ada1f60b55545c1f8a59fd28d2a5fd37d9655e9f059857121e1d493fada33750

Resubmissions

05-03-2024 20:45

240305-zjqfasgh5w 8

05-03-2024 20:41

05-03-2024 20:40

05-03-2024 20:37

05-03-2024 20:34

05-03-2024 20:31

05-03-2024 20:27

Analysis

max time kernel
150s
max time network
160s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-03-2024 20:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OperaGXSetup.exe
Size

3.4MB
MD5

b16754e31096ff084460514287187a29
SHA1

149d9d7bc7bfa0ee218e55eb3778ea3cf6184dc7
SHA256

ada1f60b55545c1f8a59fd28d2a5fd37d9655e9f059857121e1d493fada33750
SHA512

86fad8a6ee5660aac5a0fa172d6094585793cc6b86996941211292a9e91fc2571c8fa807a3021561909c841491400991f152f18c8e1d247c663ff600643224f7
SSDEEP

98304:TWo5jp/vdcY8uC+gOhUL+byztZXlAuoVGmKeLEcjXXV9bA:TP59/VcYZCOW+bO+5Eo9c

Score

7^/10

upx

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2080	OperaGXSetup.exe
2080	OperaGXSetup.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2080-0-0x00000000002D0000-0x0000000000891000-memory.dmp	upx
behavioral1/memory/2080-7-0x00000000002D0000-0x0000000000891000-memory.dmp	upx

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe
Token: SeShutdownPrivilege	2972	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2236	2972	chrome.exe	29
PID 2972 wrote to memory of 2236	2972	chrome.exe	29
PID 2972 wrote to memory of 2236	2972	chrome.exe	29
PID 2972 wrote to memory of 2780	2972	chrome.exe	31
PID 2972 wrote to memory of 2780	2972	chrome.exe	31
PID 2972 wrote to memory of 2780	2972	chrome.exe	31
PID 2972 wrote to memory of 2780	2972	chrome.exe	31
PID 2972 wrote to memory of 2780	2972	chrome.exe	31
PID 2972 wrote to memory of 2780	2972	chrome.exe	31
PID 2972 wrote to memory of 2780	2972	chrome.exe	31
PID 2972 wrote to memory of 2780	2972	chrome.exe	31
PID 2972 wrote to memory of 2780	2972	chrome.exe	31
PID 2972 wrote to memory of 2780	2972	chrome.exe	31
PID 2972 wrote to memory of 2780	2972	chrome.exe	31
PID 2972 wrote to memory of 2780	2972	chrome.exe	31
PID 2972 wrote to memory of 2780	2972	chrome.exe	31
PID 2972 wrote to memory of 2780	2972	chrome.exe	31
PID 2972 wrote to memory of 2780	2972	chrome.exe	31
PID 2972 wrote to memory of 2780	2972	chrome.exe	31
PID 2972 wrote to memory of 2780	2972	chrome.exe	31
PID 2972 wrote to memory of 2780	2972	chrome.exe	31
PID 2972 wrote to memory of 2780	2972	chrome.exe	31
PID 2972 wrote to memory of 2780	2972	chrome.exe	31
PID 2972 wrote to memory of 2780	2972	chrome.exe	31
PID 2972 wrote to memory of 2780	2972	chrome.exe	31
PID 2972 wrote to memory of 2780	2972	chrome.exe	31
PID 2972 wrote to memory of 2780	2972	chrome.exe	31
PID 2972 wrote to memory of 2780	2972	chrome.exe	31
PID 2972 wrote to memory of 2780	2972	chrome.exe	31
PID 2972 wrote to memory of 2780	2972	chrome.exe	31
PID 2972 wrote to memory of 2780	2972	chrome.exe	31
PID 2972 wrote to memory of 2780	2972	chrome.exe	31
PID 2972 wrote to memory of 2780	2972	chrome.exe	31
PID 2972 wrote to memory of 2780	2972	chrome.exe	31
PID 2972 wrote to memory of 2780	2972	chrome.exe	31
PID 2972 wrote to memory of 2780	2972	chrome.exe	31
PID 2972 wrote to memory of 2780	2972	chrome.exe	31
PID 2972 wrote to memory of 2780	2972	chrome.exe	31
PID 2972 wrote to memory of 2780	2972	chrome.exe	31
PID 2972 wrote to memory of 2780	2972	chrome.exe	31
PID 2972 wrote to memory of 2780	2972	chrome.exe	31
PID 2972 wrote to memory of 2780	2972	chrome.exe	31
PID 2972 wrote to memory of 2408	2972	chrome.exe	32
PID 2972 wrote to memory of 2408	2972	chrome.exe	32
PID 2972 wrote to memory of 2408	2972	chrome.exe	32
PID 2972 wrote to memory of 2368	2972	chrome.exe	33
PID 2972 wrote to memory of 2368	2972	chrome.exe	33
PID 2972 wrote to memory of 2368	2972	chrome.exe	33
PID 2972 wrote to memory of 2368	2972	chrome.exe	33
PID 2972 wrote to memory of 2368	2972	chrome.exe	33
PID 2972 wrote to memory of 2368	2972	chrome.exe	33
PID 2972 wrote to memory of 2368	2972	chrome.exe	33
PID 2972 wrote to memory of 2368	2972	chrome.exe	33
PID 2972 wrote to memory of 2368	2972	chrome.exe	33
PID 2972 wrote to memory of 2368	2972	chrome.exe	33
PID 2972 wrote to memory of 2368	2972	chrome.exe	33
PID 2972 wrote to memory of 2368	2972	chrome.exe	33
PID 2972 wrote to memory of 2368	2972	chrome.exe	33
PID 2972 wrote to memory of 2368	2972	chrome.exe	33
PID 2972 wrote to memory of 2368	2972	chrome.exe	33
PID 2972 wrote to memory of 2368	2972	chrome.exe	33
PID 2972 wrote to memory of 2368	2972	chrome.exe	33
PID 2972 wrote to memory of 2368	2972	chrome.exe	33
PID 2972 wrote to memory of 2368	2972	chrome.exe	33

C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
"C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
1⤵
- Loads dropped DLL
PID:2080

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef73c9758,0x7fef73c9768,0x7fef73c9778
  2⤵
  PID:2236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1180 --field-trial-handle=1196,i,11126901441274762909,18046707500936941519,131072 /prefetch:2
  2⤵
  PID:2780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1564 --field-trial-handle=1196,i,11126901441274762909,18046707500936941519,131072 /prefetch:8
  2⤵
  PID:2408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1632 --field-trial-handle=1196,i,11126901441274762909,18046707500936941519,131072 /prefetch:8
  2⤵
  PID:2368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2328 --field-trial-handle=1196,i,11126901441274762909,18046707500936941519,131072 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2340 --field-trial-handle=1196,i,11126901441274762909,18046707500936941519,131072 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1244 --field-trial-handle=1196,i,11126901441274762909,18046707500936941519,131072 /prefetch:2
  2⤵
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2848 --field-trial-handle=1196,i,11126901441274762909,18046707500936941519,131072 /prefetch:2
  2⤵
  PID:1324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3340 --field-trial-handle=1196,i,11126901441274762909,18046707500936941519,131072 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3916 --field-trial-handle=1196,i,11126901441274762909,18046707500936941519,131072 /prefetch:8
  2⤵
  PID:2008

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
987B

MD5
865061353c3ed7e2cbd20af445053fc3

SHA1
6b48791deb6d911df6be5a760b91db11171c468b

SHA256
a994f7e073ddf54ce664905ab0c25e3da0be6c65ed651dbc3fcac358e55af33b

SHA512
1bf8fab17fa5491fcc6d33a3ba4fda76600112c9402e68aaa570e6cc93b0e25d12eece495af2cb90215bb1b885f324db5fa5ab1c7d5da52098d6fa7a07f30c34

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
30c2f43c0a8db1d9d9af63552247ea6a

SHA1
1067b7f58ddc84c839985fec82a6d8a34328b875

SHA256
781910349718a7b95d476b002f674d188471171e7bb2f7471c82e926b04e0e54

SHA512
3537f217d0b290c0c0820e360ed65ef0d02b927dbc077368ccb81709ee3d5f416ec4501c44ad0645b3e9d26106b6752a4afc5e11ebf651e54b29be8b44e9ebef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFf771dec.TMP

Filesize
4KB

MD5
cb10a5558a4aa4693bb86dc96132d972

SHA1
db1cd534ae67f61fc05c012a74248bfe47bd5949

SHA256
23d4db450a5ab804d49ad8783bd9ff8ebcdd6641cb6e2d1dafebd3e619db532a

SHA512
de53f1a535e178464bad374ea755a0c2b67dd5d5b9ce4a3562812f8a2587a6c3535460a85b2e0c2a3db9cd2358795178d78a3ce6ec6512fa484e0d145a49250a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
\Users\Admin\AppData\Local\Temp\Opera_installer_2403052028144542080.dll

Filesize
5.2MB

MD5
2e9e548040cbc282125031030041b2a9

SHA1
a84b26339be4cdd889ac806227c3260d57296605

SHA256
b44501388ac04d3db78e167cc1dc4daea68aa5c7140a2976b5a8e04f6d2438eb

SHA512
8be8af00aabe5e5ccac38faaf9ed499ea9c84d6a180a3cbce81297b58e1b4cfff5597638587c8f81058f59e19f87ac4bcdacfb34e1fce7ac61128837e39d3e7b

Download Submit
memory/2080-0-0x00000000002D0000-0x0000000000891000-memory.dmp

Filesize
5.8MB

Download
memory/2080-7-0x00000000002D0000-0x0000000000891000-memory.dmp

Filesize
5.8MB

Download