cc61e30b7c3db8c85c33cbab14175cb6869fe124018bc47f7d39e3dc6d592703

Analysis

max time kernel
142s
max time network
127s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
21-03-2023 14:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe
Size

2.7MB
MD5

7f1afbb1f303fa7825609d870f970c75
SHA1

fdc8eaa2258d1e385993b6c69b48685dc766de07
SHA256

b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20
SHA512

4ab6cbf7008aeaf06ee2c5214d8becfa152def1fa61823177506401404edd1da2ad0e92555a0d61d1b087c2f456b56a08f65e2969b0c807b9a0e0c05039167b4
SSDEEP

49152:DmFGB6jgk0erMz6z7SNUbaHrzC+3FbbmxUZJmZjPS3KDBorqoyT/SVk:CFGB0gZmWOyu+VbbxrUPoKDBorq1SVk

Score

8^/10

spyware stealer upx

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
564	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe
1632	_sfx.exe
1516	assistant_installer.exe
2020	assistant_installer.exe

Loads dropped DLL 9 IoCs

pid	Process
2040	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe
1996	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe
2040	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe
564	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe
2040	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe
2040	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe
2040	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe
2040	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe
1516	assistant_installer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00080000000122f4-64.dat	upx
behavioral1/files/0x00080000000122f4-67.dat	upx
behavioral1/memory/2040-68-0x00000000008E0000-0x0000000000E2A000-memory.dmp	upx
behavioral1/memory/1996-71-0x00000000008E0000-0x0000000000E2A000-memory.dmp	upx
behavioral1/memory/564-76-0x0000000000C00000-0x000000000114A000-memory.dmp	upx

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2040	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1996	2040	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe	28
PID 2040 wrote to memory of 1996	2040	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe	28
PID 2040 wrote to memory of 1996	2040	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe	28
PID 2040 wrote to memory of 1996	2040	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe	28
PID 2040 wrote to memory of 1996	2040	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe	28
PID 2040 wrote to memory of 1996	2040	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe	28
PID 2040 wrote to memory of 1996	2040	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe	28
PID 2040 wrote to memory of 564	2040	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe	29
PID 2040 wrote to memory of 564	2040	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe	29
PID 2040 wrote to memory of 564	2040	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe	29
PID 2040 wrote to memory of 564	2040	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe	29
PID 2040 wrote to memory of 564	2040	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe	29
PID 2040 wrote to memory of 564	2040	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe	29
PID 2040 wrote to memory of 564	2040	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe	29
PID 2040 wrote to memory of 1632	2040	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe	32
PID 2040 wrote to memory of 1632	2040	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe	32
PID 2040 wrote to memory of 1632	2040	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe	32
PID 2040 wrote to memory of 1632	2040	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe	32
PID 2040 wrote to memory of 1632	2040	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe	32
PID 2040 wrote to memory of 1632	2040	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe	32
PID 2040 wrote to memory of 1632	2040	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe	32
PID 2040 wrote to memory of 1516	2040	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe	33
PID 2040 wrote to memory of 1516	2040	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe	33
PID 2040 wrote to memory of 1516	2040	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe	33
PID 2040 wrote to memory of 1516	2040	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe	33
PID 2040 wrote to memory of 1516	2040	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe	33
PID 2040 wrote to memory of 1516	2040	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe	33
PID 2040 wrote to memory of 1516	2040	b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe	33
PID 1516 wrote to memory of 2020	1516	assistant_installer.exe	34
PID 1516 wrote to memory of 2020	1516	assistant_installer.exe	34
PID 1516 wrote to memory of 2020	1516	assistant_installer.exe	34
PID 1516 wrote to memory of 2020	1516	assistant_installer.exe	34
PID 1516 wrote to memory of 2020	1516	assistant_installer.exe	34
PID 1516 wrote to memory of 2020	1516	assistant_installer.exe	34
PID 1516 wrote to memory of 2020	1516	assistant_installer.exe	34

C:\Users\Admin\AppData\Local\Temp\b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe
"C:\Users\Admin\AppData\Local\Temp\b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Users\Admin\AppData\Local\Temp\b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe
  C:\Users\Admin\AppData\Local\Temp\b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=96.0.4693.31 --initial-client-data=0x188,0x18c,0x190,0x15c,0x194,0x74b424a8,0x74b424b8,0x74b424c4
  2⤵
  - Loads dropped DLL
  PID:1996
- C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe
  "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe" --version
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:564
- C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303211530241\assistant\_sfx.exe
  "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303211530241\assistant\_sfx.exe"
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303211530241\assistant\assistant_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303211530241\assistant\assistant_installer.exe" --version
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303211530241\assistant\assistant_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303211530241\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=96.0.4693.50 --initial-client-data=0x12c,0x130,0x134,0x100,0x138,0xb16c28,0xb16c38,0xb16c44
    3⤵
    - Executes dropped EXE
    PID:2020

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77115948c117db6c80b6b006b8dbcb18

SHA1
58916b3359362e4658af119ab9bf343e4ceefe78

SHA256
4242f95301bdbbbc11ae0721edf8f314aff903e692f0d794af4c99f8f5e13bb7

SHA512
4a1f1a5c44e9f4db95833a2ea9c518587b0749d44cd6228267f1bc049ca058ea01c63f43b549bdef3326c71118094694eb9c66c77ce834cb9b0f85f6f65731fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe

Filesize
2.7MB

MD5
7f1afbb1f303fa7825609d870f970c75

SHA1
fdc8eaa2258d1e385993b6c69b48685dc766de07

SHA256
b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20

SHA512
4ab6cbf7008aeaf06ee2c5214d8becfa152def1fa61823177506401404edd1da2ad0e92555a0d61d1b087c2f456b56a08f65e2969b0c807b9a0e0c05039167b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303211530241\additional_file0.tmp

Filesize
1.7MB

MD5
b386cdcb413405daa8219af8e4cbd318

SHA1
ce275ff8514fef0629c915a6ee7b5ac481b9043d

SHA256
408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e

SHA512
91f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303211530241\assistant\_sfx.exe

Filesize
1.7MB

MD5
b386cdcb413405daa8219af8e4cbd318

SHA1
ce275ff8514fef0629c915a6ee7b5ac481b9043d

SHA256
408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e

SHA512
91f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303211530241\assistant\_sfx.exe

Filesize
1.7MB

MD5
b386cdcb413405daa8219af8e4cbd318

SHA1
ce275ff8514fef0629c915a6ee7b5ac481b9043d

SHA256
408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e

SHA512
91f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303211530241\assistant\assistant_installer.exe

Filesize
2.1MB

MD5
2f3d9e21e232b9bfea064d3b2264db06

SHA1
bafddc657d8d1bb531683b29b0342cc065ee51d2

SHA256
25528c314aed2b5391ca1d08c736a3807142aab21ae99d5970f2a862c8258d5d

SHA512
94e81aa3015b7e112bf772b52b2dd6092f5634746e201171b34b2493a62b08fbbf53a6d6c60c904c424c06e802aae6810c6dd88cf7a882846bc0a4793c3b32e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303211530241\assistant\assistant_installer.exe

Filesize
2.1MB

MD5
2f3d9e21e232b9bfea064d3b2264db06

SHA1
bafddc657d8d1bb531683b29b0342cc065ee51d2

SHA256
25528c314aed2b5391ca1d08c736a3807142aab21ae99d5970f2a862c8258d5d

SHA512
94e81aa3015b7e112bf772b52b2dd6092f5634746e201171b34b2493a62b08fbbf53a6d6c60c904c424c06e802aae6810c6dd88cf7a882846bc0a4793c3b32e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303211530241\assistant\assistant_installer.exe

Filesize
2.1MB

MD5
2f3d9e21e232b9bfea064d3b2264db06

SHA1
bafddc657d8d1bb531683b29b0342cc065ee51d2

SHA256
25528c314aed2b5391ca1d08c736a3807142aab21ae99d5970f2a862c8258d5d

SHA512
94e81aa3015b7e112bf772b52b2dd6092f5634746e201171b34b2493a62b08fbbf53a6d6c60c904c424c06e802aae6810c6dd88cf7a882846bc0a4793c3b32e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303211530241\opera_package

Filesize
86.9MB

MD5
6b7771354e081eb94cdbf7627799da4f

SHA1
199341a750443cc6e9b2b2fa1e657d0dd327711f

SHA256
494d1247e61eebf703a6eb19c14bde88edd2f85515fefa4f0465f43873e69aab

SHA512
33e781a102ba3f5c3b1895540bc9c43b78bf4f19af4b91ae0c765594f39d6569d1bad207b33f808426d8ebdcb00c419b7bb76bb050bae0bb843f96dd84355800

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4C6E.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Opera_installer_230321153023739564.dll

Filesize
4.6MB

MD5
04eef8268bb425a0d549aa7333ec0e74

SHA1
4b0ccc737fa2716278c46fde8a62d37ce4be9528

SHA256
ebc55e14d85469e699e113a088c629fe04f21ce60ae3dd77b960018da0c83616

SHA512
683feb683688ac5b846ddfade4fbdba8ae999623d3717b5d0b0f92332d1276b78c720e5f6483dd952bdb8cfecf99689f660fd5d4b5b547f92414ad5525dee5e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4CB0.tmp

Filesize
161KB

MD5
73b4b714b42fc9a6aaefd0ae59adb009

SHA1
efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

SHA256
c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

SHA512
73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar620C.tmp

Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

Filesize
40B

MD5
4f2cd724cfca2d5fa98c28c67b697c23

SHA1
70d48839b1db04b41807e97ce0829c41ab852fe2

SHA256
9503e28f48fd79576e8f794ff893a09d80cbffdd74b4ab5ca85f38e17f4185c6

SHA512
0e70d30f469fa72e1012789462873b311003179b19f7cb9c694502a40f815fbf7f966eb0c12d64453a357567393494e9e0ee47a90b54823d5816e708c5309bb0

Download Submit
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20.exe

Filesize
2.7MB

MD5
7f1afbb1f303fa7825609d870f970c75

SHA1
fdc8eaa2258d1e385993b6c69b48685dc766de07

SHA256
b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20

SHA512
4ab6cbf7008aeaf06ee2c5214d8becfa152def1fa61823177506401404edd1da2ad0e92555a0d61d1b087c2f456b56a08f65e2969b0c807b9a0e0c05039167b4

Download Submit
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303211530241\assistant\_sfx.exe

Filesize
1.7MB

MD5
b386cdcb413405daa8219af8e4cbd318

SHA1
ce275ff8514fef0629c915a6ee7b5ac481b9043d

SHA256
408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e

SHA512
91f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626

Download Submit
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303211530241\assistant\assistant_installer.exe

Filesize
2.1MB

MD5
2f3d9e21e232b9bfea064d3b2264db06

SHA1
bafddc657d8d1bb531683b29b0342cc065ee51d2

SHA256
25528c314aed2b5391ca1d08c736a3807142aab21ae99d5970f2a862c8258d5d

SHA512
94e81aa3015b7e112bf772b52b2dd6092f5634746e201171b34b2493a62b08fbbf53a6d6c60c904c424c06e802aae6810c6dd88cf7a882846bc0a4793c3b32e5

Download Submit
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303211530241\assistant\assistant_installer.exe

Filesize
2.1MB

MD5
2f3d9e21e232b9bfea064d3b2264db06

SHA1
bafddc657d8d1bb531683b29b0342cc065ee51d2

SHA256
25528c314aed2b5391ca1d08c736a3807142aab21ae99d5970f2a862c8258d5d

SHA512
94e81aa3015b7e112bf772b52b2dd6092f5634746e201171b34b2493a62b08fbbf53a6d6c60c904c424c06e802aae6810c6dd88cf7a882846bc0a4793c3b32e5

Download Submit
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303211530241\opera_package

Filesize
86.9MB

MD5
6b7771354e081eb94cdbf7627799da4f

SHA1
199341a750443cc6e9b2b2fa1e657d0dd327711f

SHA256
494d1247e61eebf703a6eb19c14bde88edd2f85515fefa4f0465f43873e69aab

SHA512
33e781a102ba3f5c3b1895540bc9c43b78bf4f19af4b91ae0c765594f39d6569d1bad207b33f808426d8ebdcb00c419b7bb76bb050bae0bb843f96dd84355800

Download Submit
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303211530241\opera_package

Filesize
86.9MB

MD5
6b7771354e081eb94cdbf7627799da4f

SHA1
199341a750443cc6e9b2b2fa1e657d0dd327711f

SHA256
494d1247e61eebf703a6eb19c14bde88edd2f85515fefa4f0465f43873e69aab

SHA512
33e781a102ba3f5c3b1895540bc9c43b78bf4f19af4b91ae0c765594f39d6569d1bad207b33f808426d8ebdcb00c419b7bb76bb050bae0bb843f96dd84355800

Download Submit
\Users\Admin\AppData\Local\Temp\Opera_installer_2303211530226302040.dll

Filesize
4.6MB

MD5
04eef8268bb425a0d549aa7333ec0e74

SHA1
4b0ccc737fa2716278c46fde8a62d37ce4be9528

SHA256
ebc55e14d85469e699e113a088c629fe04f21ce60ae3dd77b960018da0c83616

SHA512
683feb683688ac5b846ddfade4fbdba8ae999623d3717b5d0b0f92332d1276b78c720e5f6483dd952bdb8cfecf99689f660fd5d4b5b547f92414ad5525dee5e4

Download Submit
\Users\Admin\AppData\Local\Temp\Opera_installer_2303211530230911996.dll

Filesize
4.6MB

MD5
04eef8268bb425a0d549aa7333ec0e74

SHA1
4b0ccc737fa2716278c46fde8a62d37ce4be9528

SHA256
ebc55e14d85469e699e113a088c629fe04f21ce60ae3dd77b960018da0c83616

SHA512
683feb683688ac5b846ddfade4fbdba8ae999623d3717b5d0b0f92332d1276b78c720e5f6483dd952bdb8cfecf99689f660fd5d4b5b547f92414ad5525dee5e4

Download Submit
\Users\Admin\AppData\Local\Temp\Opera_installer_230321153023739564.dll

Filesize
4.6MB

MD5
04eef8268bb425a0d549aa7333ec0e74

SHA1
4b0ccc737fa2716278c46fde8a62d37ce4be9528

SHA256
ebc55e14d85469e699e113a088c629fe04f21ce60ae3dd77b960018da0c83616

SHA512
683feb683688ac5b846ddfade4fbdba8ae999623d3717b5d0b0f92332d1276b78c720e5f6483dd952bdb8cfecf99689f660fd5d4b5b547f92414ad5525dee5e4

Download Submit
memory/564-76-0x0000000000C00000-0x000000000114A000-memory.dmp

Filesize
5.3MB

Download
memory/1996-71-0x00000000008E0000-0x0000000000E2A000-memory.dmp

Filesize
5.3MB

Download
memory/2040-68-0x00000000008E0000-0x0000000000E2A000-memory.dmp

Filesize
5.3MB

Download
memory/2040-70-0x00000000028A0000-0x0000000002DEA000-memory.dmp

Filesize
5.3MB

Download
memory/2040-72-0x00000000033C0000-0x000000000390A000-memory.dmp

Filesize
5.3MB

Download