Overview

overview

6

Static

static

1

Bloxstrap-v2.9.0.exe

windows10-2004-x64

6

Bloxstrap-v2.9.0.exe

windows10-ltsc_2021-x64

6

Bloxstrap-v2.9.0.exe

windows11-21h2-x64

4

Bloxstrap-v2.9.0.exe

windows11-ltsc_2024-x64

4

Analysis

  • user interaction
    yes
  • max time kernel
    20s
  • max time network
    38s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260513-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    12/08/2026, 00:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Bloxstrap-v2.9.0.exe
  • Size 12.2MB
  • Sample260812-ap8rdshf52
  • SHA256 40d3370dca2b21a3051ad89e387ba12443c0b8dfac7720dee64e9f7117d502d7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discovery

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Modifies registry class 18 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.9.0.exe
    "C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.9.0.exe"
    1⤵
    • Downloads MZ/PE file
    • Checks computer location settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3920
    • C:\Users\Admin\AppData\Local\Temp\Bloxstrap\Updates\Bloxstrap-v2.11.4.exe
      "C:\Users\Admin\AppData\Local\Temp\Bloxstrap\Updates\Bloxstrap-v2.11.4.exe" -upgrade -player
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:5004
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/bloxstraplabs/bloxstrap/wiki/Release-notes-for-Bloxstrap-v2.11.2
        3⤵
          PID:4768
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x374,0x7ff9fc88c188,0x7ff9fc88c194,0x7ff9fc88c1a0
            4⤵
              PID:400
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,9709555890188315856,17290819175187437636,524288 --field-trial-handle=2904,i,11292728336343263884,8321768895867903729,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:3
              4⤵
              • System Time Discovery
              PID:992
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,7178814894990928699,8671482321125425688,262144 --field-trial-handle=2904,i,11292728336343263884,8321768895867903729,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:2
              4⤵
                PID:212
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,9618165095737416670,9246107931707456701,524288 --field-trial-handle=2904,i,11292728336343263884,8321768895867903729,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:8
                4⤵
                  PID:3664
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3388,i,12431124006982373670,12991152189927530720,2097152 --field-trial-handle=2904,i,11292728336343263884,8321768895867903729,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
                  4⤵
                    PID:2736
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3392,i,6265376046688929066,2886078807271343315,2097152 --field-trial-handle=2904,i,11292728336343263884,8321768895867903729,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
                    4⤵
                      PID:1092
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=1748,i,8842783330532061817,10096069129924287718,2097152 --field-trial-handle=2904,i,11292728336343263884,8321768895867903729,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
                      4⤵
                        PID:956
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4164,i,12914331970725586501,8491315333211984822,2097152 --field-trial-handle=2904,i,11292728336343263884,8321768895867903729,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:2
                        4⤵
                          PID:1116
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,1014331812094801379,17439269231184554613,524288 --field-trial-handle=2904,i,11292728336343263884,8321768895867903729,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:8
                          4⤵
                            PID:2804
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,17930230187902740118,14812500917338787865,524288 --field-trial-handle=2904,i,11292728336343263884,8321768895867903729,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
                            4⤵
                              PID:4236
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,5011500215176603235,4866249495309886340,524288 --field-trial-handle=2904,i,11292728336343263884,8321768895867903729,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
                              4⤵
                                PID:692
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,11991579536554678239,11351185104363674892,524288 --field-trial-handle=2904,i,11292728336343263884,8321768895867903729,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
                                4⤵
                                  PID:4876
                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,12058051619379766748,11474602707064833028,524288 --field-trial-handle=2904,i,11292728336343263884,8321768895867903729,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
                                  4⤵
                                    PID:3760
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,1675776410273158230,6946193783917337762,524288 --field-trial-handle=2904,i,11292728336343263884,8321768895867903729,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:8
                                    4⤵
                                      PID:1412
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,18043753941020388646,570965676411385466,524288 --field-trial-handle=2904,i,11292728336343263884,8321768895867903729,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
                                      4⤵
                                        PID:2604
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,12058051619379766748,11474602707064833028,524288 --field-trial-handle=2904,i,11292728336343263884,8321768895867903729,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
                                        4⤵
                                          PID:1928
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                    1⤵
                                      PID:4752

                                    Network

                                          MITRE ATT&CK Enterprise v16

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          ClientAppSettings.json
                                          • Path C:\Users\Admin\AppData\Local\Bloxstrap\Modifications\ClientSettings\ClientAppSettings.json
                                          • Size 2B
                                          • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          Settings.json
                                          • Path C:\Users\Admin\AppData\Local\Bloxstrap\Settings.json
                                          • Size 765B
                                          • SHA256 410f16756dd1fbdd5db0e4eb91ec552cecb9914b3fed6b53ef6cf7e78a1e4d26
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          State.json
                                          • Path C:\Users\Admin\AppData\Local\Bloxstrap\State.json
                                          • Size 194B
                                          • SHA256 a1c106f493bc6d8d04e645431f308b5266df630bfbfb2c210fa2ba90df85c7e0
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          2baef71a-b64a-4360-817f-1661bdfdd7cb.tmp
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2baef71a-b64a-4360-817f-1661bdfdd7cb.tmp
                                          • Size 8KB
                                          • SHA256 5ba58b81e042bf4fb5d5364a4c568d8013cbcac015d715c3a37ee9d52d9d2a18
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          settings.dat
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                          • Size 280B
                                          • SHA256 f581ea565cf0ece39a0cfdc05cae1573d34e8544d3d072c3f0598034de5e42f8
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          BookmarkMergedSurfaceOrdering
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                          • Size 6B
                                          • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          Edge Profile.ico
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                          • Size 70KB
                                          • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          SCT Auditing Pending Reports
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                          • Size 2B
                                          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          Preferences
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                          • Size 12KB
                                          • SHA256 5f692280ca7bdc25b90e468ced0c51623ca73fd45b2ccc4cb67b689b770ea1d2
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Secure Preferences
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                          • Size 30KB
                                          • SHA256 36007cbc4a009ae3f1bdac6f6b968ce9dafe65108c4d60230054398ecae72911
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          sync_diagnostic.log
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                          • Size 6KB
                                          • SHA256 56db80bc28afa06369c0c9890cc0ab3ce7ba243a1b190171acd36c64cf7b111e
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Local State
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                          • Size 15KB
                                          • SHA256 933df617145370b9569421b3a75820c14db6794ef05f2d2945d8bc71a0d2d7df
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Local State
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                          • Size 8KB
                                          • SHA256 7d373f9bcc4b1f84028b65997d98cf41a966ea2991a878069974e500bb01e2ba
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          9f72842d-336f-458a-a1e4-68a82072954a.tmp
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9f72842d-336f-458a-a1e4-68a82072954a.tmp
                                          • Size 13B
                                          • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          92cc83e3-7316-4a2c-a035-2e157ed653ed.tmp
                                          • Path C:\Users\Admin\AppData\Local\Temp\92cc83e3-7316-4a2c-a035-2e157ed653ed.tmp
                                          • Size 1B
                                          • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          Bloxstrap-v2.11.4.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\Bloxstrap\Updates\Bloxstrap-v2.11.4.exe
                                          • Size 12.0MB
                                          • SHA256 9ad7758093a356fe5bd9d49911aaacf766dbb9289b6f3662a8ed3242230f46b2
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Bloxstrap.lnk
                                          • Path C:\Users\Admin\Desktop\Bloxstrap.lnk
                                          • Size 1KB
                                          • SHA256 225e6f686c2fd1dd1c8dcde9d05ef701c42a0d333a8243ac7712edbba02a3d35
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          memory/3920-0-0x000001E32BF60000-0x000001E32C146000-memory.dmp
                                          Download

                                          memory/3920-14-0x000001E32C150000-0x000001E32C608000-memory.dmp
                                          Download

                                          memory/3920-13-0x000001E32BF60000-0x000001E32C146000-memory.dmp
                                          Download

                                          memory/3920-1-0x000001E32C150000-0x000001E32C608000-memory.dmp
                                          Download