Analysis

  • max time kernel
    622s
  • max time network
    457s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240319-en
  • resource tags

    arch:x64arch:x86image:win11-20240319-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    03/04/2024, 10:26

General

  • Target

    OperaSetup.exe

  • Size

    5.1MB

  • MD5

    46a9e225ea8539401a47ebd2f9a508e0

  • SHA1

    e21861a997b235eb7b1fb4c3bee5f9ba03ed5425

  • SHA256

    77f42444714c37f07cfcca0b959cae92c6889e0b0cca0b5cada20fff36ac05c5

  • SHA512

    0f231c40b39dea42c388fed599de86ad6f7accbf3356afa603fba88a70ec2203f514f1e33570108a9c1fd6e4e36b7df33330e0162cd450ce7bd7ae6b0ed5e253

  • SSDEEP

    98304:M0NFA6666666666666666666666666666666x666666666666666fwwwwwwwwww7:UPMki6zio75L3pf3dedO4keCIwkoYbgb

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 9 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\OperaSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\OperaSetup.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • Modifies system certificate store
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:492
    • C:\Users\Admin\AppData\Local\Temp\OperaSetup.exe
      C:\Users\Admin\AppData\Local\Temp\OperaSetup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.35 --initial-client-data=0x2c0,0x2c4,0x2c8,0x298,0x2cc,0x752be1d0,0x752be1dc,0x752be1e8
      2⤵
      • Loads dropped DLL
      PID:3316
    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe" --version
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4040
    • C:\Users\Admin\AppData\Local\Temp\OperaSetup.exe
      "C:\Users\Admin\AppData\Local\Temp\OperaSetup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=1 --general-interests=1 --general-location=1 --personalized-content=1 --personalized-ads=1 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=492 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240403102721" --session-guid=9d4ff876-2c0e-47a7-847e-2e160fdc15f6 --server-tracking-blob=YzUzN2JkYWExMGM1ZjU5Nzg3ODMzZTgzZWMzNDk4MzAyMjA2YmU4ZjA0NjNiOTJkMjIyZDZiMTk2OGRhMDJkODp7ImNvdW50cnkiOiJQTCIsImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYVNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhIn0sInF1ZXJ5IjoiL29wZXJhL3N0YWJsZS93aW5kb3dzP3V0bV9zb3VyY2U9Z29vZ2xlJnV0bV9tZWRpdW09b3NlJnV0bV9jYW1wYWlnbj0lMjhub25lJTI5Jmh0dHBfcmVmZXJyZXI9aHR0cHMlM0ElMkYlMkZ3d3cuZ29vZ2xlLmNvbSUyRiZ1dG1fc2l0ZT1vcGVyYV9jb20mdXRtX2xhc3RwYWdlPW9wZXJhLmNvbSUyRmRvd25sb2FkJmRsX3Rva2VuPTczMDU4ODY5Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzEyMDAwODUxLjU3MjYiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTIyLjAuMC4wIFNhZmFyaS81MzcuMzYiLCJ1dG0iOnsiY2FtcGFpZ24iOiIobm9uZSkiLCJsYXN0cGFnZSI6Im9wZXJhLmNvbS9kb3dubG9hZCIsIm1lZGl1bSI6Im9zZSIsInNpdGUiOiJvcGVyYV9jb20iLCJzb3VyY2UiOiJnb29nbGUifSwidXVpZCI6IjlmZTE0ZmE4LWYzNWItNGJkZC1hOTljLTg2OTc0MTY4YzY1MCJ9 --desktopshortcut=1 --wait-for-package --initial-proc-handle=780A000000000000
      2⤵
      • Loads dropped DLL
      • Enumerates connected drives
      • Suspicious use of WriteProcessMemory
      PID:1596
      • C:\Users\Admin\AppData\Local\Temp\OperaSetup.exe
        C:\Users\Admin\AppData\Local\Temp\OperaSetup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.35 --initial-client-data=0x2b0,0x2b4,0x2b8,0x28c,0x2bc,0x7294e1d0,0x7294e1dc,0x7294e1e8
        3⤵
        • Loads dropped DLL
        PID:4692
    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031027211\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031027211\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe"
      2⤵
      • Executes dropped EXE
      PID:2024
    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031027211\assistant\assistant_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031027211\assistant\assistant_installer.exe" --version
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:356
      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031027211\assistant\assistant_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031027211\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0xd80040,0xd8004c,0xd80058
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1604

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe

          Filesize

          5.1MB

          MD5

          46a9e225ea8539401a47ebd2f9a508e0

          SHA1

          e21861a997b235eb7b1fb4c3bee5f9ba03ed5425

          SHA256

          77f42444714c37f07cfcca0b959cae92c6889e0b0cca0b5cada20fff36ac05c5

          SHA512

          0f231c40b39dea42c388fed599de86ad6f7accbf3356afa603fba88a70ec2203f514f1e33570108a9c1fd6e4e36b7df33330e0162cd450ce7bd7ae6b0ed5e253

        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031027211\additional_file0.tmp

          Filesize

          2.5MB

          MD5

          20d293b9bf23403179ca48086ba88867

          SHA1

          dedf311108f607a387d486d812514a2defbd1b9e

          SHA256

          fd996b95ae46014edfd630bfc2bf8bc9e626adf883a1da017a8c3973b68ec348

          SHA512

          5d575c6f0d914583f9bb54f7b884caf9182f26f850da9bdd962f4ed5ed7258316a46fafaf3828dccb6916baaadb681fe1d175a3f4ed59f56066dc7e32b66f7b6

        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031027211\assistant\assistant_installer.exe

          Filesize

          1.9MB

          MD5

          b3f05009b53af6435e86cfd939717e82

          SHA1

          770877e7c5f03e8d684984fe430bdfcc2cf41b26

          SHA256

          3ea8d40fcede1fc03e5603246d75d13e8d44d7229d4c390c39a55534053027f7

          SHA512

          d2dee80aaa79b19f1eb1db85079a05f621780e06bfea9e838b62d757ba29399f9090ec7c6ff553377c9b712f3ba8dd812cdff39f3e28829928e86746a8ac6b27

        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031027211\assistant\dbgcore.DLL

          Filesize

          166KB

          MD5

          8b6f64e5d3a608b434079e50a1277913

          SHA1

          03f431fabf1c99a48b449099455c1575893d9f32

          SHA256

          926d444ffca166e006920412677c4ed2ef159cf0efc0578cb45b824f428f5eb2

          SHA512

          c9aeac62ece564ac64a894300fb9d41d13f22951ead73421854c23c506760d984dff0af92bef2d80f3a66e782f0075832e9c24a50ae6110d27a25c14e065b41c

        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031027211\assistant\dbghelp.dll

          Filesize

          1.7MB

          MD5

          925ea07f594d3fce3f73ede370d92ef7

          SHA1

          f67ea921368c288a9d3728158c3f80213d89d7c2

          SHA256

          6d02ebd4ec9a6093f21cd8ccefb9445fa0ab7b1f69ac868a5cfc5d28ed8d2de9

          SHA512

          a809851da820d9fdd8fb860a8f549311dcc2579df2c6f6fba74f50d5d8bf94baa834b09fb5476ac248f18d1deb6b47d4fdd6d658889d5d45ca8774a9264483d2

        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031027211\opera_package

          Filesize

          103.9MB

          MD5

          f9172d1f7a8316c593bdddc47f403b06

          SHA1

          ed1e5a40b040af2c60ed6c2536b3bf7ee55e0e52

          SHA256

          473f0d4b886db8cd39b900b92bdc0625a3fcec8addd43f71179696bdf186ec3b

          SHA512

          f51ab2bdf29ca6839e4f7cf1fac1bdfc03ba2da4569a8f21e5d2ee13e6519097c3da40bf0b4ca7642286ed033d0126bbd14ef7842eb9f2db1d6e503849521b02

        • C:\Users\Admin\AppData\Local\Temp\Opera_installer_240403102720299492.dll

          Filesize

          4.6MB

          MD5

          117176ddeaf70e57d1747704942549e4

          SHA1

          75e3ab6b3469d93cce9ea2f7e22b71b987ccdf2b

          SHA256

          3c5b34de987116a4d3240e319c0da89a951c96b81e6705476a0fea27b22b20af

          SHA512

          ca2a356929c92d314aab63d7f3b246d72783212dfa3a4507f28d41a51ca0eedc78e85b1cd453aa8e02c12509f847a0216bb702154f903291c804c8a98ec378b9

        • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

          Filesize

          40B

          MD5

          7a167268ac3a85dadd6201815284e9de

          SHA1

          eb3fcc8368187830b269241b32564adc0e7538f1

          SHA256

          bd5e19563be6a3ee4d2ec53fa4860f1c463baa520adb8855f05de91f19525bb9

          SHA512

          6ceb46c812e7b68eecda24b8292387e1a4297a604665a2117ebc715341a4cd9c241f76c31d38adb17fec415904c39bde5c301e9f1680be35bef5f42958ff1c22