Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    63s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/02/2023, 03:54

General

  • Target

    OperaSetup.exe

  • Size

    2.7MB

  • MD5

    32a164c7440f0cea2923b544d0a169df

  • SHA1

    c536227be3d6df4ad5d06cdccd5212eff6cfd988

  • SHA256

    a95442dc0471e48525a794d426cb968a76ededdd0bc4684a70b366ef09772108

  • SHA512

    4c6339da012fe13c1d95b4e1daddc2d0cdde5c61ef2ed0369438cd4fb4234d465f2879acaad3d5f01a4ace667828c6d69837ea1a4c68d4e8267373746aec44ef

  • SSDEEP

    49152:nBTG7j5EFGJwXYK3hcHvqO4Vf6X9dDbqhXxp+2V8VqSK6j0bLlH:dKj5scbqxx6XPbqhXxrSK6j0nlH

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies system certificate store 2 TTPs 10 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\OperaSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\OperaSetup.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • Modifies system certificate store
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1572
    • C:\Users\Admin\AppData\Local\Temp\OperaSetup.exe
      C:\Users\Admin\AppData\Local\Temp\OperaSetup.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=95.0.4635.25 --initial-client-data=0x2dc,0x2e0,0x2e4,0x2b4,0x2e8,0x7577e428,0x7577e438,0x7577e444
      2⤵
      • Loads dropped DLL
      PID:4172
    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe" --version
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4876
    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302050354401\assistant\_sfx.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302050354401\assistant\_sfx.exe"
      2⤵
      • Executes dropped EXE
      PID:852
    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302050354401\assistant\assistant_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302050354401\assistant\assistant_installer.exe" --version
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1700
      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302050354401\assistant\assistant_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302050354401\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=94.0.4606.38 --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0x382dc0,0x382dd0,0x382ddc
        3⤵
        • Executes dropped EXE
        PID:1520

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe

    Filesize

    2.7MB

    MD5

    32a164c7440f0cea2923b544d0a169df

    SHA1

    c536227be3d6df4ad5d06cdccd5212eff6cfd988

    SHA256

    a95442dc0471e48525a794d426cb968a76ededdd0bc4684a70b366ef09772108

    SHA512

    4c6339da012fe13c1d95b4e1daddc2d0cdde5c61ef2ed0369438cd4fb4234d465f2879acaad3d5f01a4ace667828c6d69837ea1a4c68d4e8267373746aec44ef

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302050354401\assistant\_sfx.exe

    Filesize

    1.7MB

    MD5

    0238df215bf6943892daf85de8ad433a

    SHA1

    3d905e4e2c0e9170df61b7a199321847691f945e

    SHA256

    a7818aca6acbe347df13d51d9750f6a852c5aa2a58580f7f2015113e0a3e06d7

    SHA512

    fc6c12e359b9a4ce84ef878f29648a4c97c38fd12ed80996c5e03829833220010fff9c751a99f399dad3529bda6438424194ed18236addfbe430343807aaad69

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302050354401\assistant\_sfx.exe

    Filesize

    1.7MB

    MD5

    0238df215bf6943892daf85de8ad433a

    SHA1

    3d905e4e2c0e9170df61b7a199321847691f945e

    SHA256

    a7818aca6acbe347df13d51d9750f6a852c5aa2a58580f7f2015113e0a3e06d7

    SHA512

    fc6c12e359b9a4ce84ef878f29648a4c97c38fd12ed80996c5e03829833220010fff9c751a99f399dad3529bda6438424194ed18236addfbe430343807aaad69

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302050354401\assistant\assistant_installer.exe

    Filesize

    2.1MB

    MD5

    9df6e2fbb7e38964f35016bf91ef7424

    SHA1

    d0c1266dc46814bc6165cf6a69e90581228989a7

    SHA256

    3573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d

    SHA512

    b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202302050354401\assistant\assistant_installer.exe

    Filesize

    2.1MB

    MD5

    9df6e2fbb7e38964f35016bf91ef7424

    SHA1

    d0c1266dc46814bc6165cf6a69e90581228989a7

    SHA256

    3573825f31875d403832de8e06aabc2adbdf0c5279d80ea62dfcb1f159f06c1d

    SHA512

    b14c2224ae10c80429205a39791745b1627c1a487176c06aa105d0689e77fb0b86427e1a7d5aef5d06460070b3df4ebea41db67d54e221ea25979b3bb5318d3e

  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2302050354398651572.dll

    Filesize

    4.6MB

    MD5

    914ec7fb3d69e977440248ef30323636

    SHA1

    2aa31e599769f34d0cb6e979947ca5728db9b009

    SHA256

    528117e7c698fbe7ad3036aef77f99ab8af74316def7a4ba60f738c40168c203

    SHA512

    ff62901ffe79bbc8ffe6cce3efc8f13e71f13a41772b8d0180614b6ba80d5b9db1094a97cf3d239057dca2efdd7b0adc217f3ddce5111267c50ec9d0d1125b3a

  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2302050354402564172.dll

    Filesize

    4.6MB

    MD5

    914ec7fb3d69e977440248ef30323636

    SHA1

    2aa31e599769f34d0cb6e979947ca5728db9b009

    SHA256

    528117e7c698fbe7ad3036aef77f99ab8af74316def7a4ba60f738c40168c203

    SHA512

    ff62901ffe79bbc8ffe6cce3efc8f13e71f13a41772b8d0180614b6ba80d5b9db1094a97cf3d239057dca2efdd7b0adc217f3ddce5111267c50ec9d0d1125b3a

  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2302050354405534876.dll

    Filesize

    4.6MB

    MD5

    914ec7fb3d69e977440248ef30323636

    SHA1

    2aa31e599769f34d0cb6e979947ca5728db9b009

    SHA256

    528117e7c698fbe7ad3036aef77f99ab8af74316def7a4ba60f738c40168c203

    SHA512

    ff62901ffe79bbc8ffe6cce3efc8f13e71f13a41772b8d0180614b6ba80d5b9db1094a97cf3d239057dca2efdd7b0adc217f3ddce5111267c50ec9d0d1125b3a

  • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

    Filesize

    40B

    MD5

    fb31ff92d913468aada46448592b482a

    SHA1

    9c94512cd103a87065978d7f990f5929cfdc0a54

    SHA256

    cf780c5d8522e6ba165c85b10990a90d353ff3304d6c31ebd9809a6dbc1b2f47

    SHA512

    8053a4bc739800fe043fde1d4302da43c5bfee9a3c30ecce1b1bbc5146af3ff2930d0aa54c7a06729d1274d73c4dd5833aa0f44ebb497b66dca674af576e4103

  • memory/1572-134-0x0000000000400000-0x0000000000947000-memory.dmp

    Filesize

    5.3MB

  • memory/4172-140-0x0000000000400000-0x0000000000947000-memory.dmp

    Filesize

    5.3MB

  • memory/4876-139-0x0000000000400000-0x0000000000947000-memory.dmp

    Filesize

    5.3MB