Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
05/01/2024, 09:00
Behavioral task
behavioral1
Sample
434868e3e9110f4b1dd8612189482131.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
434868e3e9110f4b1dd8612189482131.exe
Resource
win10v2004-20231215-en
General
-
Target
434868e3e9110f4b1dd8612189482131.exe
-
Size
97KB
-
MD5
434868e3e9110f4b1dd8612189482131
-
SHA1
f2caed1c8f9b009c7d33c56b0e16ada2a1d50854
-
SHA256
90ae15f8416ef6d07adff15ed8cb0655eb3efeb345e8099b6848c4acebcbfcee
-
SHA512
be60746cc82d7f4169b9b80827b554d5a4a9b6ade886950d09885a494014e261e706857da159d620a878d84c504427bf480fbf93c7a28c9940785fe0cebd9bff
-
SSDEEP
3072:+7m32cZ8UtE2UvMzSKMLTQ7ja8qULZsJg/:+K3fo5yo3Q7ja8qe
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2588 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2948 PostTip.exe -
Loads dropped DLL 6 IoCs
pid Process 2904 regsvr32.exe 2968 434868e3e9110f4b1dd8612189482131.exe 2968 434868e3e9110f4b1dd8612189482131.exe 2948 PostTip.exe 2948 PostTip.exe 2948 PostTip.exe -
resource yara_rule behavioral1/memory/2968-26-0x0000000000400000-0x0000000000448000-memory.dmp upx behavioral1/memory/2968-1-0x00000000003A0000-0x00000000003E8000-memory.dmp upx behavioral1/memory/2968-0-0x0000000000400000-0x0000000000448000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PostTip = "C:\\Program Files (x86)\\PostTip\\PostTip.exe" PostTip.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{C4BF6897-41A2-454b-AC3B-437F30BEA671} regsvr32.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\PostTip\PostTip.exe 434868e3e9110f4b1dd8612189482131.exe File created C:\Program Files (x86)\PostTip\PostTip.dll 434868e3e9110f4b1dd8612189482131.exe File created C:\Program Files (x86)\PostTip\uninstall.exe 434868e3e9110f4b1dd8612189482131.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 46 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A12EF54F-2691-4C32-AC1B-F65D144A3988}\1.0\ = "SideTab 1.0 Type Library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E2B006B6-159A-4384-B05C-4B5511C16354}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E2B006B6-159A-4384-B05C-4B5511C16354}\TypeLib\ = "{A12EF54F-2691-4C32-AC1B-F65D144A3988}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\VersionIndependentProgID\ = "SideTab.SideTabCtl" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A12EF54F-2691-4C32-AC1B-F65D144A3988}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A12EF54F-2691-4C32-AC1B-F65D144A3988}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E2B006B6-159A-4384-B05C-4B5511C16354} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E2B006B6-159A-4384-B05C-4B5511C16354}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E2B006B6-159A-4384-B05C-4B5511C16354}\ = "ISideTabCtl" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E2B006B6-159A-4384-B05C-4B5511C16354}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SideTab.SideTabCtl.1\CLSID\ = "{C4BF6897-41A2-454b-AC3B-437F30BEA671}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A12EF54F-2691-4C32-AC1B-F65D144A3988}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E2B006B6-159A-4384-B05C-4B5511C16354}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SideTab.SideTabCtl.1\ = "SideTabCtl Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\InprocServer32\ = "C:\\Program Files (x86)\\PostTip\\PostTip.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\ = "PostTip" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A12EF54F-2691-4C32-AC1B-F65D144A3988} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E2B006B6-159A-4384-B05C-4B5511C16354}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SideTab.SideTabCtl\ = "SideTabCtl Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SideTab.SideTabCtl\CLSID\ = "{C4BF6897-41A2-454b-AC3B-437F30BEA671}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SideTab.SideTabCtl\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\TypeLib\ = "{A12EF54F-2691-4C32-AC1B-F65D144A3988}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A12EF54F-2691-4C32-AC1B-F65D144A3988}\1.0\0\win32\ = "C:\\Program Files (x86)\\PostTip\\PostTip.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SideTab.SideTabCtl.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SideTab.SideTabCtl regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A12EF54F-2691-4C32-AC1B-F65D144A3988}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A12EF54F-2691-4C32-AC1B-F65D144A3988}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E2B006B6-159A-4384-B05C-4B5511C16354}\ = "ISideTabCtl" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E2B006B6-159A-4384-B05C-4B5511C16354}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E2B006B6-159A-4384-B05C-4B5511C16354}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SideTab.SideTabCtl.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\ProgID\ = "SideTab.SideTabCtl.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A12EF54F-2691-4C32-AC1B-F65D144A3988}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A12EF54F-2691-4C32-AC1B-F65D144A3988}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\PostTip\\" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E2B006B6-159A-4384-B05C-4B5511C16354}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E2B006B6-159A-4384-B05C-4B5511C16354}\TypeLib\ = "{A12EF54F-2691-4C32-AC1B-F65D144A3988}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SideTab.SideTabCtl\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SideTab.SideTabCtl\CurVer\ = "SideTab.SideTabCtl.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E2B006B6-159A-4384-B05C-4B5511C16354} regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2968 434868e3e9110f4b1dd8612189482131.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 2968 434868e3e9110f4b1dd8612189482131.exe Token: SeBackupPrivilege 2968 434868e3e9110f4b1dd8612189482131.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2968 434868e3e9110f4b1dd8612189482131.exe 2968 434868e3e9110f4b1dd8612189482131.exe 2948 PostTip.exe 2948 PostTip.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2968 wrote to memory of 2904 2968 434868e3e9110f4b1dd8612189482131.exe 20 PID 2968 wrote to memory of 2904 2968 434868e3e9110f4b1dd8612189482131.exe 20 PID 2968 wrote to memory of 2904 2968 434868e3e9110f4b1dd8612189482131.exe 20 PID 2968 wrote to memory of 2904 2968 434868e3e9110f4b1dd8612189482131.exe 20 PID 2968 wrote to memory of 2904 2968 434868e3e9110f4b1dd8612189482131.exe 20 PID 2968 wrote to memory of 2904 2968 434868e3e9110f4b1dd8612189482131.exe 20 PID 2968 wrote to memory of 2904 2968 434868e3e9110f4b1dd8612189482131.exe 20 PID 2968 wrote to memory of 2948 2968 434868e3e9110f4b1dd8612189482131.exe 19 PID 2968 wrote to memory of 2948 2968 434868e3e9110f4b1dd8612189482131.exe 19 PID 2968 wrote to memory of 2948 2968 434868e3e9110f4b1dd8612189482131.exe 19 PID 2968 wrote to memory of 2948 2968 434868e3e9110f4b1dd8612189482131.exe 19 PID 2968 wrote to memory of 2948 2968 434868e3e9110f4b1dd8612189482131.exe 19 PID 2968 wrote to memory of 2948 2968 434868e3e9110f4b1dd8612189482131.exe 19 PID 2968 wrote to memory of 2948 2968 434868e3e9110f4b1dd8612189482131.exe 19 PID 2968 wrote to memory of 2588 2968 434868e3e9110f4b1dd8612189482131.exe 18 PID 2968 wrote to memory of 2588 2968 434868e3e9110f4b1dd8612189482131.exe 18 PID 2968 wrote to memory of 2588 2968 434868e3e9110f4b1dd8612189482131.exe 18 PID 2968 wrote to memory of 2588 2968 434868e3e9110f4b1dd8612189482131.exe 18 PID 2968 wrote to memory of 2588 2968 434868e3e9110f4b1dd8612189482131.exe 18 PID 2968 wrote to memory of 2588 2968 434868e3e9110f4b1dd8612189482131.exe 18 PID 2968 wrote to memory of 2588 2968 434868e3e9110f4b1dd8612189482131.exe 18 PID 2948 wrote to memory of 2564 2948 PostTip.exe 17 PID 2948 wrote to memory of 2564 2948 PostTip.exe 17 PID 2948 wrote to memory of 2564 2948 PostTip.exe 17 PID 2948 wrote to memory of 2564 2948 PostTip.exe 17 PID 2948 wrote to memory of 2564 2948 PostTip.exe 17 PID 2948 wrote to memory of 2564 2948 PostTip.exe 17 PID 2948 wrote to memory of 2564 2948 PostTip.exe 17
Processes
-
C:\Users\Admin\AppData\Local\Temp\434868e3e9110f4b1dd8612189482131.exe"C:\Users\Admin\AppData\Local\Temp\434868e3e9110f4b1dd8612189482131.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\SysWOW64\cmd.execmd /c \DelUS.bat2⤵
- Deletes itself
PID:2588
-
-
C:\Program Files (x86)\PostTip\PostTip.exe"C:\Program Files (x86)\PostTip\PostTip.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2948
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Program Files (x86)\PostTip\PostTip.dll"2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:2904
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Program Files (x86)\PostTip\PostTip.dll"1⤵PID:2564
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
243B
MD5658e675316e831edd1860e1d1c0ee2e9
SHA14bcafa8b2300a39e127e231257a207cc224c2d53
SHA2566396aa960a07c812e6399f7e5fb97993940ff2d3d542e9d4db2002c6dc6b727f
SHA51272b92c85e6fc6211dfb26e2f922c22ea1004f22224dd87504c6b8e1b48a06bf14f53d3282d8aa92bcf447b8bd3727346f0b1d7fe7ee616b39f949de8a373d5f8
-
Filesize
20KB
MD5f5253fa1969187f737544503a8f997f7
SHA1fbb910f6dc8eff7d53dd0323870750df1f06ad7c
SHA2563bba79e2e78129f372364d3ba37309c4d48a286c52f26b17b5ec9bdd40cabcad
SHA512d6b4f17e8d155a247fe4d53a9b1664efbf989d577e4896b0a0dd4f9054fe97764b47e1420e3fb050cb08d6f74137c449411a8fb45849b7b70d7d777b34bd4f0f
-
Filesize
33KB
MD5a8c3d5898b69246333d8cfa021bbe399
SHA16f5b171a93cc1c2e5a201751cd8ac9c43dbe9a88
SHA2568802cbbc4785fcd9e6ad0f163804f8cf49f9129a893c6bca15fec2d446ff5c04
SHA512392cd8cddbf7d540b235eb1b10e790106d1bbf7c14a84419ceb1bbebed1d96131313fe59881f010ad58bd121d1700bb59578b8fea81dde4c81ec3980cadeeb86
-
Filesize
9KB
MD53e450dcebb7acd69dff73dfe3aa8899e
SHA128f1fd6667b4beaac56fb2b7583db7b6614cc9ec
SHA256378774c4a122238011c7f46692ea008a338d16ac2caadbe3275e9405d777e18b
SHA5126610e1f630368977bd3427d6202b162689d87fe3ac83bb1dc537ac4a8a7acd21ae447d4cfbe2d6507b762ae345d170b85669ce450d5c7f7aa8e65655345da60a
-
Filesize
45KB
MD5f32f15773ac237431735793cf54a589b
SHA132c101c92e28103c370ddb89f35d7b8509f83bae
SHA256a99a2f6074dfa9e55a95ea894081d3ecc32ac19ee572c3ad554a083282e204a2
SHA5121e522f73922a79ef9af0bb8d8d066ca322b64f60ec97001bace5cc822dd88b0e09c4111fec63f27c2340de4f167dd5adeae5eab0d832a2bd1fafab19f42d55a9
-
Filesize
65KB
MD58437914f9da1dc20b6439d9d901ff14b
SHA17b931496603c585ee76e4c5715d7507bb82e5f83
SHA25612422e49396b3352538bae8982ada75f9d81a253292f6f9189d7a79b9ac208be
SHA512994216e74809b50f0f0e29c31aedc4f083a5d1c564c10c8e19d97331b8c925430e3e1906e1f2ef61933926f0bf39ef9b7c8686735b5880fcd6d4d04734cb9b3a
-
Filesize
38KB
MD5c2b5be376cac31c0b01603105ae4ea89
SHA14fcfa0181ca5478103c6999199957be40f4a937b
SHA2568ec9ca043b655d4bf868ccd7d9d5fdd4e23ad8610aed2fb983370437b7851feb
SHA512d17e798a414a6d2295f13339a10151f2a34cff5a7d6c81862c26a0c4ac831bf9f867f9f2bf028fa15f189a93f8d8883a334a9857a33bcabac916376267c9da72