Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3Blox-Fruit...ox.exe
windows10-ltsc 2021-x64
10Blox-Fruit...or.dll
windows10-ltsc 2021-x64
1Blox-Fruit...on.exe
windows10-ltsc 2021-x64
3Blox-Fruit...er.dll
windows10-ltsc 2021-x64
3Blox-Fruit...09.dll
windows10-ltsc 2021-x64
3Blox-Fruit...r2.dll
windows10-ltsc 2021-x64
3Blox-Fruit...09.dll
windows10-ltsc 2021-x64
1Blox-Fruit...r2.dll
windows10-ltsc 2021-x64
1Blox-Fruit...on.exe
windows10-ltsc 2021-x64
1Blox-Fruit...if.dll
windows10-ltsc 2021-x64
3Blox-Fruit...ns.dll
windows10-ltsc 2021-x64
3Blox-Fruit...co.dll
windows10-ltsc 2021-x64
3Blox-Fruit...eg.dll
windows10-ltsc 2021-x64
3Blox-Fruit...vg.dll
windows10-ltsc 2021-x64
3Blox-Fruit...ga.dll
windows10-ltsc 2021-x64
Blox-Fruit...ff.dll
windows10-ltsc 2021-x64
3Blox-Fruit...mp.dll
windows10-ltsc 2021-x64
3Blox-Fruit...bp.dll
windows10-ltsc 2021-x64
3Blox-Fruit...3u.dll
windows10-ltsc 2021-x64
3Blox-Fruit...ll.dll
windows10-ltsc 2021-x64
3Blox-Fruit...ea.dll
windows10-ltsc 2021-x64
3Blox-Fruit...rt.dll
windows10-ltsc 2021-x64
3Blox-Fruit...te.dll
windows10-ltsc 2021-x64
3Blox-Fruit...bc.dll
windows10-ltsc 2021-x64
3Blox-Fruit...ql.dll
windows10-ltsc 2021-x64
3Analysis
-
max time kernel
62s -
max time network
65s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250113-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
22/01/2025, 01:55
Static task
static1
Behavioral task
behavioral1
Sample
Blox-Fruits-Script-Roblox/Blox-Fruits-Script-Roblox.exe
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral2
Sample
Blox-Fruits-Script-Roblox/RSI_indicator.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral3
Sample
Blox-Fruits-Script-Roblox/adbdrv/32/devcon.exe
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral4
Sample
Blox-Fruits-Script-Roblox/adbdrv/32/i386/USBCoInstaller.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral5
Sample
Blox-Fruits-Script-Roblox/adbdrv/32/i386/WdfCoInstaller01009.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral6
Sample
Blox-Fruits-Script-Roblox/adbdrv/32/i386/winusbcoinstaller2.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral7
Sample
Blox-Fruits-Script-Roblox/adbdrv/64/amd64/WdfCoInstaller01009.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral8
Sample
Blox-Fruits-Script-Roblox/adbdrv/64/amd64/winusbcoinstaller2.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral9
Sample
Blox-Fruits-Script-Roblox/adbdrv/64/devcon.exe
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral10
Sample
Blox-Fruits-Script-Roblox/imageformats/qgif.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral11
Sample
Blox-Fruits-Script-Roblox/imageformats/qicns.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral12
Sample
Blox-Fruits-Script-Roblox/imageformats/qico.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral13
Sample
Blox-Fruits-Script-Roblox/imageformats/qjpeg.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral14
Sample
Blox-Fruits-Script-Roblox/imageformats/qsvg.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral15
Sample
Blox-Fruits-Script-Roblox/imageformats/qtga.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral16
Sample
Blox-Fruits-Script-Roblox/imageformats/qtiff.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral17
Sample
Blox-Fruits-Script-Roblox/imageformats/qwbmp.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral18
Sample
Blox-Fruits-Script-Roblox/imageformats/qwebp.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral19
Sample
Blox-Fruits-Script-Roblox/playlistformats/qtmultimedia_m3u.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral20
Sample
Blox-Fruits-Script-Roblox/position/qtposition_positionpoll.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral21
Sample
Blox-Fruits-Script-Roblox/position/qtposition_serialnmea.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral22
Sample
Blox-Fruits-Script-Roblox/position/qtposition_winrt.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral23
Sample
Blox-Fruits-Script-Roblox/sqldrivers/qsqlite.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral24
Sample
Blox-Fruits-Script-Roblox/sqldrivers/qsqlodbc.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral25
Sample
Blox-Fruits-Script-Roblox/sqldrivers/qsqlpsql.dll
Resource
win10ltsc2021-20250113-en
General
-
Target
Blox-Fruits-Script-Roblox/Blox-Fruits-Script-Roblox.exe
-
Size
399KB
-
MD5
8326264cfcff215611c9890e985b80e6
-
SHA1
658550e697d9499db7821cbbbf59ffd39eb59053
-
SHA256
d5b6cd18d84f4c8334b84745bc0603d7d7407aa7243ef945f8a3696c9d097f65
-
SHA512
e41f407c851eb5744fad83b504d56d8c1445d382f40c975ce938121908f484c44bc181ff60383e56cb7eb70bf127b8166b170aa35b8d032cf040a0ceebd02e3f
-
SSDEEP
12288:pQXNUkhnjDvP1wNiqMAYVgPinUzLnP6MOXJ:p5khnv8iRVgPz6fXJ
Malware Config
Extracted
lumma
https://toppyneedus.biz/api
https://suggestyuoz.biz/api
Signatures
-
Lumma family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4204 set thread context of 3300 4204 Blox-Fruits-Script-Roblox.exe 82 -
Program crash 1 IoCs
pid pid_target Process procid_target 1460 4204 WerFault.exe 80 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Blox-Fruits-Script-Roblox.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Blox-Fruits-Script-Roblox.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4204 wrote to memory of 3896 4204 Blox-Fruits-Script-Roblox.exe 81 PID 4204 wrote to memory of 3896 4204 Blox-Fruits-Script-Roblox.exe 81 PID 4204 wrote to memory of 3896 4204 Blox-Fruits-Script-Roblox.exe 81 PID 4204 wrote to memory of 3300 4204 Blox-Fruits-Script-Roblox.exe 82 PID 4204 wrote to memory of 3300 4204 Blox-Fruits-Script-Roblox.exe 82 PID 4204 wrote to memory of 3300 4204 Blox-Fruits-Script-Roblox.exe 82 PID 4204 wrote to memory of 3300 4204 Blox-Fruits-Script-Roblox.exe 82 PID 4204 wrote to memory of 3300 4204 Blox-Fruits-Script-Roblox.exe 82 PID 4204 wrote to memory of 3300 4204 Blox-Fruits-Script-Roblox.exe 82 PID 4204 wrote to memory of 3300 4204 Blox-Fruits-Script-Roblox.exe 82 PID 4204 wrote to memory of 3300 4204 Blox-Fruits-Script-Roblox.exe 82 PID 4204 wrote to memory of 3300 4204 Blox-Fruits-Script-Roblox.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\Blox-Fruits-Script-Roblox\Blox-Fruits-Script-Roblox.exe"C:\Users\Admin\AppData\Local\Temp\Blox-Fruits-Script-Roblox\Blox-Fruits-Script-Roblox.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\Blox-Fruits-Script-Roblox\Blox-Fruits-Script-Roblox.exe"C:\Users\Admin\AppData\Local\Temp\Blox-Fruits-Script-Roblox\Blox-Fruits-Script-Roblox.exe"2⤵PID:3896
-
-
C:\Users\Admin\AppData\Local\Temp\Blox-Fruits-Script-Roblox\Blox-Fruits-Script-Roblox.exe"C:\Users\Admin\AppData\Local\Temp\Blox-Fruits-Script-Roblox\Blox-Fruits-Script-Roblox.exe"2⤵
- System Location Discovery: System Language Discovery
PID:3300
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 8322⤵
- Program crash
PID:1460
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 232 -p 4204 -ip 42041⤵PID:2144