Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3Blox-Fruit...ox.exe
windows10-ltsc 2021-x64
10Blox-Fruit...or.dll
windows10-ltsc 2021-x64
1Blox-Fruit...on.exe
windows10-ltsc 2021-x64
3Blox-Fruit...er.dll
windows10-ltsc 2021-x64
3Blox-Fruit...09.dll
windows10-ltsc 2021-x64
3Blox-Fruit...r2.dll
windows10-ltsc 2021-x64
3Blox-Fruit...09.dll
windows10-ltsc 2021-x64
1Blox-Fruit...r2.dll
windows10-ltsc 2021-x64
1Blox-Fruit...on.exe
windows10-ltsc 2021-x64
1Blox-Fruit...if.dll
windows10-ltsc 2021-x64
3Blox-Fruit...ns.dll
windows10-ltsc 2021-x64
3Blox-Fruit...co.dll
windows10-ltsc 2021-x64
3Blox-Fruit...eg.dll
windows10-ltsc 2021-x64
3Blox-Fruit...vg.dll
windows10-ltsc 2021-x64
3Blox-Fruit...ga.dll
windows10-ltsc 2021-x64
Blox-Fruit...ff.dll
windows10-ltsc 2021-x64
3Blox-Fruit...mp.dll
windows10-ltsc 2021-x64
3Blox-Fruit...bp.dll
windows10-ltsc 2021-x64
3Blox-Fruit...3u.dll
windows10-ltsc 2021-x64
3Blox-Fruit...ll.dll
windows10-ltsc 2021-x64
3Blox-Fruit...ea.dll
windows10-ltsc 2021-x64
3Blox-Fruit...rt.dll
windows10-ltsc 2021-x64
3Blox-Fruit...te.dll
windows10-ltsc 2021-x64
3Blox-Fruit...bc.dll
windows10-ltsc 2021-x64
3Blox-Fruit...ql.dll
windows10-ltsc 2021-x64
3Analysis
-
max time kernel
62s -
max time network
64s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250113-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
22/01/2025, 01:55
Static task
static1
Behavioral task
behavioral1
Sample
Blox-Fruits-Script-Roblox/Blox-Fruits-Script-Roblox.exe
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral2
Sample
Blox-Fruits-Script-Roblox/RSI_indicator.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral3
Sample
Blox-Fruits-Script-Roblox/adbdrv/32/devcon.exe
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral4
Sample
Blox-Fruits-Script-Roblox/adbdrv/32/i386/USBCoInstaller.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral5
Sample
Blox-Fruits-Script-Roblox/adbdrv/32/i386/WdfCoInstaller01009.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral6
Sample
Blox-Fruits-Script-Roblox/adbdrv/32/i386/winusbcoinstaller2.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral7
Sample
Blox-Fruits-Script-Roblox/adbdrv/64/amd64/WdfCoInstaller01009.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral8
Sample
Blox-Fruits-Script-Roblox/adbdrv/64/amd64/winusbcoinstaller2.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral9
Sample
Blox-Fruits-Script-Roblox/adbdrv/64/devcon.exe
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral10
Sample
Blox-Fruits-Script-Roblox/imageformats/qgif.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral11
Sample
Blox-Fruits-Script-Roblox/imageformats/qicns.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral12
Sample
Blox-Fruits-Script-Roblox/imageformats/qico.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral13
Sample
Blox-Fruits-Script-Roblox/imageformats/qjpeg.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral14
Sample
Blox-Fruits-Script-Roblox/imageformats/qsvg.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral15
Sample
Blox-Fruits-Script-Roblox/imageformats/qtga.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral16
Sample
Blox-Fruits-Script-Roblox/imageformats/qtiff.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral17
Sample
Blox-Fruits-Script-Roblox/imageformats/qwbmp.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral18
Sample
Blox-Fruits-Script-Roblox/imageformats/qwebp.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral19
Sample
Blox-Fruits-Script-Roblox/playlistformats/qtmultimedia_m3u.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral20
Sample
Blox-Fruits-Script-Roblox/position/qtposition_positionpoll.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral21
Sample
Blox-Fruits-Script-Roblox/position/qtposition_serialnmea.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral22
Sample
Blox-Fruits-Script-Roblox/position/qtposition_winrt.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral23
Sample
Blox-Fruits-Script-Roblox/sqldrivers/qsqlite.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral24
Sample
Blox-Fruits-Script-Roblox/sqldrivers/qsqlodbc.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral25
Sample
Blox-Fruits-Script-Roblox/sqldrivers/qsqlpsql.dll
Resource
win10ltsc2021-20250113-en
General
-
Target
Blox-Fruits-Script-Roblox/imageformats/qtiff.dll
-
Size
345KB
-
MD5
49b6f0ba901f649ab110744e34076951
-
SHA1
4c9eebadb5b86147ea94f48eaa6705a4b75b3e61
-
SHA256
5128aedf4bd9b747ac848bf85e0ffb99ba814bd8e671adff7d26391d31259050
-
SHA512
b42a13f0215a194f77781ac74cf55c24a0f0bc99cc872ea06125cfe12ffef93add0665991339db3b7962262e6d381f20227da3272360450b53993d06bc0ec98a
-
SSDEEP
6144:BpYIdJpn0zXsT6DP64icIkjEkaNCTjM+8kBHWNFnHJXGFkDQDWr:jYIp06+IkjeNGjIkZZKr
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 892 wrote to memory of 1744 892 rundll32.exe 81 PID 892 wrote to memory of 1744 892 rundll32.exe 81 PID 892 wrote to memory of 1744 892 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Blox-Fruits-Script-Roblox\imageformats\qtiff.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Blox-Fruits-Script-Roblox\imageformats\qtiff.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1744
-