Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    89s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/03/2024, 23:10

General

  • Target

    c7dab771fbf5d6edbcdb1b892331340ad8b27d307b547e87e0fc83016df7196d.exe

  • Size

    4.3MB

  • MD5

    8d8675dff13dba84e138116f55547a21

  • SHA1

    3539639720aed34e60f0bd5b96c69734aba621fe

  • SHA256

    c7dab771fbf5d6edbcdb1b892331340ad8b27d307b547e87e0fc83016df7196d

  • SHA512

    ebfabc6b2adad4d9718bf2b215b352e500c69ad6820b96b92eba7a9af881889daa9dd8674872c58564b2557b3ede87096ae98ddf834645759d02961c7f63c5ed

  • SSDEEP

    98304:t+ckBkz8nmXHxP6t2y8n52X3CjxIIHdyquqmX3vHvXLNvsMkykJ:D4kzImXHxSt2y8noCjxIuDufHvXLNvD4

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies system certificate store 2 TTPs 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c7dab771fbf5d6edbcdb1b892331340ad8b27d307b547e87e0fc83016df7196d.exe
    "C:\Users\Admin\AppData\Local\Temp\c7dab771fbf5d6edbcdb1b892331340ad8b27d307b547e87e0fc83016df7196d.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • Modifies system certificate store
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1456
    • C:\Users\Admin\AppData\Local\Temp\c7dab771fbf5d6edbcdb1b892331340ad8b27d307b547e87e0fc83016df7196d.exe
      C:\Users\Admin\AppData\Local\Temp\c7dab771fbf5d6edbcdb1b892331340ad8b27d307b547e87e0fc83016df7196d.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=82.0.4227.23 --initial-client-data=0x2e8,0x2ec,0x2f0,0x2c4,0x2f4,0x7504a558,0x7504a568,0x7504a574
      2⤵
      • Loads dropped DLL
      PID:2008
    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\c7dab771fbf5d6edbcdb1b892331340ad8b27d307b547e87e0fc83016df7196d.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\c7dab771fbf5d6edbcdb1b892331340ad8b27d307b547e87e0fc83016df7196d.exe" --version
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3916
    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403082310411\assistant\_sfx.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403082310411\assistant\_sfx.exe"
      2⤵
      • Executes dropped EXE
      PID:4612
    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403082310411\assistant\assistant_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403082310411\assistant\assistant_installer.exe" --version
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4584
      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403082310411\assistant\assistant_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403082310411\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0xd80040,0xd8004c,0xd80058
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1368

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\c7dab771fbf5d6edbcdb1b892331340ad8b27d307b547e87e0fc83016df7196d.exe

    Filesize

    4.3MB

    MD5

    8d8675dff13dba84e138116f55547a21

    SHA1

    3539639720aed34e60f0bd5b96c69734aba621fe

    SHA256

    c7dab771fbf5d6edbcdb1b892331340ad8b27d307b547e87e0fc83016df7196d

    SHA512

    ebfabc6b2adad4d9718bf2b215b352e500c69ad6820b96b92eba7a9af881889daa9dd8674872c58564b2557b3ede87096ae98ddf834645759d02961c7f63c5ed

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403082310411\assistant\_sfx.exe

    Filesize

    2.5MB

    MD5

    20d293b9bf23403179ca48086ba88867

    SHA1

    dedf311108f607a387d486d812514a2defbd1b9e

    SHA256

    fd996b95ae46014edfd630bfc2bf8bc9e626adf883a1da017a8c3973b68ec348

    SHA512

    5d575c6f0d914583f9bb54f7b884caf9182f26f850da9bdd962f4ed5ed7258316a46fafaf3828dccb6916baaadb681fe1d175a3f4ed59f56066dc7e32b66f7b6

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403082310411\assistant\assistant_installer.exe

    Filesize

    1.9MB

    MD5

    b3f05009b53af6435e86cfd939717e82

    SHA1

    770877e7c5f03e8d684984fe430bdfcc2cf41b26

    SHA256

    3ea8d40fcede1fc03e5603246d75d13e8d44d7229d4c390c39a55534053027f7

    SHA512

    d2dee80aaa79b19f1eb1db85079a05f621780e06bfea9e838b62d757ba29399f9090ec7c6ff553377c9b712f3ba8dd812cdff39f3e28829928e86746a8ac6b27

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403082310411\assistant\dbgcore.dll

    Filesize

    166KB

    MD5

    8b6f64e5d3a608b434079e50a1277913

    SHA1

    03f431fabf1c99a48b449099455c1575893d9f32

    SHA256

    926d444ffca166e006920412677c4ed2ef159cf0efc0578cb45b824f428f5eb2

    SHA512

    c9aeac62ece564ac64a894300fb9d41d13f22951ead73421854c23c506760d984dff0af92bef2d80f3a66e782f0075832e9c24a50ae6110d27a25c14e065b41c

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403082310411\assistant\dbghelp.dll

    Filesize

    1.7MB

    MD5

    925ea07f594d3fce3f73ede370d92ef7

    SHA1

    f67ea921368c288a9d3728158c3f80213d89d7c2

    SHA256

    6d02ebd4ec9a6093f21cd8ccefb9445fa0ab7b1f69ac868a5cfc5d28ed8d2de9

    SHA512

    a809851da820d9fdd8fb860a8f549311dcc2579df2c6f6fba74f50d5d8bf94baa834b09fb5476ac248f18d1deb6b47d4fdd6d658889d5d45ca8774a9264483d2

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403082310411\opera_package

    Filesize

    1.9MB

    MD5

    99a39b1d62d2e7427ad61a9ad8681620

    SHA1

    d200b612b99484b0567ea7d0b2151167088b4dcb

    SHA256

    e65a6c2862ab6eda5e0db0e402f2155b9a5d430f1a9071a1e175b59707bc3318

    SHA512

    73f4bea5ac7ea56e2bbcdfaa7327bd536bf0b0b4bbaad2c3e8bfacfd1560b63ea2f0df61333671d341eaf893eb50c2d134d4de8e563661d49c41ced6fd39574a

  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2403082310414171456.dll

    Filesize

    3.8MB

    MD5

    d91e0edd63915b7aeda7e6b1f2fe9a4b

    SHA1

    fc0220c7af8299a9a724c2c1a3137133588ee2a3

    SHA256

    934f9c39ec9ad174176e5ceb672fcc5a2051083c823cdef3bc0820189ce30570

    SHA512

    76e5f240dc522ffd4f902e3549bc81443cc5011f52cf022ea147108f56d6152a8acb4e15721e60a2c5938a1411c79fc3a179352834a66be08764bfa3c9f57fcf

  • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

    Filesize

    40B

    MD5

    0195780fe232f3bc52ddf25820fc0fef

    SHA1

    13c5ff5cd909c2681506258cf2f331291b5e8fbd

    SHA256

    94f0799465c544c05ab5ae109a8d7e0d70a0292d5085a6ef1d40e454922bfb52

    SHA512

    c6a2adec71e8127101e7a080adf9d18c8c1fc6d4510455ab424d2a7f800e2961048a56f15ee8f8981bb3a423c251a3392553b212ada7a9eb909b44d4735fc4e5