c67544e121d7b475605fb69fcf9ac376f549ea632847cbd4862fe4eac9e33a34

Analysis

max time kernel
66s
max time network
77s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2023, 05:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Opera_Crypto_96.0.4693.24_Autoupdate_x64.exe
Size

87.1MB
MD5

1ed172c5d016c3625be0d571dba15338
SHA1

9f980e55c07e1521f11574144a771fee82486475
SHA256

c67544e121d7b475605fb69fcf9ac376f549ea632847cbd4862fe4eac9e33a34
SHA512

464da71ab3bbfa98dc6905e9a466c03c4c584915f89124e68c3f2e9defb40ffcf7364815c13413a84c8e8947402e232fec4cc420020eb7096876865e5f470804
SSDEEP

1572864:CvmDOhjRMbWq/xlSXhH0Weji3vtC34CuNnA2G+926FaD6q2Y5/Vsa6ONBC:CmOhjkTSxHTjVC34Cj0wCO/V1B

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2836	msedge.exe
2836	msedge.exe
4032	msedge.exe
4032	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 2616	4032	msedge.exe	97
PID 4032 wrote to memory of 2616	4032	msedge.exe	97
PID 4032 wrote to memory of 2624	4032	msedge.exe	99
PID 4032 wrote to memory of 2624	4032	msedge.exe	99
PID 4032 wrote to memory of 2624	4032	msedge.exe	99
PID 4032 wrote to memory of 2624	4032	msedge.exe	99
PID 4032 wrote to memory of 2624	4032	msedge.exe	99
PID 4032 wrote to memory of 2624	4032	msedge.exe	99
PID 4032 wrote to memory of 2624	4032	msedge.exe	99
PID 4032 wrote to memory of 2624	4032	msedge.exe	99
PID 4032 wrote to memory of 2624	4032	msedge.exe	99
PID 4032 wrote to memory of 2624	4032	msedge.exe	99
PID 4032 wrote to memory of 2624	4032	msedge.exe	99
PID 4032 wrote to memory of 2624	4032	msedge.exe	99
PID 4032 wrote to memory of 2624	4032	msedge.exe	99
PID 4032 wrote to memory of 2624	4032	msedge.exe	99
PID 4032 wrote to memory of 2624	4032	msedge.exe	99
PID 4032 wrote to memory of 2624	4032	msedge.exe	99
PID 4032 wrote to memory of 2624	4032	msedge.exe	99
PID 4032 wrote to memory of 2624	4032	msedge.exe	99
PID 4032 wrote to memory of 2624	4032	msedge.exe	99
PID 4032 wrote to memory of 2624	4032	msedge.exe	99
PID 4032 wrote to memory of 2624	4032	msedge.exe	99
PID 4032 wrote to memory of 2624	4032	msedge.exe	99
PID 4032 wrote to memory of 2624	4032	msedge.exe	99
PID 4032 wrote to memory of 2624	4032	msedge.exe	99
PID 4032 wrote to memory of 2624	4032	msedge.exe	99
PID 4032 wrote to memory of 2624	4032	msedge.exe	99
PID 4032 wrote to memory of 2624	4032	msedge.exe	99
PID 4032 wrote to memory of 2624	4032	msedge.exe	99
PID 4032 wrote to memory of 2624	4032	msedge.exe	99
PID 4032 wrote to memory of 2624	4032	msedge.exe	99
PID 4032 wrote to memory of 2624	4032	msedge.exe	99
PID 4032 wrote to memory of 2624	4032	msedge.exe	99
PID 4032 wrote to memory of 2624	4032	msedge.exe	99
PID 4032 wrote to memory of 2624	4032	msedge.exe	99
PID 4032 wrote to memory of 2624	4032	msedge.exe	99
PID 4032 wrote to memory of 2624	4032	msedge.exe	99
PID 4032 wrote to memory of 2624	4032	msedge.exe	99
PID 4032 wrote to memory of 2624	4032	msedge.exe	99
PID 4032 wrote to memory of 2624	4032	msedge.exe	99
PID 4032 wrote to memory of 2624	4032	msedge.exe	99
PID 4032 wrote to memory of 2836	4032	msedge.exe	100
PID 4032 wrote to memory of 2836	4032	msedge.exe	100
PID 4032 wrote to memory of 1860	4032	msedge.exe	102
PID 4032 wrote to memory of 1860	4032	msedge.exe	102
PID 4032 wrote to memory of 1860	4032	msedge.exe	102
PID 4032 wrote to memory of 1860	4032	msedge.exe	102
PID 4032 wrote to memory of 1860	4032	msedge.exe	102
PID 4032 wrote to memory of 1860	4032	msedge.exe	102
PID 4032 wrote to memory of 1860	4032	msedge.exe	102
PID 4032 wrote to memory of 1860	4032	msedge.exe	102
PID 4032 wrote to memory of 1860	4032	msedge.exe	102
PID 4032 wrote to memory of 1860	4032	msedge.exe	102
PID 4032 wrote to memory of 1860	4032	msedge.exe	102
PID 4032 wrote to memory of 1860	4032	msedge.exe	102
PID 4032 wrote to memory of 1860	4032	msedge.exe	102
PID 4032 wrote to memory of 1860	4032	msedge.exe	102
PID 4032 wrote to memory of 1860	4032	msedge.exe	102
PID 4032 wrote to memory of 1860	4032	msedge.exe	102
PID 4032 wrote to memory of 1860	4032	msedge.exe	102
PID 4032 wrote to memory of 1860	4032	msedge.exe	102
PID 4032 wrote to memory of 1860	4032	msedge.exe	102
PID 4032 wrote to memory of 1860	4032	msedge.exe	102

C:\Users\Admin\AppData\Local\Temp\Opera_Crypto_96.0.4693.24_Autoupdate_x64.exe
"C:\Users\Admin\AppData\Local\Temp\Opera_Crypto_96.0.4693.24_Autoupdate_x64.exe"
1⤵
PID:1268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8630446f8,0x7ff863044708,0x7ff863044718
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,18405776266521787613,14800966982734036110,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,18405776266521787613,14800966982734036110,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2472 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,18405776266521787613,14800966982734036110,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,18405776266521787613,14800966982734036110,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,18405776266521787613,14800966982734036110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,18405776266521787613,14800966982734036110,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,18405776266521787613,14800966982734036110,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:1
  2⤵
  PID:4524

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2276

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
78c7656527762ed2977adf983a6f4766

SHA1
21a66d2eefcb059371f4972694057e4b1f827ce6

SHA256
e1000099751602ae1adcec6f1c74e1d65f472936817b45239dfed4b043984296

SHA512
0a8e58ae95163b3cdf8e81b5085887761e73cb7c836a1a6a972e837fb3df69b2ac70cfd6311d06d40656344ec35eb48e512f007561480f0345486ac2b329be0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
099b4ba2787e99b696fc61528100f83f

SHA1
06e1f8b7391e1d548e49a1022f6ce6e7aa61f292

SHA256
cdb1db488e260ed750edfe1c145850b57ee8ab819d75237a167e673116a33ee8

SHA512
4309375e10785564ceb03e0127ced414e366a5b833f16a60d796471d871b479e4c044db5268902d9dfd14715ca577cb26042bab8f7b0f31fe8abf33947feb9d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

Filesize
264KB

MD5
42f45fe60d4fc7b74fca481a35dfb6dc

SHA1
cc94dbd2fc84990d3ca849deedbe78d37331c735

SHA256
0ff81bfe8be0518d8f0d6ac60e1782d0c04745701c9ec549404fddf3e0604f8f

SHA512
c8855091db9b73ca924a8d3c8c84edba9bc5cc4766816872561d7f2b0d09874636247db6f82815f3d8dfd7a2202e8d664f7b8668925af166cb3e4b01163a2bf9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
d2849e88834729ba6460873c1ed77e35

SHA1
edf62c2b3578c26d37d91eb78e48c3f563febc75

SHA256
e750fcd5eb72b894e3a42bd2391dec9e913581383188f1293ce81c840efa9a41

SHA512
dcd3c3958dc2b0de60bdd3a05fa62ceea78a7200cbdde59721d82b3f62751c31613967a98fda645265e4e5b4ee636882f25b42413cd100a06cbc4d43a5ac46b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
81f5ecab47054967a28d3b8ea9cbcc77

SHA1
ca611a7dd581b90c75e77c118d96e3011e023c04

SHA256
fc27269039d67a8511c338552dc02bce3d0c39ba5d58cb750284d54f422a270f

SHA512
821917e250f087e98b7580dfd37fea448739bc0a8f0a3d67934b908afb8da3d5c9736ab8189fad5a05d33da8e6bb8ec89d8a091ef4796c39fa16ba90ea215fd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c9dc7b30b200d2a0b82152f715e4bdf3

SHA1
d3a404a2d0f44a17554a09f3b738af45ed8ba0a4

SHA256
501e3fcc8bde3ddf0ab8c32a8ce7624214e2e8ae2aba985d982d733c9506a1d9

SHA512
a145717020382dfefb723bd99f3ca7abec9a0642a9d8f6a2e2f001d19dfbee03be66fc639adbddb859d725cc55f01e3f54a8ec9fd6f288121ce0b7db879d05b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
02ee7addc9e8a2d07af55556ebf0ff5c

SHA1
020161bb64ecb7c6e6886ccc055908984dc651d8

SHA256
552d3ed359b7a52278ce621674d16428d8a7969f6cd5663df18e240cce66aadc

SHA512
567989543c3848a0c3276d96b96ca761f750e4b71fb74f36d809f590ffe16a72fd5ece251737a8b1ffe65f0051e211bd7ad19d2b8b0b7ca1b7ffc86dd2a52883

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
9d7cdb76266735fbf3a756bd12db60fc

SHA1
159a4a1929db4ae24e9579a38486fd7636d2a5fb

SHA256
f92e3ab39ecca16d04a02546629719e9906c225e5a5a18703cbc67778904d9f1

SHA512
07d661d0b9176382dba69d448cdfde355f86a988379ebd2d1d539243c6beb5ac25e2964083db6f26f5808cc9d54eb87221d290f010e8d5391439add956f0d259

Download Submit
C:\Users\Admin\AppData\Local\Temp\resources\CCCED631-6DA2-4060-9824-95737E64350C.ico

Filesize
5KB

MD5
93e4504d4c585cfda1979b37e75fe39a

SHA1
5d4296f36e878b263c5da6ad8abd6174e4dff5d8

SHA256
69aaab4b888c83b3f77d524313f9383d9edaa73e4af111a7a637e9f84a1609d7

SHA512
072638bee318f5e15af53cf3f9efd9156aa4836c40e8fb5f1f856706331cb11b528dfebe8e88713fc7146fefb1e66a614cff2f4e87676d886d2f09d945cbd1a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\resources\FDC2CCAB-E8F9-4620-91DD-B0B67285997C.ico

Filesize
1KB

MD5
74fdac19593602b8d25a5e2fdb9c3051

SHA1
81db52e9ad1be5946dffa3c89f5302633a7698d2

SHA256
f06ebef0b912b94d7e0af3915f2a6b6b64f74cb60bc8aaa1104c874761a0dee6

SHA512
8ffb507e46c99f1fede3f12c14998cd41afa8cfc5c815756343041f1bef6faf7ba4429cebeb87b0fb807d911f5516d235d5f893e519576b1fb675d25d025c21b

Download Submit