Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3Blox-Fruit...ox.exe
windows10-ltsc 2021-x64
10Blox-Fruit...or.dll
windows10-ltsc 2021-x64
1Blox-Fruit...on.exe
windows10-ltsc 2021-x64
3Blox-Fruit...er.dll
windows10-ltsc 2021-x64
3Blox-Fruit...09.dll
windows10-ltsc 2021-x64
3Blox-Fruit...r2.dll
windows10-ltsc 2021-x64
3Blox-Fruit...09.dll
windows10-ltsc 2021-x64
1Blox-Fruit...r2.dll
windows10-ltsc 2021-x64
1Blox-Fruit...on.exe
windows10-ltsc 2021-x64
1Blox-Fruit...if.dll
windows10-ltsc 2021-x64
3Blox-Fruit...ns.dll
windows10-ltsc 2021-x64
3Blox-Fruit...co.dll
windows10-ltsc 2021-x64
3Blox-Fruit...eg.dll
windows10-ltsc 2021-x64
3Blox-Fruit...vg.dll
windows10-ltsc 2021-x64
3Blox-Fruit...ga.dll
windows10-ltsc 2021-x64
Blox-Fruit...ff.dll
windows10-ltsc 2021-x64
3Blox-Fruit...mp.dll
windows10-ltsc 2021-x64
3Blox-Fruit...bp.dll
windows10-ltsc 2021-x64
3Blox-Fruit...3u.dll
windows10-ltsc 2021-x64
3Blox-Fruit...ll.dll
windows10-ltsc 2021-x64
3Blox-Fruit...ea.dll
windows10-ltsc 2021-x64
3Blox-Fruit...rt.dll
windows10-ltsc 2021-x64
3Blox-Fruit...te.dll
windows10-ltsc 2021-x64
3Blox-Fruit...bc.dll
windows10-ltsc 2021-x64
3Blox-Fruit...ql.dll
windows10-ltsc 2021-x64
3Analysis
-
max time kernel
32s -
max time network
40s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250113-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
22/01/2025, 01:55
Static task
static1
Behavioral task
behavioral1
Sample
Blox-Fruits-Script-Roblox/Blox-Fruits-Script-Roblox.exe
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral2
Sample
Blox-Fruits-Script-Roblox/RSI_indicator.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral3
Sample
Blox-Fruits-Script-Roblox/adbdrv/32/devcon.exe
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral4
Sample
Blox-Fruits-Script-Roblox/adbdrv/32/i386/USBCoInstaller.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral5
Sample
Blox-Fruits-Script-Roblox/adbdrv/32/i386/WdfCoInstaller01009.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral6
Sample
Blox-Fruits-Script-Roblox/adbdrv/32/i386/winusbcoinstaller2.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral7
Sample
Blox-Fruits-Script-Roblox/adbdrv/64/amd64/WdfCoInstaller01009.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral8
Sample
Blox-Fruits-Script-Roblox/adbdrv/64/amd64/winusbcoinstaller2.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral9
Sample
Blox-Fruits-Script-Roblox/adbdrv/64/devcon.exe
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral10
Sample
Blox-Fruits-Script-Roblox/imageformats/qgif.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral11
Sample
Blox-Fruits-Script-Roblox/imageformats/qicns.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral12
Sample
Blox-Fruits-Script-Roblox/imageformats/qico.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral13
Sample
Blox-Fruits-Script-Roblox/imageformats/qjpeg.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral14
Sample
Blox-Fruits-Script-Roblox/imageformats/qsvg.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral15
Sample
Blox-Fruits-Script-Roblox/imageformats/qtga.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral16
Sample
Blox-Fruits-Script-Roblox/imageformats/qtiff.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral17
Sample
Blox-Fruits-Script-Roblox/imageformats/qwbmp.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral18
Sample
Blox-Fruits-Script-Roblox/imageformats/qwebp.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral19
Sample
Blox-Fruits-Script-Roblox/playlistformats/qtmultimedia_m3u.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral20
Sample
Blox-Fruits-Script-Roblox/position/qtposition_positionpoll.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral21
Sample
Blox-Fruits-Script-Roblox/position/qtposition_serialnmea.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral22
Sample
Blox-Fruits-Script-Roblox/position/qtposition_winrt.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral23
Sample
Blox-Fruits-Script-Roblox/sqldrivers/qsqlite.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral24
Sample
Blox-Fruits-Script-Roblox/sqldrivers/qsqlodbc.dll
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral25
Sample
Blox-Fruits-Script-Roblox/sqldrivers/qsqlpsql.dll
Resource
win10ltsc2021-20250113-en
General
-
Target
Blox-Fruits-Script-Roblox/adbdrv/32/i386/winusbcoinstaller2.dll
-
Size
837KB
-
MD5
3259ebd7742a78e8fa0ad5a689b7377d
-
SHA1
fbe79b1f6b207c3b47ff37071c47b8ffdadf889f
-
SHA256
91baea13dc25e24916de0faab9a59a70fef12f3a2eec96528c1d9d076ce320b2
-
SHA512
3dcdeed5c2078d4c82308b63bd9812c16d07883f47a615ce06616de94c59934e916966ab026391d95af9a370fbc7a7fb90cce931736484cdc85a377080ad2f1b
-
SSDEEP
12288:aZq3DFVAZjj5h7OqGDqY66s32+0SLqfhA50yWI7yBoM1oGloLwtxJYnPXrmQl79:aZwoP7MYG+pX501zBoC+wtxuPXrmQlZ
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3544 1108 WerFault.exe 81 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4432 wrote to memory of 1108 4432 rundll32.exe 81 PID 4432 wrote to memory of 1108 4432 rundll32.exe 81 PID 4432 wrote to memory of 1108 4432 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Blox-Fruits-Script-Roblox\adbdrv\32\i386\winusbcoinstaller2.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Blox-Fruits-Script-Roblox\adbdrv\32\i386\winusbcoinstaller2.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1108 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 6003⤵
- Program crash
PID:3544
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1108 -ip 11081⤵PID:1480