Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/04/2024, 10:13

General

  • Target

    OperaGXSetup.exe

  • Size

    3.4MB

  • MD5

    8f1754216056e8cb331b2898969a463d

  • SHA1

    9b4ec4f9b3228baabbf36179ec4596dc44127f1e

  • SHA256

    0161bc4af3c016135efaba480be6d286a35e357c30db4534e4ec1bca21522fae

  • SHA512

    438077c5f9ec56474993818e5b3c5c4259f21dd6995a8a0fdd6d2e9dcfcf6480de36323ec73fb53783c0e17b9933ee9e885e6dd55ebec70a797c042f3327c81c

  • SSDEEP

    98304:hWnL1M2XNmcGCVIps5phuIMAbvbJaJNQqPAbsU8968Vum8z22+:hWu2Qcvlh9vbvWobIbG3+

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • Modifies system certificate store
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4608
    • C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
      C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=107.0.5045.86 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2cc,0x2fc,0x74fc626c,0x74fc6278,0x74fc6284
      2⤵
      • Loads dropped DLL
      PID:5012
    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\OperaGXSetup.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\OperaGXSetup.exe" --version
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:544
    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202404111013231\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202404111013231\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"
      2⤵
      • Executes dropped EXE
      PID:1484
    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202404111013231\assistant\assistant_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202404111013231\assistant\assistant_installer.exe" --version
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4232
      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202404111013231\assistant\assistant_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202404111013231\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0x834f48,0x834f58,0x834f64
        3⤵
        • Executes dropped EXE
        PID:4024
    • C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
      "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=1 --general-interests=1 --general-location=1 --personalized-content=1 --personalized-ads=1 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=4608 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20240411101323" --session-guid=1a9fbc7f-a957-4077-b4a2-11a348e4570a --server-tracking-blob="NDg4ZDA0NWY2ZTYyNWYzZDg2MjY4MGVlZGNhODE4NmFlNWZhN2ZjMWQ4MDk0MDFhMTRkYmJiMTFmZjVjOWFlYTp7ImNvdW50cnkiOiJGUiIsImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYUdYU2V0dXAuZXhlIiwicHJvZHVjdCI6eyJuYW1lIjoib3BlcmFfZ3gifSwicXVlcnkiOiIvb3BlcmFfZ3gvc3RhYmxlL3dpbmRvd3M/dXRtX3NvdXJjZT1nb29nbGUmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249T0dYX0ZSX1NlYXJjaF9GUl9UMV9WMiZ1dG1fY29udGVudD02NDE4NTQ0MzI2ODkmdXRtX2lkPUNqMEtDUWp3bE42d0JoQ2NBUklzQUtadkQ1aXNOMlhIVGREcjcxNjdpNTMzWXBvYS1ObmdJWThLS0k2elBpbzkzTVRjUHFkY1ZuMmN1cWdhQXBKNEVBTHdfd2NCJmh0dHBfcmVmZXJyZXI9aHR0cHMlM0ElMkYlMkZ3d3cub3BlcmEuY29tJTJGZnIlMkZneCUzRnV0bV9pZCUzRENqMEtDUWp3bE42d0JoQ2NBUklzQUtadkQ1aXNOMlhIVGREcjcxNjdpNTMzWXBvYS1ObmdJWThLS0k2elBpbzkzTVRjUHFkY1ZuMmN1cWdhQXBKNEVBTHdfd2NCJTI2dXRtX21lZGl1bSUzRHBhJTI2dXRtX3NvdXJjZSUzRGdvb2dsZSUyNnV0bV9jYW1wYWlnbiUzRE9HWF9GUl9TZWFyY2hfRlJfVDFfVjIlMjZ1dG1fY29udGVudCUzRDY0MTg1NDQzMjY4OSUyNmdhZF9zb3VyY2UlM0QxJTI2Z2NsaWQlM0RDajBLQ1Fqd2xONndCaENjQVJJc0FLWnZENWlzTjJYSFRkRHI3MTY3aTUzM1lwb2EtTm5nSVk4S0tJNnpQaW85M01UY1BxZGNWbjJjdXFnYUFwSjRFQUx3X3djQiZ1dG1fc2l0ZT1vcGVyYV9jb20mdXRtX2xhc3RwYWdlPW9wZXJhLmNvbSUyRmd4JnV0bV9pZD1DajBLQ1Fqd2xONndCaENjQVJJc0FLWnZENWlzTjJYSFRkRHI3MTY3aTUzM1lwb2EtTm5nSVk4S0tJNnpQaW85M01UY1BxZGNWbjJjdXFnYUFwSjRFQUx3X3djQiZkbF90b2tlbj00ODE1MzM4MyIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTcxMjgzMDIwOC40NjU3IiwidXNlcmFnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEyMS4wLjAuMCBTYWZhcmkvNTM3LjM2IE9QUi8xMDcuMC4wLjAgKEVkaXRpb24gc3RkLTEpIiwidXRtIjp7ImNhbXBhaWduIjoiT0dYX0ZSX1NlYXJjaF9GUl9UMV9WMiIsImNvbnRlbnQiOiI2NDE4NTQ0MzI2ODkiLCJpZCI6IkNqMEtDUWp3bE42d0JoQ2NBUklzQUtadkQ1aXNOMlhIVGREcjcxNjdpNTMzWXBvYS1ObmdJWThLS0k2elBpbzkzTVRjUHFkY1ZuMmN1cWdhQXBKNEVBTHdfd2NCIiwibGFzdHBhZ2UiOiJvcGVyYS5jb20vZ3giLCJtZWRpdW0iOiJwYSIsInNpdGUiOiJvcGVyYV9jb20iLCJzb3VyY2UiOiJnb29nbGUifSwidXVpZCI6Ijc5YTVmNGRhLTJjOGYtNGZiZS04NjIwLWM2NjYyM2I2ZWI3OCJ9 " --desktopshortcut=1 --wait-for-package --initial-proc-handle=000B000000000000
      2⤵
      • Loads dropped DLL
      • Enumerates connected drives
      • Suspicious use of WriteProcessMemory
      PID:1012
      • C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=107.0.5045.86 --initial-client-data=0x2e8,0x2ec,0x2fc,0x2c4,0x300,0x723a626c,0x723a6278,0x723a6284
        3⤵
        • Loads dropped DLL
        PID:4668

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\OperaGXSetup.exe

    Filesize

    3.4MB

    MD5

    8f1754216056e8cb331b2898969a463d

    SHA1

    9b4ec4f9b3228baabbf36179ec4596dc44127f1e

    SHA256

    0161bc4af3c016135efaba480be6d286a35e357c30db4534e4ec1bca21522fae

    SHA512

    438077c5f9ec56474993818e5b3c5c4259f21dd6995a8a0fdd6d2e9dcfcf6480de36323ec73fb53783c0e17b9933ee9e885e6dd55ebec70a797c042f3327c81c

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202404111013231\additional_file0.tmp

    Filesize

    1.4MB

    MD5

    e9a2209b61f4be34f25069a6e54affea

    SHA1

    6368b0a81608c701b06b97aeff194ce88fd0e3c0

    SHA256

    e950f17f4181009eeafa9f5306e8a9dfd26d88ca63b1838f44ff0efc738e7d1f

    SHA512

    59e46277ca79a43ed8b0a25b24eff013e251a75f90587e013b9c12851e5dd7283b6172f7d48583982f6a32069457778ee440025c1c754bf7bb6ce8ae1d2c3fc5

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202404111013231\assistant\assistant_installer.exe

    Filesize

    1.8MB

    MD5

    4c8fbed0044da34ad25f781c3d117a66

    SHA1

    8dd93340e3d09de993c3bc12db82680a8e69d653

    SHA256

    afe569ce9e4f71c23ba5f6e8fd32be62ac9538e397cde8f2ecbe46faa721242a

    SHA512

    a04e6fd052d2d63a0737c83702c66a9af834f9df8423666508c42b3e1d8384300239c9ddacdc31c1e85140eb1193bcfac209f218750b40342492ffce6e9da481

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202404111013231\opera_package

    Filesize

    135.7MB

    MD5

    51925d4ccf835cfc01fc4128e16aae03

    SHA1

    2e29709468adb5399c91da7c65c2999ff1e136e9

    SHA256

    4bc959418d2a311e7fe50db799145d65382a7697230f9d343f3ae23f6526a91d

    SHA512

    a23cd3e8ddb059c898ccde02e3fb56f9767d989b96c207594d9a437964fd35a4f3ec7c68923ea669f206d3d13f9668b3970e9e6784e92e3a4beef10707267b32

  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2404111013223084608.dll

    Filesize

    5.2MB

    MD5

    7c4c89e7a2b29a8fc7c24fd158761f5f

    SHA1

    f05bddcb3df1811d104939192510d7afce5bf9b1

    SHA256

    b2b0b0372fea8c706860f531099234dd2e90a5648adba0e540cb1eeba6ea0d99

    SHA512

    135bea3366b56f78d78d71969f8ae09fca130339e8989480c29b9970e35c9ed81bccb0a26e68fa572d254d2434f10c28e200baf2044248378724fd471483cd0c

  • C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat

    Filesize

    40B

    MD5

    27cd5f3c8a4774feead55fdf51ef7943

    SHA1

    8be9c9e747f14693dd5c6bfdd75667070eb9ae7c

    SHA256

    f38c76b1176ce845b87f6ab996763a4d177ad9fa5d3ba7d2f6c31a99e72723e9

    SHA512

    0e1238271bb32b83ef07770941c00d57ec557c848230525188780c82652c485298f71e70ffdb887334bf1b43413bbd5f07931281dee4bc18222b5267d714b1de

  • memory/544-13-0x00000000004C0000-0x0000000000A80000-memory.dmp

    Filesize

    5.8MB

  • memory/544-17-0x00000000004C0000-0x0000000000A80000-memory.dmp

    Filesize

    5.8MB

  • memory/1012-99-0x0000000000F90000-0x0000000001550000-memory.dmp

    Filesize

    5.8MB

  • memory/4608-32-0x0000000000F90000-0x0000000001550000-memory.dmp

    Filesize

    5.8MB

  • memory/4608-1-0x0000000000F90000-0x0000000001550000-memory.dmp

    Filesize

    5.8MB

  • memory/4668-103-0x0000000000F90000-0x0000000001550000-memory.dmp

    Filesize

    5.8MB

  • memory/4668-109-0x0000000000F90000-0x0000000001550000-memory.dmp

    Filesize

    5.8MB

  • memory/5012-33-0x0000000000F90000-0x0000000001550000-memory.dmp

    Filesize

    5.8MB