73b0cf115b4baa06622e67706739e8f47518f912809b79a39366e70da3f560e0

Resubmissions

10/05/2024, 01:52

240510-cavmbsca6w 4

10/05/2024, 01:51

10/05/2024, 01:43

09/05/2024, 22:19

09/05/2024, 22:16

09/05/2024, 21:43

Analysis

max time kernel
1481s
max time network
1500s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
09/05/2024, 21:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Vivaldi.6.7.3329.26.x64.exe
Size

110.5MB
MD5

d91380acca246bc420a6b7e1cc3079c3
SHA1

6f852a838e0a7dba730167ed514172e48898b41b
SHA256

73b0cf115b4baa06622e67706739e8f47518f912809b79a39366e70da3f560e0
SHA512

c27375d48b49f45edbdad647970c015a020994c80732b35e10c4e6162e75fa91c1703e84baa210f0e6da196ec099a20ff722fe9b8ae052e0213f3ba75756e837
SSDEEP

3145728:z3jTPLe53eikBD/XrxC/vX3Vls/59+kGsyiQfoocU1s:z3HPI388XX3fs/59+BFK

Score

4^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2356	setup.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3900	Vivaldi.6.7.3329.26.x64.exe
Token: SeIncBasePriorityPrivilege	3900	Vivaldi.6.7.3329.26.x64.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3900 wrote to memory of 2356	3900	Vivaldi.6.7.3329.26.x64.exe	80
PID 3900 wrote to memory of 2356	3900	Vivaldi.6.7.3329.26.x64.exe	80

C:\Users\Admin\AppData\Local\Temp\Vivaldi.6.7.3329.26.x64.exe
"C:\Users\Admin\AppData\Local\Temp\Vivaldi.6.7.3329.26.x64.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3900
- C:\Users\Admin\AppData\Local\Temp\CR_A1CCD.tmp\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\CR_A1CCD.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\CR_A1CCD.tmp\VIVALDI.PACKED.7Z" --vivaldi-mini
  2⤵
  - Executes dropped EXE
  PID:2356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CR_A1CCD.tmp\setup.exe

Filesize
19.0MB

MD5
cae2b3a1d5fcb12fcf92fda463714e77

SHA1
76a1fcb7f3be5c1227227c178677349c8b5f4f26

SHA256
978ac79d4303555f25b384113de680896fe014cb2f74fc392b3684295320e150

SHA512
981c0381207721a5de42c83f27ff661ea98c6c9071308f4d6ca81b5c7a132b87ea4ab96f61f8e8ce2b8689f8341c96a85d24f4a028050621b54d4bfdcefef210

Download Submit