Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    911s
  • max time network
    1593s
  • platform
    windows10-1703_x64
  • resource
    win10-20220901-es
  • resource tags

    arch:x64arch:x86image:win10-20220901-eslocale:es-esos:windows10-1703-x64systemwindows
  • submitted
    13/01/2023, 16:33

General

  • Target

    OperaGXSetup.exe

  • Size

    3.4MB

  • MD5

    14057fd79d3e628917df7ea6e42f242c

  • SHA1

    2e725f7e85df109a3e7d69212ae0f0146530be25

  • SHA256

    5056c2e60199f3f2b6022d275f836c4436996a18f0b9de25c72a55903dd6917d

  • SHA512

    a6e6e5d9bbc7fbc8d38d853b3a0bb60372c48effd2fcd2231a60cb6d444715aa03d627fbc8aae9c2f86fffc81a177328f0130678c2b2e001cbaecc21da42185f

  • SSDEEP

    98304:efvQdrJ6UDSClG4jHSZGf6a3lzwsdcOmiurHZ9MfvkTIWFh1SR:efIhDmVeshDtVi

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies system certificate store 2 TTPs 13 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • Modifies system certificate store
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2868
    • C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
      C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=94.0.4606.64 --initial-client-data=0x2c0,0x2c4,0x2c8,0x298,0x2cc,0x741ee660,0x741ee670,0x741ee67c
      2⤵
      • Loads dropped DLL
      PID:2316
    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\OperaGXSetup.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\OperaGXSetup.exe" --version
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:788
    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202301131634471\assistant\_sfx.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202301131634471\assistant\_sfx.exe"
      2⤵
      • Executes dropped EXE
      PID:4532
    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202301131634471\assistant\assistant_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202301131634471\assistant\assistant_installer.exe" --version
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4696
      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202301131634471\assistant\assistant_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202301131634471\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0xb84f48,0xb84f58,0xb84f64
        3⤵
        • Executes dropped EXE
        PID:700

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\OperaGXSetup.exe

    Filesize

    3.4MB

    MD5

    14057fd79d3e628917df7ea6e42f242c

    SHA1

    2e725f7e85df109a3e7d69212ae0f0146530be25

    SHA256

    5056c2e60199f3f2b6022d275f836c4436996a18f0b9de25c72a55903dd6917d

    SHA512

    a6e6e5d9bbc7fbc8d38d853b3a0bb60372c48effd2fcd2231a60cb6d444715aa03d627fbc8aae9c2f86fffc81a177328f0130678c2b2e001cbaecc21da42185f

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202301131634471\assistant\_sfx.exe

    Filesize

    1.4MB

    MD5

    e9a2209b61f4be34f25069a6e54affea

    SHA1

    6368b0a81608c701b06b97aeff194ce88fd0e3c0

    SHA256

    e950f17f4181009eeafa9f5306e8a9dfd26d88ca63b1838f44ff0efc738e7d1f

    SHA512

    59e46277ca79a43ed8b0a25b24eff013e251a75f90587e013b9c12851e5dd7283b6172f7d48583982f6a32069457778ee440025c1c754bf7bb6ce8ae1d2c3fc5

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202301131634471\assistant\_sfx.exe

    Filesize

    1.4MB

    MD5

    e9a2209b61f4be34f25069a6e54affea

    SHA1

    6368b0a81608c701b06b97aeff194ce88fd0e3c0

    SHA256

    e950f17f4181009eeafa9f5306e8a9dfd26d88ca63b1838f44ff0efc738e7d1f

    SHA512

    59e46277ca79a43ed8b0a25b24eff013e251a75f90587e013b9c12851e5dd7283b6172f7d48583982f6a32069457778ee440025c1c754bf7bb6ce8ae1d2c3fc5

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202301131634471\assistant\assistant_installer.exe

    Filesize

    1.8MB

    MD5

    4c8fbed0044da34ad25f781c3d117a66

    SHA1

    8dd93340e3d09de993c3bc12db82680a8e69d653

    SHA256

    afe569ce9e4f71c23ba5f6e8fd32be62ac9538e397cde8f2ecbe46faa721242a

    SHA512

    a04e6fd052d2d63a0737c83702c66a9af834f9df8423666508c42b3e1d8384300239c9ddacdc31c1e85140eb1193bcfac209f218750b40342492ffce6e9da481

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202301131634471\assistant\assistant_installer.exe

    Filesize

    1.8MB

    MD5

    4c8fbed0044da34ad25f781c3d117a66

    SHA1

    8dd93340e3d09de993c3bc12db82680a8e69d653

    SHA256

    afe569ce9e4f71c23ba5f6e8fd32be62ac9538e397cde8f2ecbe46faa721242a

    SHA512

    a04e6fd052d2d63a0737c83702c66a9af834f9df8423666508c42b3e1d8384300239c9ddacdc31c1e85140eb1193bcfac209f218750b40342492ffce6e9da481

  • C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat

    Filesize

    40B

    MD5

    71b31ebb55a755b88c6f5a94f1819b08

    SHA1

    a25087739c9105943cee8032c70964d9a9deafeb

    SHA256

    90f3690147eb3c6f89be115748c012e685a769fdcc099d4b597bc58b9a7aef87

    SHA512

    6ea2dbf8d2444911e74b705e4c56252516e9d4156d133b22471622c1c4489c5f9cf0662c22a073659763dd70add8510b47a74422e7a34d6dfcbb8c8bfe0d0ea4

  • \Users\Admin\AppData\Local\Temp\Opera_installer_2301131634363302868.dll

    Filesize

    5.0MB

    MD5

    7bb70371a11bb9dcff908628a301881a

    SHA1

    79028dbf7d7b99d5b3dabd94fee21a55e09212f8

    SHA256

    f61b6d7079c1944164a64d065a40ea12d4c429a0aa77c5b82b956c48a561fcbe

    SHA512

    d73812c0523df3d4fee8f09702c9534c0640991b1d6858ff5a477699124de1cb8f754f8d2a24eabea4448c169d16695e2b509fde6964b52d018ffdae1f12287e

  • \Users\Admin\AppData\Local\Temp\Opera_installer_2301131634433152316.dll

    Filesize

    5.0MB

    MD5

    7bb70371a11bb9dcff908628a301881a

    SHA1

    79028dbf7d7b99d5b3dabd94fee21a55e09212f8

    SHA256

    f61b6d7079c1944164a64d065a40ea12d4c429a0aa77c5b82b956c48a561fcbe

    SHA512

    d73812c0523df3d4fee8f09702c9534c0640991b1d6858ff5a477699124de1cb8f754f8d2a24eabea4448c169d16695e2b509fde6964b52d018ffdae1f12287e

  • \Users\Admin\AppData\Local\Temp\Opera_installer_230113163444939788.dll

    Filesize

    5.0MB

    MD5

    7bb70371a11bb9dcff908628a301881a

    SHA1

    79028dbf7d7b99d5b3dabd94fee21a55e09212f8

    SHA256

    f61b6d7079c1944164a64d065a40ea12d4c429a0aa77c5b82b956c48a561fcbe

    SHA512

    d73812c0523df3d4fee8f09702c9534c0640991b1d6858ff5a477699124de1cb8f754f8d2a24eabea4448c169d16695e2b509fde6964b52d018ffdae1f12287e

  • memory/788-317-0x0000000000400000-0x00000000009AC000-memory.dmp

    Filesize

    5.7MB

  • memory/788-269-0x0000000000400000-0x00000000009AC000-memory.dmp

    Filesize

    5.7MB

  • memory/2316-183-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2316-186-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2316-185-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2316-184-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2316-182-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2316-181-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2316-180-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2316-179-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2316-178-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2316-177-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2316-343-0x0000000000400000-0x00000000009AC000-memory.dmp

    Filesize

    5.7MB

  • memory/2316-176-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-140-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-146-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-148-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-149-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-150-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-151-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-152-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-153-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-154-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-155-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-156-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-157-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-158-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-159-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-160-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-161-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-162-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-163-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-164-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-166-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-165-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-167-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-168-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-170-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-169-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-171-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-172-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-173-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-174-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-147-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-145-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-144-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-142-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-141-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-120-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-139-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-138-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-137-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-136-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-135-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-134-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-133-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-132-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-131-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-127-0x0000000000400000-0x00000000009AC000-memory.dmp

    Filesize

    5.7MB

  • memory/2868-266-0x0000000000400000-0x00000000009AC000-memory.dmp

    Filesize

    5.7MB

  • memory/2868-130-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-129-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-128-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-121-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-126-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-125-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-122-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-124-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-123-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

    Filesize

    1.6MB