Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3Blox-Fruit...ox.exe
windows10-ltsc 2021-x64
10Blox-Fruit...or.dll
windows10-ltsc 2021-x64
1Blox-Fruit...on.exe
windows10-ltsc 2021-x64
3Blox-Fruit...er.dll
windows10-ltsc 2021-x64
3Blox-Fruit...09.dll
windows10-ltsc 2021-x64
3Blox-Fruit...r2.dll
windows10-ltsc 2021-x64
3Blox-Fruit...09.dll
windows10-ltsc 2021-x64
1Blox-Fruit...r2.dll
windows10-ltsc 2021-x64
1Blox-Fruit...on.exe
windows10-ltsc 2021-x64
1Blox-Fruit...if.dll
windows10-ltsc 2021-x64
3Blox-Fruit...ns.dll
windows10-ltsc 2021-x64
3Blox-Fruit...co.dll
windows10-ltsc 2021-x64
3Blox-Fruit...eg.dll
windows10-ltsc 2021-x64
3Blox-Fruit...vg.dll
windows10-ltsc 2021-x64
3Blox-Fruit...ga.dll
windows10-ltsc 2021-x64
Blox-Fruit...ff.dll
windows10-ltsc 2021-x64
3Blox-Fruit...mp.dll
windows10-ltsc 2021-x64
3Blox-Fruit...bp.dll
windows10-ltsc 2021-x64
3Blox-Fruit...3u.dll
windows10-ltsc 2021-x64
3Blox-Fruit...ll.dll
windows10-ltsc 2021-x64
3Blox-Fruit...ea.dll
windows10-ltsc 2021-x64
3Blox-Fruit...rt.dll
windows10-ltsc 2021-x64
3Blox-Fruit...te.dll
windows10-ltsc 2021-x64
3Blox-Fruit...bc.dll
windows10-ltsc 2021-x64
3Blox-Fruit...ql.dll
windows10-ltsc 2021-x64
3Analysis
-
max time kernel
32s -
max time network
37s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250113-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
22/01/2025, 01:55
Static task
static1
Behavioral task
behavioral1
Sample
Blox-Fruits-Script-Roblox/Blox-Fruits-Script-Roblox.exe
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral2
Sample
Blox-Fruits-Script-Roblox/RSI_indicator.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral3
Sample
Blox-Fruits-Script-Roblox/adbdrv/32/devcon.exe
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral4
Sample
Blox-Fruits-Script-Roblox/adbdrv/32/i386/USBCoInstaller.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral5
Sample
Blox-Fruits-Script-Roblox/adbdrv/32/i386/WdfCoInstaller01009.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral6
Sample
Blox-Fruits-Script-Roblox/adbdrv/32/i386/winusbcoinstaller2.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral7
Sample
Blox-Fruits-Script-Roblox/adbdrv/64/amd64/WdfCoInstaller01009.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral8
Sample
Blox-Fruits-Script-Roblox/adbdrv/64/amd64/winusbcoinstaller2.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral9
Sample
Blox-Fruits-Script-Roblox/adbdrv/64/devcon.exe
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral10
Sample
Blox-Fruits-Script-Roblox/imageformats/qgif.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral11
Sample
Blox-Fruits-Script-Roblox/imageformats/qicns.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral12
Sample
Blox-Fruits-Script-Roblox/imageformats/qico.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral13
Sample
Blox-Fruits-Script-Roblox/imageformats/qjpeg.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral14
Sample
Blox-Fruits-Script-Roblox/imageformats/qsvg.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral15
Sample
Blox-Fruits-Script-Roblox/imageformats/qtga.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral16
Sample
Blox-Fruits-Script-Roblox/imageformats/qtiff.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral17
Sample
Blox-Fruits-Script-Roblox/imageformats/qwbmp.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral18
Sample
Blox-Fruits-Script-Roblox/imageformats/qwebp.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral19
Sample
Blox-Fruits-Script-Roblox/playlistformats/qtmultimedia_m3u.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral20
Sample
Blox-Fruits-Script-Roblox/position/qtposition_positionpoll.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral21
Sample
Blox-Fruits-Script-Roblox/position/qtposition_serialnmea.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral22
Sample
Blox-Fruits-Script-Roblox/position/qtposition_winrt.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral23
Sample
Blox-Fruits-Script-Roblox/sqldrivers/qsqlite.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral24
Sample
Blox-Fruits-Script-Roblox/sqldrivers/qsqlodbc.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral25
Sample
Blox-Fruits-Script-Roblox/sqldrivers/qsqlpsql.dll
Resource
win10ltsc2021-20250113-en
General
-
Target
Blox-Fruits-Script-Roblox/sqldrivers/qsqlodbc.dll
-
Size
72KB
-
MD5
340b067fbbc32574ea14b8018da69797
-
SHA1
11abd4cad1ea51d24791df3501dc1de766adfaf0
-
SHA256
001eff38874f7526fb4cea4b0b28215b55b321ec8c116f2e175bbd604706669d
-
SHA512
fdc90e74561fb1f48a0e72a6fe41bf3c9162b93845bf56c47c94da4281a1645ad0e18987b47b05f7aaa712e06bfdf4825e974cf6a6b8ca5aa18b3aaac31c841a
-
SSDEEP
768:KKQfNPFNCQLwRebhZKHbFXmAFooXT/+SN6QSFf50pdwvnS0NdpaOyxliHPs/MJIi:kftBhMsJfpHAOlHB8GwOON+hFhUv0Ufm
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 228 wrote to memory of 2172 228 rundll32.exe 82 PID 228 wrote to memory of 2172 228 rundll32.exe 82 PID 228 wrote to memory of 2172 228 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Blox-Fruits-Script-Roblox\sqldrivers\qsqlodbc.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Blox-Fruits-Script-Roblox\sqldrivers\qsqlodbc.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2172
-