Analysis
- max time kernel
149s - max time network
125s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
17/10/2026, 13:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bloxsense_crack.exe
Resource
win10ltsc2021-20260911-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
bloxsense_crack.exe
Resource
win11-20260911-en
6 signatures
150 seconds
General
- Target bloxsense_crack.exe
- Size 1.9MB
- Sample261017-q8dncsfc52
- SHA256 38cb0f434d982045ba1e725463fb32f3c8e16178d09f12bcdd45f79a12396e1d
- MD5 5d4c876e8e24214a353d31c186c340ec
- SHA1 fd5c24e43ba64294541a8f8fb07c7b347e97d5f0
- SHA512 72cf736d5057ae7f01733a396ffadaaa3d66a57b14130c873eb22311ac264f2765d7ed103b668256f51e50e8f0eb79b7c0960290cf609eb26654d5a6cfd3d415
- SSDEEP 49152:zWcVCX4FR6okDxVAnfWEgAFFBM2y6r/VWr/tnU5b:UsRUfIfbwLm/orK
- TLSH T1AD95E001F2B501EDD06BD1789597BE1BEAB5B48807206ACB13E049592FF27E41BF7B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions bloxsense_crack.exe - Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools bloxsense_crack.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS bloxsense_crack.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer bloxsense_crack.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName bloxsense_crack.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3132 bloxsense_crack.exe 3132 bloxsense_crack.exe 3132 bloxsense_crack.exe 3132 bloxsense_crack.exe 3132 bloxsense_crack.exe 3132 bloxsense_crack.exe 3132 bloxsense_crack.exe 3132 bloxsense_crack.exe 3132 bloxsense_crack.exe 3132 bloxsense_crack.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3132 bloxsense_crack.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3132 bloxsense_crack.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bloxsense_crack.exe"C:\Users\Admin\AppData\Local\Temp\bloxsense_crack.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3132
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\BLOXSENSE\crash.txt
- Size 2KB
- SHA256 68506c7093618140fd2fef06e463e66cdec011924c03188bf821b918411ec12f
- MD5 c8670c026b74c57785aba407aaa23864
- SHA1 e4123a6ca9921bad5cea7ef72d68ce064e1ec633
- SHA512 5c9fe99a8f46cc721440293bf44d01e8e92feef6d47a18dfc5efa3342285594587b4c85f97acd5cada17c1f7fe32c4c162636857182d803e3e68a3cde5f42cd5
- TLSH T133416D1196D4D3D8F83D404D1E663A6CC09EF40302E95C87FDAED6C89FB87B2160691D
- MD5 SHA1 SHA512 TLSH
- Path C:\BLOXSENSE\crash.txt
- Size 149B
- SHA256 f6de1a0ccbaf2caf28a2fa3ede7736dcd55bac293a5ba8c80720575bd6228f17
- MD5 2ce59fb89a92e0c814c9856a953067d5
- SHA1 71de1e9428b3f3bdd834ce2f7031624343361eb7
- SHA512 f75034045ba03af60b1b631afd6481fe881bc5f5e8a5f0088041ce4bffa7d87f48664026333b08584847eb0f93b156ca48b7a8d6cdf716908439a202857f13f7
- TLSH T164C022230A28AA00E8880B0B820838CC3088320320CC22288CE08F800FA32822FCC328
- MD5 SHA1 SHA512 TLSH