Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
06/07/2024, 08:13
240706-j4gqwsvaqg 706/07/2024, 08:09
240706-j2m5ws1hrr 706/07/2024, 08:06
240706-jzgkbsthna 7Analysis
-
max time kernel
195s -
max time network
200s -
platform
windows11-21h2_x64 -
resource
win11-20240704-en -
resource tags
arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system -
submitted
06/07/2024, 08:06
Static task
static1
Behavioral task
behavioral1
Sample
Bloxstrap.exe
Resource
win11-20240704-en
General
-
Target
Bloxstrap.exe
-
Size
8.6MB
-
MD5
299f66389937049af891ae9ec1c3a6d3
-
SHA1
1a1f4a2ef6d148101a83d59bf18cf5f76f46806a
-
SHA256
b38eef5655d6d82d526e9841bc95c67374e79e4ca2a15e642eb299c4e3ff24ff
-
SHA512
0c1cc9f8fb8ea3b8b2fc4b329baa12dae725ef2e2b79cfa0f51e3cc8e9913925fd6686fdb8767e87f55e68a9f8a1740285a7277ce19f6581fc28553f33dff653
-
SSDEEP
98304:D0d5D8d5DlTsed5DDlLpOcvGWD3pkMOYoHwfLk3vSmaR0+Mc4AN0edaAHDfysrTO:Dfs63vG0XObAbN0f
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 1684 RobloxPlayerBeta.exe 2888 Bloxstrap.exe 5340 RobloxPlayerBeta.exe -
Loads dropped DLL 2 IoCs
pid Process 1684 RobloxPlayerBeta.exe 5340 RobloxPlayerBeta.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
pid Process 1684 RobloxPlayerBeta.exe 5340 RobloxPlayerBeta.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 36 IoCs
pid Process 1684 RobloxPlayerBeta.exe 1684 RobloxPlayerBeta.exe 1684 RobloxPlayerBeta.exe 1684 RobloxPlayerBeta.exe 1684 RobloxPlayerBeta.exe 1684 RobloxPlayerBeta.exe 1684 RobloxPlayerBeta.exe 1684 RobloxPlayerBeta.exe 1684 RobloxPlayerBeta.exe 1684 RobloxPlayerBeta.exe 1684 RobloxPlayerBeta.exe 1684 RobloxPlayerBeta.exe 1684 RobloxPlayerBeta.exe 1684 RobloxPlayerBeta.exe 1684 RobloxPlayerBeta.exe 1684 RobloxPlayerBeta.exe 1684 RobloxPlayerBeta.exe 1684 RobloxPlayerBeta.exe 5340 RobloxPlayerBeta.exe 5340 RobloxPlayerBeta.exe 5340 RobloxPlayerBeta.exe 5340 RobloxPlayerBeta.exe 5340 RobloxPlayerBeta.exe 5340 RobloxPlayerBeta.exe 5340 RobloxPlayerBeta.exe 5340 RobloxPlayerBeta.exe 5340 RobloxPlayerBeta.exe 5340 RobloxPlayerBeta.exe 5340 RobloxPlayerBeta.exe 5340 RobloxPlayerBeta.exe 5340 RobloxPlayerBeta.exe 5340 RobloxPlayerBeta.exe 5340 RobloxPlayerBeta.exe 5340 RobloxPlayerBeta.exe 5340 RobloxPlayerBeta.exe 5340 RobloxPlayerBeta.exe -
Modifies registry class 53 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\roblox\shell\open\command Bloxstrap.exe Key created \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\roblox-studio-auth\shell Bloxstrap.exe Key created \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\.rbxl\Roblox.Place\ShellNew Bloxstrap.exe Set value (str) \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\roblox\URL Protocol Bloxstrap.exe Key created \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\roblox-player Bloxstrap.exe Set value (str) \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\roblox-studio-auth\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe" Bloxstrap.exe Set value (str) \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\Roblox.Place\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe,0" Bloxstrap.exe Key created \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\.rbxlx\Roblox.Place Bloxstrap.exe Set value (str) \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\roblox-studio\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe\" %1" Bloxstrap.exe Key created \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\.rbxlx\Roblox.Place\ShellNew Bloxstrap.exe Key created \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\roblox\shell Bloxstrap.exe Key created \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\roblox\shell\open Bloxstrap.exe Key created \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\roblox-studio Bloxstrap.exe Key created \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\roblox-studio\DefaultIcon Bloxstrap.exe Key created \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\Roblox.Place\shell\Open Bloxstrap.exe Key created \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\roblox Bloxstrap.exe Set value (str) \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\roblox\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe" Bloxstrap.exe Key created \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\roblox-studio-auth\DefaultIcon Bloxstrap.exe Key created \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\roblox-studio-auth\shell\open Bloxstrap.exe Set value (str) \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\Roblox.Place\shell\Open\ = "Open" Bloxstrap.exe Key created \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\roblox-player\DefaultIcon Bloxstrap.exe Set value (str) \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\roblox-player\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe\" %1" Bloxstrap.exe Set value (str) \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\roblox-studio-auth\ = "URL: Roblox Protocol" Bloxstrap.exe Key created \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\.rbxl Bloxstrap.exe Set value (str) \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\roblox\ = "URL: Roblox Protocol" Bloxstrap.exe Key created \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\roblox-player\shell\open\command Bloxstrap.exe Key created \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\roblox-studio\shell Bloxstrap.exe Key created \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\roblox-studio\shell\open Bloxstrap.exe Set value (str) \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\roblox-studio\ = "URL: Roblox Protocol" Bloxstrap.exe Key created \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\roblox-studio\shell\open\command Bloxstrap.exe Key created \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\Roblox.Place Bloxstrap.exe Set value (str) \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\roblox\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe\" %1" Bloxstrap.exe Key created \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\roblox-player\shell\open Bloxstrap.exe Key created \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\roblox-studio-auth Bloxstrap.exe Set value (str) \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\roblox-studio-auth\URL Protocol Bloxstrap.exe Key created \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\roblox\DefaultIcon Bloxstrap.exe Key created \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\.rbxl\Roblox.Place Bloxstrap.exe Set value (str) \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\Roblox.Place\ = "Roblox Place" Bloxstrap.exe Set value (str) \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\roblox-player\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe" Bloxstrap.exe Set value (str) \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\roblox-studio\URL Protocol Bloxstrap.exe Key created \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\Roblox.Place\shell\Open\command Bloxstrap.exe Set value (str) \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\Roblox.Place\shell\Open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe\" -ide \"%1\"" Bloxstrap.exe Set value (str) \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\.rbxlx\ = "Roblox.Place" Bloxstrap.exe Key created \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\Roblox.Place\DefaultIcon Bloxstrap.exe Set value (str) \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\roblox-player\ = "URL: Roblox Protocol" Bloxstrap.exe Set value (str) \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\roblox-player\URL Protocol Bloxstrap.exe Set value (str) \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\roblox-studio\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe" Bloxstrap.exe Key created \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\roblox-studio-auth\shell\open\command Bloxstrap.exe Set value (str) \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\roblox-studio-auth\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe\" %1" Bloxstrap.exe Key created \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\roblox-player\shell Bloxstrap.exe Key created \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\Roblox.Place\shell Bloxstrap.exe Set value (str) \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\.rbxl\ = "Roblox.Place" Bloxstrap.exe Key created \REGISTRY\USER\S-1-5-21-3234977864-427365696-1522832567-1000_Classes\.rbxlx Bloxstrap.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 1684 RobloxPlayerBeta.exe 1684 RobloxPlayerBeta.exe 1684 RobloxPlayerBeta.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe 5956 Bloxstrap.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 5956 Bloxstrap.exe Token: SeDebugPrivilege 2888 Bloxstrap.exe Token: SeBackupPrivilege 5820 svchost.exe Token: SeRestorePrivilege 5820 svchost.exe Token: SeSecurityPrivilege 5820 svchost.exe Token: SeTakeOwnershipPrivilege 5820 svchost.exe Token: 35 5820 svchost.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 5956 Bloxstrap.exe 2888 Bloxstrap.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 5956 Bloxstrap.exe 2888 Bloxstrap.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1684 RobloxPlayerBeta.exe 5340 RobloxPlayerBeta.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 5956 wrote to memory of 1684 5956 Bloxstrap.exe 81 PID 5956 wrote to memory of 1684 5956 Bloxstrap.exe 81 PID 2888 wrote to memory of 5340 2888 Bloxstrap.exe 90 PID 2888 wrote to memory of 5340 2888 Bloxstrap.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bloxstrap.exe"C:\Users\Admin\AppData\Local\Temp\Bloxstrap.exe"1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\RobloxPlayerBeta.exe"C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\RobloxPlayerBeta.exe" --app -channel production2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:1684
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4088
-
C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe"C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\RobloxPlayerBeta.exe"C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-1088f3c8e4a44cc7\RobloxPlayerBeta.exe" --app -channel production2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of UnmapMainImage
PID:5340
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SDRSVC1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5820
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.6MB
MD5299f66389937049af891ae9ec1c3a6d3
SHA11a1f4a2ef6d148101a83d59bf18cf5f76f46806a
SHA256b38eef5655d6d82d526e9841bc95c67374e79e4ca2a15e642eb299c4e3ff24ff
SHA5120c1cc9f8fb8ea3b8b2fc4b329baa12dae725ef2e2b79cfa0f51e3cc8e9913925fd6686fdb8767e87f55e68a9f8a1740285a7277ce19f6581fc28553f33dff653
-
Filesize
79B
MD5eab6dcc312473d43c2fa8cc41280d79c
SHA1b4e9ec7e579d06dfcaa5ac616de2751308a153c3
SHA2560a27d3c9100ab7ab6f03c45daeb0f0cd586f3aeb59daf7986e853f9614e954fe
SHA5121ce0fdc237110d644bcc8238f184554f25813ccf7142fd312ce96fbb6659081db677b04485bf66d52100136da6bb9688e48b1287455725c7b4950153aa2a4595
-
Filesize
6KB
MD59404c52d6f311da02d65d4320bfebb59
SHA10b5b5c2e7c631894953d5828fec06bdf6adba55f
SHA256c9775e361392877d1d521d0450a5368ee92d37dc542bc5e514373c9d5003f317
SHA51222aa1acbcdcf56f571170d9c32fd0d025c50936387203a7827dbb925f352d2bc082a8a79db61c2d1f1795ad979e93367c80205d9141b73d806ae08fa089837c4
-
Filesize
721B
MD5f011944453781cf1c88a4f9d9509dca9
SHA1b688124e816f52711fe3330e3fcb6bacbb7e25ab
SHA256e704d460b5abb39ce2946028a171c70bc10f0bf884ff0efc1e84ba28fbf32447
SHA512c8a17fe56f395c5b1d327362e0270898fff4eb1e7cb7a5418d0b4fe2dbe5673f484706d92c89c9cfa53ff7835e7c3b8560cb28c1953b5a9147d3a53d3f56c2a3
-
Filesize
269B
MD5dff1d867431eaf46c70f10ad4505d2bb
SHA111658cdee33ad806b652cbcf06ea6d044cc99dcb
SHA2566d5c985854eaab4139580143a3610501b9ba711b878d7c1b044a12998cfe0961
SHA5127c5de6eb76670c6975bb35d37c2bdcedc1b49bda78e6034c6cead8b1f843b7faa177223153dbc461502bfc808b697541771d2361c9dc173a9d5789988af90744
-
Filesize
16.7MB
MD56dfc619af29b1bce46cc55f2f1dd82e4
SHA1e39ccb51a7e456df074f505193f7371046a51c29
SHA25672e88ee5395bc66d252042e2fa975a39cff8c3ed2152ba661aacf6b997ba755d
SHA512379e38a57b17cc417e949ff4ead79980d0b6829f33774d5b0e7a2e36c9247686b12a3c0915123f68e891310a594672ade26d247946213919b7ab972ec6eae495