProfileInspector.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
ULTIMATE KASU/Basic Boost/1 Display Settings.url
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
ULTIMATE KASU/Basic Boost/1 Display Settings.url
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
ULTIMATE KASU/Basic Boost/10 Game bar.url
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral8
Sample
ULTIMATE KASU/Basic Boost/10 Game bar.url
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
ULTIMATE KASU/Basic Boost/2 Notifications.url
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
ULTIMATE KASU/Basic Boost/2 Notifications.url
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
ULTIMATE KASU/Basic Boost/4 Bluetooth.url
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
ULTIMATE KASU/Basic Boost/4 Bluetooth.url
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
ULTIMATE KASU/Basic Boost/6 Color Settings.url
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral14
Sample
ULTIMATE KASU/Basic Boost/6 Color Settings.url
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
ULTIMATE KASU/Basic Boost/8 Apps.url
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
ULTIMATE KASU/Basic Boost/8 Apps.url
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
ULTIMATE KASU/Basic Boost/Background Apps (win 10 only).url
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
ULTIMATE KASU/Basic Boost/Background Apps (win 10 only).url
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
ULTIMATE KASU/Color Setts (Windows 10 ONLY)/LUT GUI (windows 10 only)/WindowsDisplayAPI.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
ULTIMATE KASU/Color Setts (Windows 10 ONLY)/LUT GUI (windows 10 only)/WindowsDisplayAPI.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
ULTIMATE KASU/Color Setts (Windows 10 ONLY)/LUT GUI (windows 10 only)/dwm_lut.dll
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral22
Sample
ULTIMATE KASU/Color Setts (Windows 10 ONLY)/LUT GUI (windows 10 only)/dwm_lut.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
ULTIMATE KASU/DWMLUT (COLORS)/LUT GUI ( windows 11 only )/DwmLutGUI.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral24
Sample
ULTIMATE KASU/DWMLUT (COLORS)/LUT GUI ( windows 11 only )/DwmLutGUI.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
ULTIMATE KASU/DWMLUT (COLORS)/LUT GUI ( windows 11 only )/WindowsDisplayAPI.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral26
Sample
ULTIMATE KASU/DWMLUT (COLORS)/LUT GUI ( windows 11 only )/WindowsDisplayAPI.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
ULTIMATE KASU/DWMLUT (COLORS)/LUT GUI ( windows 11 only )/dwm_lut.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral28
Sample
ULTIMATE KASU/DWMLUT (COLORS)/LUT GUI ( windows 11 only )/dwm_lut.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
ULTIMATE KASU/DWMLUT (COLORS)/LUT GUI (windows 10 only)/DwmLutGUI.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral30
Sample
ULTIMATE KASU/DWMLUT (COLORS)/LUT GUI (windows 10 only)/DwmLutGUI.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
ULTIMATE KASU/DWMLUT (COLORS)/LUT GUI (windows 10 only)/WindowsDisplayAPI.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral32
Sample
ULTIMATE KASU/DWMLUT (COLORS)/LUT GUI (windows 10 only)/WindowsDisplayAPI.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
ULTIMATE KASU/DWMLUT (COLORS)/LUT GUI (windows 10 only)/DwmLutGUI.exe
-
Size
41KB
-
MD5
3b4757e1a391ad8afe84a433ea044335
-
SHA1
1d04873b685e26377ed7be16f1dea43f149dd07e
-
SHA256
5bd14307f344f802ba2a43f18b118cd15fd2056c2e01dfeaa7b16afbe637e280
-
SHA512
a4f95040ebb2839b6f87dacd687e22110e6f02c5a7032f4d9645c20b4bfe58cd8fb39eec9e1c59f4cb7fb6e6a23aa89e06d16713fa5fed337f0b192353574a3a
-
SSDEEP
768:Xu3QbzTyrqZmr3dYzBA9dMFciV5yQIXXFABQJVDDDDDRVDDDDDsetYcFwVc6K:XaQXurqZmr3dEKjit5yQIXVABQ0iwVcl
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1540 DwmLutGUI.exe Token: SeDebugPrivilege 1540 DwmLutGUI.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1540 DwmLutGUI.exe 1540 DwmLutGUI.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ULTIMATE KASU\DWMLUT (COLORS)\LUT GUI (windows 10 only)\DwmLutGUI.exe"C:\Users\Admin\AppData\Local\Temp\ULTIMATE KASU\DWMLUT (COLORS)\LUT GUI (windows 10 only)\DwmLutGUI.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1540