Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
104s -
max time network
106s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
01/10/2024, 19:41
Static task
static1
Behavioral task
behavioral1
Sample
Bloxstrap-v2.7.0.exe
Resource
win11-20240802-en
General
-
Target
Bloxstrap-v2.7.0.exe
-
Size
10.1MB
-
MD5
2c752edef5b0aa0962a3e01c4c82a2fa
-
SHA1
9c3afd1c63f2b0dbdc2dc487709471222d2cb81e
-
SHA256
891846bf656253ca1cdd28584a28681e9604e2a03d74cd6b99313e3bff11daf8
-
SHA512
04d25fe7d40c8c320ffc545a038ad6ea458df6a8a552b0e0393b369a03b9bf273c72f30169bd54e8eb10757c04bdddf3859c601c1eb9e1a12fe4d15658906dfe
-
SSDEEP
98304:TYd5DQd5Dk9Tsed5DogTrBKvGWD3nIOYoHwfLk3vSmaR0+Mc4AN0edaAHDfysrT4:Tasx3vG6IObAbN0T
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4660 RobloxPlayerBeta.exe -
Loads dropped DLL 1 IoCs
pid Process 4660 RobloxPlayerBeta.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 4660 RobloxPlayerBeta.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 18 IoCs
pid Process 4660 RobloxPlayerBeta.exe 4660 RobloxPlayerBeta.exe 4660 RobloxPlayerBeta.exe 4660 RobloxPlayerBeta.exe 4660 RobloxPlayerBeta.exe 4660 RobloxPlayerBeta.exe 4660 RobloxPlayerBeta.exe 4660 RobloxPlayerBeta.exe 4660 RobloxPlayerBeta.exe 4660 RobloxPlayerBeta.exe 4660 RobloxPlayerBeta.exe 4660 RobloxPlayerBeta.exe 4660 RobloxPlayerBeta.exe 4660 RobloxPlayerBeta.exe 4660 RobloxPlayerBeta.exe 4660 RobloxPlayerBeta.exe 4660 RobloxPlayerBeta.exe 4660 RobloxPlayerBeta.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 Winword.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Winword.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Winword.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily Winword.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU Winword.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS Winword.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe -
Modifies registry class 61 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\roblox-player\ = "URL: Roblox Protocol" Bloxstrap-v2.7.0.exe Set value (data) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = 00000000ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\ses_auto_file\shell\edit\command\ = "\"C:\\Program Files\\Microsoft Office\\root\\Office16\\Winword.exe\" /n \"%1\"" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0 = 500031000000000041592b9d10004c6f63616c003c0009000400efbe0259f27841592e9d2e000000745702000000010000000000000000000000000000006b568a004c006f00630061006c00000014000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\ses_auto_file\shell OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\roblox-player\URL Protocol Bloxstrap-v2.7.0.exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\roblox-player\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe\" %1" Bloxstrap-v2.7.0.exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0 = 50003100000000000259307f100041646d696e003c0009000400efbe0259f2784159289d2e000000555702000000010000000000000000000000000000004ce35000410064006d0069006e00000014000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\ses_auto_file\shell\edit OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\.ses\ = "ses_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\roblox\shell\open Bloxstrap-v2.7.0.exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\roblox-player\shell Bloxstrap-v2.7.0.exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\roblox\ = "URL: Roblox Protocol" Bloxstrap-v2.7.0.exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\roblox\URL Protocol Bloxstrap-v2.7.0.exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\roblox-player\DefaultIcon Bloxstrap-v2.7.0.exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\roblox-player\shell\open\command Bloxstrap-v2.7.0.exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\roblox\shell Bloxstrap-v2.7.0.exe Set value (data) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 19002f433a5c000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\roblox\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe" Bloxstrap-v2.7.0.exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\roblox-player\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe" Bloxstrap-v2.7.0.exe Set value (data) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0 = 56003100000000000259f27812004170704461746100400009000400efbe0259f2784159289d2e00000060570200000001000000000000000000000000000000c5b2a1004100700070004400610074006100000016000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0\0\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\roblox-player Bloxstrap-v2.7.0.exe Set value (int) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0\0\NodeSlot = "3" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0 = 78003100000000000259f2781100557365727300640009000400efbec5522d604159289d2e0000006c0500000000010000000000000000003a0000000000dd00b00055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\ses_auto_file\shell\edit\ = "@C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Office16\\oregres.dll,-1" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\roblox-player\shell\open Bloxstrap-v2.7.0.exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0\0 = 4e003100000000004159289d100054656d7000003a0009000400efbe0259f27841592e9d2e00000075570200000001000000000000000000000000000000ea8e1d01540065006d007000000014000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\ses_auto_file OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\ses_auto_file\shell\edit\command OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\roblox Bloxstrap-v2.7.0.exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\roblox\DefaultIcon Bloxstrap-v2.7.0.exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\roblox\shell\open\command Bloxstrap-v2.7.0.exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\roblox\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe\" %1" Bloxstrap-v2.7.0.exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\.ses OpenWith.exe -
Suspicious behavior: AddClipboardFormatListener 3 IoCs
pid Process 3160 explorer.exe 3476 Winword.exe 3476 Winword.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 4660 RobloxPlayerBeta.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe 1600 Bloxstrap-v2.7.0.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 3160 explorer.exe 1396 OpenWith.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1600 Bloxstrap-v2.7.0.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1600 Bloxstrap-v2.7.0.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1600 Bloxstrap-v2.7.0.exe -
Suspicious use of SetWindowsHookEx 26 IoCs
pid Process 3160 explorer.exe 3160 explorer.exe 3160 explorer.exe 3160 explorer.exe 3160 explorer.exe 3160 explorer.exe 4952 OpenWith.exe 3160 explorer.exe 1396 OpenWith.exe 1396 OpenWith.exe 1396 OpenWith.exe 1396 OpenWith.exe 1396 OpenWith.exe 1396 OpenWith.exe 1396 OpenWith.exe 1396 OpenWith.exe 1396 OpenWith.exe 1396 OpenWith.exe 1396 OpenWith.exe 1396 OpenWith.exe 1396 OpenWith.exe 3476 Winword.exe 3476 Winword.exe 3476 Winword.exe 3476 Winword.exe 3476 Winword.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 4660 RobloxPlayerBeta.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1600 wrote to memory of 4660 1600 Bloxstrap-v2.7.0.exe 79 PID 1600 wrote to memory of 4660 1600 Bloxstrap-v2.7.0.exe 79 PID 1600 wrote to memory of 2748 1600 Bloxstrap-v2.7.0.exe 81 PID 1600 wrote to memory of 2748 1600 Bloxstrap-v2.7.0.exe 81 PID 1396 wrote to memory of 3476 1396 OpenWith.exe 85 PID 1396 wrote to memory of 3476 1396 OpenWith.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.7.0.exe"C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.7.0.exe"1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-b591875ddfbc4294\RobloxPlayerBeta.exe"C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-b591875ddfbc4294\RobloxPlayerBeta.exe" --app -channel production2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:4660
-
-
C:\Windows\explorer.exe"explorer.exe" /select,"C:\Users\Admin\AppData\Local\Temp\Bloxstrap_20241001T194114Z.log"2⤵PID:2748
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1076
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3160
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4952
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Program Files\Microsoft Office\root\Office16\Winword.exe"C:\Program Files\Microsoft Office\root\Office16\Winword.exe" /n "C:\Users\Admin\AppData\Local\Temp\.ses"2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3476
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
79B
MD5eab6dcc312473d43c2fa8cc41280d79c
SHA1b4e9ec7e579d06dfcaa5ac616de2751308a153c3
SHA2560a27d3c9100ab7ab6f03c45daeb0f0cd586f3aeb59daf7986e853f9614e954fe
SHA5121ce0fdc237110d644bcc8238f184554f25813ccf7142fd312ce96fbb6659081db677b04485bf66d52100136da6bb9688e48b1287455725c7b4950153aa2a4595
-
Filesize
18.5MB
MD578dc9f08202382db76ecce3d70a7107f
SHA1110a23181673ba65356b953f28e13e5382e6da6b
SHA2561f334bd39e9e17919c8dba82b2eaaae1a45154c574aff195b1c001c5fc1cb159
SHA512c37bc98958b830101245ff422aad635c040fea0ab379556c870246964626073921440818a44c4fac5ce56d290969e3e6640f56f734cec74d986a793a59fa1be3
-
Filesize
6KB
MD59404c52d6f311da02d65d4320bfebb59
SHA10b5b5c2e7c631894953d5828fec06bdf6adba55f
SHA256c9775e361392877d1d521d0450a5368ee92d37dc542bc5e514373c9d5003f317
SHA51222aa1acbcdcf56f571170d9c32fd0d025c50936387203a7827dbb925f352d2bc082a8a79db61c2d1f1795ad979e93367c80205d9141b73d806ae08fa089837c4
-
Filesize
262KB
MD551d32ee5bc7ab811041f799652d26e04
SHA1412193006aa3ef19e0a57e16acf86b830993024a
SHA2566230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA5125fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810