Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
17s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
01/12/2022, 09:08
Static task
static1
Behavioral task
behavioral1
Sample
dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe
Resource
win10v2004-20221111-en
General
-
Target
dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe
-
Size
7KB
-
MD5
dd8ff67f3f997d2d0ed7e5638b200411
-
SHA1
35ceb758db8984d2549bd24f702db74717540a88
-
SHA256
dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228
-
SHA512
43c97275daf24087fa1a3e2f51e0f9d71b9dcc8cfe4a17af91dcbbe0699f22d30e31e221d241ca5f64dde88487a24c1b048a604a996a82cbd0fea10e1762fd34
-
SSDEEP
192:aeIZpTxEZzsgG+qxTiHf8v3HmYIPvij5/agJD116bO0X:dETeq9+qsEPmBP8agR114nX
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\v.exe = "C:\\Windows\\system32\\ghdrmbkqkv.exe" dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\ghdrmbkqkv.exe dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe -
Enumerates system info in registry 2 TTPs 42 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1 dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000 dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0 dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0 dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1 dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000 dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0 dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0 dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe"C:\Users\Admin\AppData\Local\Temp\dd36e0274717b91507b00b0ce35ef28669739958c7e0db2c94671b3c4258c228.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:1348