Analysis
- user interaction
yes - max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/07/2026, 00:37
Static task
static1
Behavioral task
behavioral1
Sample
Bloxstrap-v2.11.3.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Bloxstrap-v2.11.3.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target Bloxstrap-v2.11.3.exe
- Size 12.0MB
- Sample260722-ayp1mstses
- SHA256 4d423ad46d0bf43cd22c9c1b5d25167edc15e784a57e94f889f1eefb5ce238a0
- MD5 3240bc150c493952fc0c727f47b96f5b
- SHA1 bf3d5f6baca61e27b61d7365bc58df4e8f2f967c
- SHA512 61c378817dc3bcdcc5f4c95414f91ec4621e4ec7841de7f6cbaae13b1d653b3fb69b503773c3cd703e886bfd20f4f1369cf9ecef0d405e3894ec513784d147a2
- SSDEEP 98304:UYJOvTscod5DkasbMZszos0D3FuOYoHwfLk3vSmaR0+Mc4AN0edaAHDfysrTl:UYJQscgsbMZfs/ObAbN0
- TLSH T11AC67C9533FC2A35E3B74B35A970721A05767C2EA901D78F5B85BA1D2972280CDE0B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation Bloxstrap-v2.11.3.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Modifies registry class 18 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\roblox-player\shell\open Bloxstrap-v2.11.3.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\roblox\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe\" -player \"%1\"" Bloxstrap-v2.11.3.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\roblox-player\DefaultIcon Bloxstrap-v2.11.3.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\roblox-player\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe\" -player \"%1\"" Bloxstrap-v2.11.3.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\roblox Bloxstrap-v2.11.3.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\roblox\shell Bloxstrap-v2.11.3.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\roblox\URL Protocol Bloxstrap-v2.11.3.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\roblox\shell\open\command Bloxstrap-v2.11.3.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\roblox\shell\open Bloxstrap-v2.11.3.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\roblox\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe" Bloxstrap-v2.11.3.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\roblox-player Bloxstrap-v2.11.3.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\roblox-player\shell\open\command Bloxstrap-v2.11.3.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\roblox-player\shell Bloxstrap-v2.11.3.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\roblox-player\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe" Bloxstrap-v2.11.3.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\roblox\DefaultIcon Bloxstrap-v2.11.3.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\roblox\ = "URL: Roblox Protocol" Bloxstrap-v2.11.3.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\roblox-player\ = "URL: Roblox Protocol" Bloxstrap-v2.11.3.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\roblox-player\URL Protocol Bloxstrap-v2.11.3.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1144 Bloxstrap-v2.11.3.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1144 Bloxstrap-v2.11.3.exe Token: SeDebugPrivilege 620 taskmgr.exe Token: SeSystemProfilePrivilege 620 taskmgr.exe Token: SeCreateGlobalPrivilege 620 taskmgr.exe Token: 33 620 taskmgr.exe Token: SeIncBasePriorityPrivilege 620 taskmgr.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe - Suspicious use of SendNotifyMessage 34 IoCs
pid Process 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe 620 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.11.3.exe"C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.11.3.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1144
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:620