Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    153s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/01/2024, 12:41

General

  • Target

    f20ed60f14ba73f4564a302e37baedc7bc6180021a0067298061344ca2cb5b40.exe

  • Size

    2.6MB

  • MD5

    48dd2f342809c4b3fefae60aae2d2b00

  • SHA1

    b353a99ebe62291ecedda811cad6d10a81b117a0

  • SHA256

    f20ed60f14ba73f4564a302e37baedc7bc6180021a0067298061344ca2cb5b40

  • SHA512

    3a26705326bfe4b91cf5da9250b56f48e30c75a5a0701695bcb715fd2d7814f8827b8b955ac6893c124e187afb049a65bc4f0972864df4dee66f4dcd925ec776

  • SSDEEP

    49152:LJ33Y9YXyyUVYyCa0iNyXmAZ4z56BrWV8AZmG27DPHE8eAZzmLQyzGR/yQ41XAus:l0YXyy9WGX496BNAAG27DvE8e08zGNyg

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f20ed60f14ba73f4564a302e37baedc7bc6180021a0067298061344ca2cb5b40.exe
    "C:\Users\Admin\AppData\Local\Temp\f20ed60f14ba73f4564a302e37baedc7bc6180021a0067298061344ca2cb5b40.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • Modifies system certificate store
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4952
    • C:\Users\Admin\AppData\Local\Temp\f20ed60f14ba73f4564a302e37baedc7bc6180021a0067298061344ca2cb5b40.exe
      C:\Users\Admin\AppData\Local\Temp\f20ed60f14ba73f4564a302e37baedc7bc6180021a0067298061344ca2cb5b40.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=106.0.4998.19 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2cc,0x2fc,0x75399530,0x7539953c,0x75399548
      2⤵
      • Loads dropped DLL
      PID:4964
    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\f20ed60f14ba73f4564a302e37baedc7bc6180021a0067298061344ca2cb5b40.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\f20ed60f14ba73f4564a302e37baedc7bc6180021a0067298061344ca2cb5b40.exe" --version
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4352
    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401011242401\assistant\Assistant_106.0.4998.16_Setup.exe_sfx.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401011242401\assistant\Assistant_106.0.4998.16_Setup.exe_sfx.exe"
      2⤵
      • Executes dropped EXE
      PID:1540
    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401011242401\assistant\assistant_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401011242401\assistant\assistant_installer.exe" --version
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:628
      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401011242401\assistant\assistant_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401011242401\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=106.0.4998.16 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x6e2614,0x6e2620,0x6e262c
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2624

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\f20ed60f14ba73f4564a302e37baedc7bc6180021a0067298061344ca2cb5b40.exe

    Filesize

    376KB

    MD5

    8fc1f7d7a79a4ee013ee9e77975a8288

    SHA1

    3852166afe3134c38d933ef850856b1192289c4e

    SHA256

    e6769404d86c5b94097cb8c049a091cafa09876dc83e3bcaf3073ab4312892c2

    SHA512

    b3cce67efb46e061f4d59c5f9fee7fe4f6e091a79b37c6b4a7eed1c5a245b39d5d29393f38dc5f382fdf7e16d9871a56ee2c019800ce44cf593f33cd2bafc2b9

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401011242401\assistant\Assistant_106.0.4998.16_Setup.exe_sfx.exe

    Filesize

    1.1MB

    MD5

    82aaf6b086c1a727a26b795de3eb4359

    SHA1

    5f8fff2db8c4f6991e9287f04eb39988f5b4a576

    SHA256

    8a13509cb54c3d8a8bdac074f49cfef65d3cb5614804043aaa0e399183ae24b6

    SHA512

    4779d26f8e330a51fd7ceaf8d465a6d9c31ac3b61479ef2980eb77f7f854058bfbd9757101c95192c252a089339a678e416b809db4145dab5615d42c0d78ebea

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401011242401\assistant\Assistant_106.0.4998.16_Setup.exe_sfx.exe

    Filesize

    1.0MB

    MD5

    35d402f2ab65e6eada583da2329da209

    SHA1

    fba247d5ca9254f183c127f47d3d1f13c4fd34bb

    SHA256

    9fb4a64158006033e298c42969952c81697e5291f0384ebe156a08a9dcabdbd8

    SHA512

    8d3a07f1effcd5aa328b9d00898ed0266599ad018ab94932eac15eb786560b193f8a4f3a8a68e5c937f73e377c5610bf812c631563f32c3ed5e63dd1f289c376

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401011242401\assistant\Assistant_106.0.4998.16_Setup.exe_sfx.exe

    Filesize

    915KB

    MD5

    db850564d76a7d2fb35c16cf2ce469ac

    SHA1

    d0ff34cb1bdd662517159b36ddfb11cabf41ff1f

    SHA256

    f2a60f41afe55ed862ce2360a9f0537545ebe68150eea1674e5521ab5822fd54

    SHA512

    0a100796954a7fbe12d8aa6fc9e875c4fa9d85eb9debe65f49a4806bea8456411754a2ae28ea63a3c2132bbea524eb23aef4534bd52ddc7a41f45c465bb333c6

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401011242401\assistant\assistant_installer.exe

    Filesize

    498KB

    MD5

    4ac4c2118cb548044b87888c6b45f1af

    SHA1

    aff6a988f11731dcbff4052f91b00cdcd2f743cd

    SHA256

    33f50a360234938dcf374f4e79231a2351d2cbbb1303df1e31ee0eb11e0d4c0a

    SHA512

    48151355b0171fd04452326245a4fdd7af4069f42bece6ccd21810d6f88fbfeef44e8e4f57ad3560b0ccf169303699da9e143e9afbd1b15770fc2bb924a99b15

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401011242401\assistant\assistant_installer.exe

    Filesize

    256KB

    MD5

    a554b109d77388cbf5d26b7a9dc8af02

    SHA1

    7ead36cdbbde405da7279bca99bc910119d2db52

    SHA256

    1d2a750dc530844a40dc81a8037af853d5d17900c83447ac371e81e72ec10dce

    SHA512

    75d23d25973fcf205d1cce750aa4e488f8fd48998ebd605680dc5d4e96897ccd0d14edb1f690d2b62c3b000c07516dca529340c4e1d0b2c150ccdaf941362baa

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401011242401\assistant\dbgcore.dll

    Filesize

    166KB

    MD5

    a59b6c6d04bac536cc7fafe92f0d1bda

    SHA1

    6d5bbdfafbe2ea65e3aa9abc088e0fc6e20be8a1

    SHA256

    c2d92d6e9a3ea40f38d275499bef7ba899802f131160ce1a2f76314b87b531ac

    SHA512

    49e748676c54482f7de089fb6eaa45b5cb3e59a1b9125d90619371678749a0b80cf8ef8c7cf75c8486d20b89639a8b679c23a671a2c3b6dff1f86ea9cb1a7f5c

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401011242401\assistant\dbghelp.dll

    Filesize

    448KB

    MD5

    bff083848451d3e2b08c979327cf3617

    SHA1

    18960b74bc4e983462c0ca3181199fe9ed52fba0

    SHA256

    ad69844b3c5834dd5235aa09e56ec3a1cc324e30f2924022c01976de5ce8443f

    SHA512

    f31c6458539da8a7eb1d5a3fcd5a13882f1cd0c545907fe2857e4997d579d53b78530e6f8f3f79297906a4237d29ad687c994267ce5f4b1d44756836092edf98

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401011242401\assistant\dbghelp.dll

    Filesize

    662KB

    MD5

    f7fa62d7d05d14c8947e2f697b2d79b0

    SHA1

    91017fb96f4b7f62291b42174d7ea3216e212e66

    SHA256

    1293670c8f7274370a376774fa4c5f61b72d30946937e3df97758c7b71b458f3

    SHA512

    c1106fa9f1bfb3106dc392adccf73675249c0173ee838f1d2f9487ead0dc4d924879bb37260af31ca72319cd2661a9bf222992be8d34fea1331281a0faa44dc8

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401011242401\assistant\dbghelp.dll

    Filesize

    341KB

    MD5

    63d1af40f24cdb48816c4f91acacc1f2

    SHA1

    ef9be47566fadf7d0386129c337f34a27e8db722

    SHA256

    9d990977f1e1dcf43c25fd2f00fec7297a150d3fb08e08780b290aa5039fceb9

    SHA512

    0a50d15851fb9ad0fae4ff016a9d0c5546a42a74ef791f36602dae71018e4537e2e8445047d88ac61032dd18e94f638419c5245f7daa7598bdbefe60b5a449d3

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401011242401\opera_package

    Filesize

    9.2MB

    MD5

    ce9ef1e9910a6e9619ab1aecf4c066ba

    SHA1

    8a427fd3a22970449b1c057016aa98da36177082

    SHA256

    7066efb803a3c9b62659ee6e40a3d8237237017f5e89eae636473611b8b4be82

    SHA512

    e9e25bdacabf7ec1c2aaab62353260a32b5b219b19fede2f2b48677ad1c3dfe4aa425614a6abdd260241b3db734e8cc37ae316bb4e4246c76073153f3db7d2c3

  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2401011242395244952.dll

    Filesize

    49KB

    MD5

    055714d8ed23011acbd093d261fb0321

    SHA1

    1e960c6d844dc2f5d707ad13b7def57dbbeeb284

    SHA256

    69db7c706fb1a44f166f89d119b132251532d246e37cddd71a272523ae4764d3

    SHA512

    da0760c764b12a64eb1b8fbd09ab883b373a5f79f30b246af8b8985e8be69bbfa5fa237bfdb3b6b1c543dd7f1fca89284d2df022b0c72ed12821e8b125ddc752

  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2401011242401804964.dll

    Filesize

    321KB

    MD5

    7eeccf7807f7d8e3328ba782a4ecf9e2

    SHA1

    8ce0a9eada0e05295b643543faccd6b33ddcb3e5

    SHA256

    c59888716bd568e7db61e54f34949ef759988c5d2488bab10c2a4e5f3f40f1be

    SHA512

    10f08d705a01a7a393c3d1de4e96f46f009d6d4438fe7fa088359e3e6d654d8341b7bd9515853d05643ffd1693fce0ac81157d5ec758fc60a69ce7da8f80c37d

  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2401011242404154352.dll

    Filesize

    281KB

    MD5

    1480330acd33801b361cee7d25251cd4

    SHA1

    1edff381cbf9c3da9287973df509406c489cd3c5

    SHA256

    a7f6190d4389a41de1dc8bcc7c2416e4790d59d333b6264198d546e4447533ab

    SHA512

    0579b635dfcc063d68d9b6fd998702fd53d920622e5c08431227a4128fa9e5da93da41532995f29efbf206520fa7e7a1e8a986fbc3777573b9846bc065e8bc61

  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2401011242404154352.dll

    Filesize

    476KB

    MD5

    a75bea56f20e3bc2dab6b16cc21a6633

    SHA1

    fb91463c8da80b8d0f805afc9a6ae60904e16721

    SHA256

    55e2b06a7bb098cec42368d926046cba8ece5bf70dbe0b531e2d1fc1bb7596b1

    SHA512

    131fe8422e4ce1a0ce451b15d7c0a756cce65e520a45b91ff2241034c8c468deea88848a78e1b849d02d9a22a4a6f54c69292a498d264895beed39ee41ecbffc

  • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

    Filesize

    40B

    MD5

    1d2b3d7a2ae0f107f30d85fae484c7de

    SHA1

    a754e1fd79d82b8803818aa4791c1e640f2cb774

    SHA256

    73d2e7f872215ee82c2aa413e47c6afa819e6e7a8b51ea6ded32dcfbbdd48e68

    SHA512

    44a4a04af73584db6cd93a3d4a308bdb065ff65dc115ab20f41f132cc531c44d2acbca61a38dde2ef7685f9ad079d2557611e5325df502fc980e7841df448755

  • memory/4352-18-0x00000000009A0000-0x0000000000E88000-memory.dmp

    Filesize

    4.9MB

  • memory/4352-15-0x00000000009A0000-0x0000000000E88000-memory.dmp

    Filesize

    4.9MB

  • memory/4952-36-0x0000000000450000-0x0000000000938000-memory.dmp

    Filesize

    4.9MB

  • memory/4952-0-0x0000000000450000-0x0000000000938000-memory.dmp

    Filesize

    4.9MB

  • memory/4964-37-0x0000000000450000-0x0000000000938000-memory.dmp

    Filesize

    4.9MB

  • memory/4964-5-0x0000000000450000-0x0000000000938000-memory.dmp

    Filesize

    4.9MB