Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
57s -
max time network
37s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23/02/2024, 00:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
microsoft office 2007 service pack 2.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
microsoft office 2007 service pack 2.exe
Resource
win10v2004-20240221-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
microsoft office 2007 service pack 2.exe
-
Size
174KB
-
MD5
223977bfe475775f06a35f006aa81711
-
SHA1
699c517c943fa31fd70ebc342c94ec8cc3ed62ad
-
SHA256
0d8f1efd9e5617db2d6c9534b571818e7bcd58a1ccf0e365a9c0628dee63dcde
-
SHA512
7ba04a442401e043729c3d91869a5a8b7e272b99d8814f016b0d9863f12b7d91f37d98c7ac37ad9fe56efce67b6ba12008f9ef475936e1ccdb02447c6c0577f6
-
SSDEEP
3072:snOn7t7XpdpCCTg/sxFgJDjJCyOOZcjgMPbqXAp3bW/8zDdKtqtvEi0VbeOPr2U:sKpdcCrTqoZOZczpLWUFQjjbeA
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2516 northstar.exe -
Loads dropped DLL 3 IoCs
pid Process 2928 microsoft office 2007 service pack 2.exe 2928 microsoft office 2007 service pack 2.exe 2928 microsoft office 2007 service pack 2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 northstar.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c909000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c01400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e52000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a northstar.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e51d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af33313353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703030f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c92000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a northstar.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c909000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c01400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a northstar.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
pid Process 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1724 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1724 taskmgr.exe -
Suspicious use of FindShellTrayWindow 50 IoCs
pid Process 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe -
Suspicious use of SendNotifyMessage 49 IoCs
pid Process 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe 1724 taskmgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2516 northstar.exe 2516 northstar.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2928 wrote to memory of 2516 2928 microsoft office 2007 service pack 2.exe 28 PID 2928 wrote to memory of 2516 2928 microsoft office 2007 service pack 2.exe 28 PID 2928 wrote to memory of 2516 2928 microsoft office 2007 service pack 2.exe 28 PID 2928 wrote to memory of 2516 2928 microsoft office 2007 service pack 2.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\microsoft office 2007 service pack 2.exe"C:\Users\Admin\AppData\Local\Temp\microsoft office 2007 service pack 2.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\nsd3B5D.tmp\northstar.exeC:\Users\Admin\AppData\Local\Temp\nsd3B5D.tmp\northstar.exe /u4dc9054e-38b0-4614-bdd5-20605bc06f26 /e2604885 /dT2012122715152⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
PID:2516
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1724
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
21KB
MD55ebc73650256e9c8ddbcda231db829a1
SHA1988d4535e18754ab2a6248abae96c5697d7dbcd5
SHA2561eaa543842df7795404184e8892a1654b0773dbc9bd8b54c7fdb9e68f4355493
SHA512b21266e76fc7263af982a1336a766e47ccf348ed56b305dbb09f03574c9b2a7309f12200e80d86f9a251381be6e87a41206447f11c51899cb31fba10da1d5270
-
Filesize
275KB
MD5a1e2472db630c7043c2fb486a17300bc
SHA1f289644ce703d4050b49ec0606c543a8f3928624
SHA2560e990e290a6c3b4b3a3ac7495bfc197b698799ae840a06586eb5d5cbe74a1bd7
SHA5123571478424b464b17ef58f43ffca57e09e539e4b83ed1a158694ab4f473001ceb37cb72c850d701767625d515f129a14a1f60446ace745517658923467b01823