Analysis
-
max time kernel
84s -
max time network
37s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05-03-2024 11:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Bloxstrap-v2.5.4.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
300 seconds
Behavioral task
behavioral2
Sample
Bloxstrap-v2.5.4.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
300 seconds
General
-
Target
Bloxstrap-v2.5.4.exe
-
Size
7.6MB
-
MD5
dbb820772caf0003967ef0f269fbdeb1
-
SHA1
31992bd4977a7dfeba67537a2da6c9ca64bc304c
-
SHA256
b2ac1e407ed3ecd7c7faa6de929a68fb51145662cf793c40b69eb59295bba6bc
-
SHA512
e8ac879c7198dffb78bc6ee4ad49b5de40a5a7dbbda53d427d0a034941487d13c8bb2b8d590a1fcdd81cd6abb8f21fdfcd52924eb00c45a42ee06c1e4b3d590f
-
SSDEEP
98304:XNd5DSd5DxTsed5D2ZT00UuOYoHwfLk3vSmaR0+Mc4AN0edaAHDfysrTl1:X+sdtObAbN0u
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation Bloxstrap-v2.5.4.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2172 Bloxstrap-v2.5.4.exe Token: SeDebugPrivilege 5092 taskmgr.exe Token: SeSystemProfilePrivilege 5092 taskmgr.exe Token: SeCreateGlobalPrivilege 5092 taskmgr.exe Token: 33 5092 taskmgr.exe Token: SeIncBasePriorityPrivilege 5092 taskmgr.exe -
Suspicious use of FindShellTrayWindow 45 IoCs
pid Process 2172 Bloxstrap-v2.5.4.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe -
Suspicious use of SendNotifyMessage 44 IoCs
pid Process 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe 5092 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.5.4.exe"C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.5.4.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2172
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5092