Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
15/10/2023, 19:51
Static task
static1
Behavioral task
behavioral1
Sample
fb0c71d71ee6d447a5c498cd12f4f050_exe32.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
fb0c71d71ee6d447a5c498cd12f4f050_exe32.exe
Resource
win10v2004-20230915-en
General
-
Target
fb0c71d71ee6d447a5c498cd12f4f050_exe32.exe
-
Size
204KB
-
MD5
fb0c71d71ee6d447a5c498cd12f4f050
-
SHA1
c03638ae78e882d1e1b59b5a6654772100bc024b
-
SHA256
3f101c958bf7aaacfcd0a8285595583282ab9a02df2f98367004edda7eaf7763
-
SHA512
410eb5cd3bbb328207a47b42b8d7cd5b92e696af0ef0703e4849578a4892be6214113c44e067544e960dd8c39064d2c9e2c1d476e01b369d3fe4199653ec9fb0
-
SSDEEP
3072:lOmsW8f0tQ9nLHbB9W0c1TqECzR/mkSYGrl9ymgYUWBc:l5hs4QxL7B9W0c1RCzR/fSmlH
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" fb0c71d71ee6d447a5c498cd12f4f050_exe32.exe Set value (int) \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" foqim.exe -
Executes dropped EXE 1 IoCs
pid Process 1344 foqim.exe -
Loads dropped DLL 2 IoCs
pid Process 2212 fb0c71d71ee6d447a5c498cd12f4f050_exe32.exe 2212 fb0c71d71ee6d447a5c498cd12f4f050_exe32.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Run\foqim = "C:\\Users\\Admin\\foqim.exe /h" foqim.exe Set value (str) \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Run\foqim = "C:\\Users\\Admin\\foqim.exe /s" foqim.exe Set value (str) \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Run\foqim = "C:\\Users\\Admin\\foqim.exe /t" foqim.exe Set value (str) \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Run\foqim = "C:\\Users\\Admin\\foqim.exe /u" foqim.exe Set value (str) \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Run\foqim = "C:\\Users\\Admin\\foqim.exe /e" foqim.exe Set value (str) \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Run\foqim = "C:\\Users\\Admin\\foqim.exe /p" foqim.exe Set value (str) \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Run\foqim = "C:\\Users\\Admin\\foqim.exe /j" foqim.exe Set value (str) \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Run\foqim = "C:\\Users\\Admin\\foqim.exe /c" foqim.exe Set value (str) \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Run\foqim = "C:\\Users\\Admin\\foqim.exe /a" foqim.exe Set value (str) \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Run\foqim = "C:\\Users\\Admin\\foqim.exe /l" foqim.exe Set value (str) \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Run\foqim = "C:\\Users\\Admin\\foqim.exe /n" foqim.exe Set value (str) \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Run\foqim = "C:\\Users\\Admin\\foqim.exe /z" fb0c71d71ee6d447a5c498cd12f4f050_exe32.exe Set value (str) \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Run\foqim = "C:\\Users\\Admin\\foqim.exe /q" foqim.exe Set value (str) \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Run\foqim = "C:\\Users\\Admin\\foqim.exe /k" foqim.exe Set value (str) \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Run\foqim = "C:\\Users\\Admin\\foqim.exe /w" foqim.exe Set value (str) \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Run\foqim = "C:\\Users\\Admin\\foqim.exe /o" foqim.exe Set value (str) \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Run\foqim = "C:\\Users\\Admin\\foqim.exe /m" foqim.exe Set value (str) \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Run\foqim = "C:\\Users\\Admin\\foqim.exe /d" foqim.exe Set value (str) \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Run\foqim = "C:\\Users\\Admin\\foqim.exe /y" foqim.exe Set value (str) \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Run\foqim = "C:\\Users\\Admin\\foqim.exe /f" foqim.exe Set value (str) \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Run\foqim = "C:\\Users\\Admin\\foqim.exe /b" foqim.exe Set value (str) \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Run\foqim = "C:\\Users\\Admin\\foqim.exe /g" foqim.exe Set value (str) \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Run\foqim = "C:\\Users\\Admin\\foqim.exe /r" foqim.exe Set value (str) \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Run\foqim = "C:\\Users\\Admin\\foqim.exe /x" foqim.exe Set value (str) \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Run\foqim = "C:\\Users\\Admin\\foqim.exe /v" foqim.exe Set value (str) \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Run\foqim = "C:\\Users\\Admin\\foqim.exe /i" foqim.exe Set value (str) \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Run\foqim = "C:\\Users\\Admin\\foqim.exe /z" foqim.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2212 fb0c71d71ee6d447a5c498cd12f4f050_exe32.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe 1344 foqim.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2212 fb0c71d71ee6d447a5c498cd12f4f050_exe32.exe 1344 foqim.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2212 wrote to memory of 1344 2212 fb0c71d71ee6d447a5c498cd12f4f050_exe32.exe 28 PID 2212 wrote to memory of 1344 2212 fb0c71d71ee6d447a5c498cd12f4f050_exe32.exe 28 PID 2212 wrote to memory of 1344 2212 fb0c71d71ee6d447a5c498cd12f4f050_exe32.exe 28 PID 2212 wrote to memory of 1344 2212 fb0c71d71ee6d447a5c498cd12f4f050_exe32.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb0c71d71ee6d447a5c498cd12f4f050_exe32.exe"C:\Users\Admin\AppData\Local\Temp\fb0c71d71ee6d447a5c498cd12f4f050_exe32.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\foqim.exe"C:\Users\Admin\foqim.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1344
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB
MD522207c0c00caaab00d924c5551adacc0
SHA10cdc1b6eb0db63777b0aac098aafa23b40f06e63
SHA256bbf800b0cb30aa6953bfa0dad248da3d32eef95c15402de92fe15eb60b3be2eb
SHA51259dfeca076df5b6a57efff459dac41f696d0adafaa45031b32872771830a9fa01e51f96d97ea03bb392ca38708fee9e85a89689f7f365e030bc6e6d8ece70e6a
-
Filesize
204KB
MD522207c0c00caaab00d924c5551adacc0
SHA10cdc1b6eb0db63777b0aac098aafa23b40f06e63
SHA256bbf800b0cb30aa6953bfa0dad248da3d32eef95c15402de92fe15eb60b3be2eb
SHA51259dfeca076df5b6a57efff459dac41f696d0adafaa45031b32872771830a9fa01e51f96d97ea03bb392ca38708fee9e85a89689f7f365e030bc6e6d8ece70e6a
-
Filesize
204KB
MD522207c0c00caaab00d924c5551adacc0
SHA10cdc1b6eb0db63777b0aac098aafa23b40f06e63
SHA256bbf800b0cb30aa6953bfa0dad248da3d32eef95c15402de92fe15eb60b3be2eb
SHA51259dfeca076df5b6a57efff459dac41f696d0adafaa45031b32872771830a9fa01e51f96d97ea03bb392ca38708fee9e85a89689f7f365e030bc6e6d8ece70e6a
-
Filesize
204KB
MD522207c0c00caaab00d924c5551adacc0
SHA10cdc1b6eb0db63777b0aac098aafa23b40f06e63
SHA256bbf800b0cb30aa6953bfa0dad248da3d32eef95c15402de92fe15eb60b3be2eb
SHA51259dfeca076df5b6a57efff459dac41f696d0adafaa45031b32872771830a9fa01e51f96d97ea03bb392ca38708fee9e85a89689f7f365e030bc6e6d8ece70e6a
-
Filesize
204KB
MD522207c0c00caaab00d924c5551adacc0
SHA10cdc1b6eb0db63777b0aac098aafa23b40f06e63
SHA256bbf800b0cb30aa6953bfa0dad248da3d32eef95c15402de92fe15eb60b3be2eb
SHA51259dfeca076df5b6a57efff459dac41f696d0adafaa45031b32872771830a9fa01e51f96d97ea03bb392ca38708fee9e85a89689f7f365e030bc6e6d8ece70e6a