Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    74s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/02/2023, 03:58

General

  • Target

    OperaGXSetup.exe

  • Size

    3.4MB

  • MD5

    5a5fa99bc4eaaa6aa2824a8db83d513d

  • SHA1

    3e2ecbe54b99669c5f76b4030d9a8b1c2a20e8ef

  • SHA256

    a94938de21291917b26e8b4b5869a220d5eaf343d7dfefa618da7f431846b1d9

  • SHA512

    e9ce5b892d02071d23d44af0d28c54147a3704948588e1fcd25223d678ac12832ba47d33bb8b2b3828a42a7c9d934885424bdf67e1d308d4f6e54e38abff873f

  • SSDEEP

    98304:SCsF86gzedOMDfRSi/8cJGPxUtGGZD3XdB9RhQCUKVPaUolc5lkqqmtYUkmxmv:Sf85zIF1JGP6thQiVPXUZ

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies system certificate store 2 TTPs 13 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • Modifies system certificate store
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4940
    • C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
      C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=93.0.4585.72 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2d0,0x300,0x753a76a0,0x753a76b0,0x753a76bc
      2⤵
      • Loads dropped DLL
      PID:1460
    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\OperaGXSetup.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\OperaGXSetup.exe" --version
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4924
    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202302040459021\assistant\_sfx.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202302040459021\assistant\_sfx.exe"
      2⤵
      • Executes dropped EXE
      PID:400
    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202302040459021\assistant\assistant_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202302040459021\assistant\assistant_installer.exe" --version
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1480
      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202302040459021\assistant\assistant_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202302040459021\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0x204f48,0x204f58,0x204f64
        3⤵
        • Executes dropped EXE
        PID:1832

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\OperaGXSetup.exe

    Filesize

    3.4MB

    MD5

    5a5fa99bc4eaaa6aa2824a8db83d513d

    SHA1

    3e2ecbe54b99669c5f76b4030d9a8b1c2a20e8ef

    SHA256

    a94938de21291917b26e8b4b5869a220d5eaf343d7dfefa618da7f431846b1d9

    SHA512

    e9ce5b892d02071d23d44af0d28c54147a3704948588e1fcd25223d678ac12832ba47d33bb8b2b3828a42a7c9d934885424bdf67e1d308d4f6e54e38abff873f

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202302040459021\assistant\_sfx.exe

    Filesize

    1.4MB

    MD5

    e9a2209b61f4be34f25069a6e54affea

    SHA1

    6368b0a81608c701b06b97aeff194ce88fd0e3c0

    SHA256

    e950f17f4181009eeafa9f5306e8a9dfd26d88ca63b1838f44ff0efc738e7d1f

    SHA512

    59e46277ca79a43ed8b0a25b24eff013e251a75f90587e013b9c12851e5dd7283b6172f7d48583982f6a32069457778ee440025c1c754bf7bb6ce8ae1d2c3fc5

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202302040459021\assistant\_sfx.exe

    Filesize

    1.4MB

    MD5

    e9a2209b61f4be34f25069a6e54affea

    SHA1

    6368b0a81608c701b06b97aeff194ce88fd0e3c0

    SHA256

    e950f17f4181009eeafa9f5306e8a9dfd26d88ca63b1838f44ff0efc738e7d1f

    SHA512

    59e46277ca79a43ed8b0a25b24eff013e251a75f90587e013b9c12851e5dd7283b6172f7d48583982f6a32069457778ee440025c1c754bf7bb6ce8ae1d2c3fc5

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202302040459021\assistant\assistant_installer.exe

    Filesize

    1.8MB

    MD5

    4c8fbed0044da34ad25f781c3d117a66

    SHA1

    8dd93340e3d09de993c3bc12db82680a8e69d653

    SHA256

    afe569ce9e4f71c23ba5f6e8fd32be62ac9538e397cde8f2ecbe46faa721242a

    SHA512

    a04e6fd052d2d63a0737c83702c66a9af834f9df8423666508c42b3e1d8384300239c9ddacdc31c1e85140eb1193bcfac209f218750b40342492ffce6e9da481

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202302040459021\assistant\assistant_installer.exe

    Filesize

    1.8MB

    MD5

    4c8fbed0044da34ad25f781c3d117a66

    SHA1

    8dd93340e3d09de993c3bc12db82680a8e69d653

    SHA256

    afe569ce9e4f71c23ba5f6e8fd32be62ac9538e397cde8f2ecbe46faa721242a

    SHA512

    a04e6fd052d2d63a0737c83702c66a9af834f9df8423666508c42b3e1d8384300239c9ddacdc31c1e85140eb1193bcfac209f218750b40342492ffce6e9da481

  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2302040458599544940.dll

    Filesize

    5.0MB

    MD5

    3175b655105f9a71e70477c0b572c8f0

    SHA1

    5daa4e755790acfe5f9a2543289aa91fec29e45d

    SHA256

    88a4f9e75779de51ee4b0a4144b3dde46843a738cec1b00baec98cdc2519e13a

    SHA512

    fe8c06ee34bb4aaf4491789d86cacd00e58026d9c76fc360b5585423d3bf38c6b25b14a22e2124ec8ca2ae5fb219a3388b529a98c28345b9f984f27777efdc8f

  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2302040459008911460.dll

    Filesize

    5.0MB

    MD5

    3175b655105f9a71e70477c0b572c8f0

    SHA1

    5daa4e755790acfe5f9a2543289aa91fec29e45d

    SHA256

    88a4f9e75779de51ee4b0a4144b3dde46843a738cec1b00baec98cdc2519e13a

    SHA512

    fe8c06ee34bb4aaf4491789d86cacd00e58026d9c76fc360b5585423d3bf38c6b25b14a22e2124ec8ca2ae5fb219a3388b529a98c28345b9f984f27777efdc8f

  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2302040459016104924.dll

    Filesize

    5.0MB

    MD5

    3175b655105f9a71e70477c0b572c8f0

    SHA1

    5daa4e755790acfe5f9a2543289aa91fec29e45d

    SHA256

    88a4f9e75779de51ee4b0a4144b3dde46843a738cec1b00baec98cdc2519e13a

    SHA512

    fe8c06ee34bb4aaf4491789d86cacd00e58026d9c76fc360b5585423d3bf38c6b25b14a22e2124ec8ca2ae5fb219a3388b529a98c28345b9f984f27777efdc8f

  • C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat

    Filesize

    40B

    MD5

    fd45e213aea3afb51445e8248e73e8b1

    SHA1

    f223f06f9ca78220ab57625b3929fe9689a852d7

    SHA256

    17b4fb429f895f41a728ef097b3f53c35ca362fa24962f65be72dbdcbcb82c27

    SHA512

    a7c2226afd09164e53b0d2445bc73532dece7bd261edd2639dd2142110af2990586f4550c86ec7211a6306e4f234dad6259ebe944f2b09cefd243ca929663fe2

  • memory/1460-136-0x0000000000400000-0x00000000009A5000-memory.dmp

    Filesize

    5.6MB

  • memory/4924-140-0x0000000000400000-0x00000000009A5000-memory.dmp

    Filesize

    5.6MB

  • memory/4940-133-0x0000000000400000-0x00000000009A5000-memory.dmp

    Filesize

    5.6MB