73b0cf115b4baa06622e67706739e8f47518f912809b79a39366e70da3f560e0

Resubmissions

10/05/2024, 01:52

240510-cavmbsca6w 4

10/05/2024, 01:51

10/05/2024, 01:43

09/05/2024, 22:19

09/05/2024, 22:16

09/05/2024, 21:43

Analysis

max time kernel
1722s
max time network
1175s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 21:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Vivaldi.6.7.3329.26.x64.exe
Size

110.5MB
MD5

d91380acca246bc420a6b7e1cc3079c3
SHA1

6f852a838e0a7dba730167ed514172e48898b41b
SHA256

73b0cf115b4baa06622e67706739e8f47518f912809b79a39366e70da3f560e0
SHA512

c27375d48b49f45edbdad647970c015a020994c80732b35e10c4e6162e75fa91c1703e84baa210f0e6da196ec099a20ff722fe9b8ae052e0213f3ba75756e837
SSDEEP

3145728:z3jTPLe53eikBD/XrxC/vX3Vls/59+kGsyiQfoocU1s:z3HPI388XX3fs/59+BFK

Score

4^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3948	setup.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2068	Vivaldi.6.7.3329.26.x64.exe
Token: SeIncBasePriorityPrivilege	2068	Vivaldi.6.7.3329.26.x64.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 3948	2068	Vivaldi.6.7.3329.26.x64.exe	87
PID 2068 wrote to memory of 3948	2068	Vivaldi.6.7.3329.26.x64.exe	87

C:\Users\Admin\AppData\Local\Temp\Vivaldi.6.7.3329.26.x64.exe
"C:\Users\Admin\AppData\Local\Temp\Vivaldi.6.7.3329.26.x64.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Users\Admin\AppData\Local\Temp\CR_6F9CC.tmp\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\CR_6F9CC.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\CR_6F9CC.tmp\VIVALDI.PACKED.7Z" --vivaldi-mini
  2⤵
  - Executes dropped EXE
  PID:3948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CR_6F9CC.tmp\setup.exe

Filesize
19.0MB

MD5
cae2b3a1d5fcb12fcf92fda463714e77

SHA1
76a1fcb7f3be5c1227227c178677349c8b5f4f26

SHA256
978ac79d4303555f25b384113de680896fe014cb2f74fc392b3684295320e150

SHA512
981c0381207721a5de42c83f27ff661ea98c6c9071308f4d6ca81b5c7a132b87ea4ab96f61f8e8ce2b8689f8341c96a85d24f4a028050621b54d4bfdcefef210

Download Submit