Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
26/04/2024, 11:19
Static task
static1
Behavioral task
behavioral1
Sample
FoxiWare W11 Support.rar
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
FoxiWare W11 Support.rar
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
foxiwareW11.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
foxiwareW11.exe
Resource
win10v2004-20240419-en
General
-
Target
FoxiWare W11 Support.rar
-
Size
682KB
-
MD5
6dde9d167b55c0945de83eb8b518e75d
-
SHA1
463dfa8f5c6dd774cc05f9ca0cbb6e3d7c981218
-
SHA256
bcc9b82f4b261b15c94e811e3375734b568412b81ae90e5a3ed5a823e8ba9b79
-
SHA512
1852d44fe1ec0db03a76f3c665f82a171cbde3a19f467254239acb214e68fec9dfdcb7db0e6acabc8505402940a4d6b907f7ef18ece0fd38571142db9a62e306
-
SSDEEP
12288:zq+PSawQjRvM8ZJxbYLVMUzZ+GxfamFjY/RSSjiV9dMMkc5u:eTO5YLVMUImJuRsVJkr
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1848 wrote to memory of 2768 1848 cmd.exe 29 PID 1848 wrote to memory of 2768 1848 cmd.exe 29 PID 1848 wrote to memory of 2768 1848 cmd.exe 29
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\FoxiWare W11 Support.rar"1⤵
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\FoxiWare W11 Support.rar2⤵
- Modifies registry class
PID:2768
-