Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
256s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
27/06/2024, 23:10
Static task
static1
Behavioral task
behavioral1
Sample
a30a1a3fed468884c922e23a5cf2698fd5a915eebcb6fceda855ffebf036271a.exe
Resource
win7-20240508-en
General
-
Target
a30a1a3fed468884c922e23a5cf2698fd5a915eebcb6fceda855ffebf036271a.exe
-
Size
2.0MB
-
MD5
387ab5aedc15bbc9493e628fc5d239f2
-
SHA1
f8869f1ea001f85ff868e1db7fb924acefcf8d6f
-
SHA256
a30a1a3fed468884c922e23a5cf2698fd5a915eebcb6fceda855ffebf036271a
-
SHA512
a80d83c7d10c2305914b8b695ee7796db301940f1000378754d8536bbe7c557416ca909eace3955febba5e22145e1e6f9dca35fd34d1fdd5531e56dd4e7ce2c9
-
SSDEEP
49152:bNEyY80FNFPy4tGmml/0947g+b9W7m6S/sbs0wQ22qPAoFmkn:BEhFvqXjbqoJQCF
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 6 IoCs
pid Process 4220 setup.exe 1916 setup.exe 2296 setup.exe 2452 Assistant_111.0.5168.25_Setup.exe_sfx.exe 5080 assistant_installer.exe 4256 assistant_installer.exe -
Loads dropped DLL 7 IoCs
pid Process 4220 setup.exe 1916 setup.exe 2296 setup.exe 5080 assistant_installer.exe 5080 assistant_installer.exe 4256 assistant_installer.exe 4256 assistant_installer.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: setup.exe File opened (read-only) \??\F: setup.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e75490f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e4190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e199604000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 setup.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4220 setup.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2676 wrote to memory of 4220 2676 a30a1a3fed468884c922e23a5cf2698fd5a915eebcb6fceda855ffebf036271a.exe 74 PID 2676 wrote to memory of 4220 2676 a30a1a3fed468884c922e23a5cf2698fd5a915eebcb6fceda855ffebf036271a.exe 74 PID 2676 wrote to memory of 4220 2676 a30a1a3fed468884c922e23a5cf2698fd5a915eebcb6fceda855ffebf036271a.exe 74 PID 4220 wrote to memory of 1916 4220 setup.exe 75 PID 4220 wrote to memory of 1916 4220 setup.exe 75 PID 4220 wrote to memory of 1916 4220 setup.exe 75 PID 4220 wrote to memory of 2296 4220 setup.exe 76 PID 4220 wrote to memory of 2296 4220 setup.exe 76 PID 4220 wrote to memory of 2296 4220 setup.exe 76 PID 4220 wrote to memory of 2452 4220 setup.exe 77 PID 4220 wrote to memory of 2452 4220 setup.exe 77 PID 4220 wrote to memory of 2452 4220 setup.exe 77 PID 4220 wrote to memory of 5080 4220 setup.exe 78 PID 4220 wrote to memory of 5080 4220 setup.exe 78 PID 4220 wrote to memory of 5080 4220 setup.exe 78 PID 5080 wrote to memory of 4256 5080 assistant_installer.exe 79 PID 5080 wrote to memory of 4256 5080 assistant_installer.exe 79 PID 5080 wrote to memory of 4256 5080 assistant_installer.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\a30a1a3fed468884c922e23a5cf2698fd5a915eebcb6fceda855ffebf036271a.exe"C:\Users\Admin\AppData\Local\Temp\a30a1a3fed468884c922e23a5cf2698fd5a915eebcb6fceda855ffebf036271a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\7zS47A49377\setup.exeC:\Users\Admin\AppData\Local\Temp\7zS47A49377\setup.exe --server-tracking-blob=YjBhOGU1YzA4ODdhN2JiOTQ2OGNiMTdkMjEyZWYwMmJkZGNkMjIzM2JkNzRlN2NhNDg4MGJhODgxMTQxM2E0Mzp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPXBiJnV0bV9zb3VyY2U9Y2luc3QmdXRtX2NhbXBhaWduPU9wZXJhX0Rlc2t0b3AmdXRtX2NvbnRlbnQ9NWQ3NzZmZmE0ZDQ4OF8mdXRtX2lkPUwxUXJjVzJSVTZVNFY5bXNoU1gzWlciLCJ0aW1lc3RhbXAiOiIxNzE5MTcxMjY5LjQ0OTMiLCJ1dG0iOnsiY2FtcGFpZ24iOiJPcGVyYV9EZXNrdG9wIiwiY29udGVudCI6IjVkNzc2ZmZhNGQ0ODhfIiwiaWQiOiJMMVFyY1cyUlU2VTRWOW1zaFNYM1pXIiwibWVkaXVtIjoicGIiLCJzb3VyY2UiOiJjaW5zdCJ9LCJ1dWlkIjoiNTNjZTA5MWUtNThjNi00ODM1LWJiMzUtYzYyNTRlNzAzMGRkIn0=2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\7zS47A49377\setup.exeC:\Users\Admin\AppData\Local\Temp\7zS47A49377\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=111.0.5168.25 --initial-client-data=0x30c,0x310,0x314,0x2e0,0x318,0x72dba128,0x72dba134,0x72dba1403⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1916
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe" --version3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406272311011\assistant\Assistant_111.0.5168.25_Setup.exe_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406272311011\assistant\Assistant_111.0.5168.25_Setup.exe_sfx.exe"3⤵
- Executes dropped EXE
PID:2452
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406272311011\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406272311011\assistant\assistant_installer.exe" --version3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406272311011\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406272311011\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=111.0.5168.25 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x559f88,0x559f94,0x559fa04⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4256
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406272311011\additional_file0.tmp
Filesize2.6MB
MD5dfe86cd1ab9fe5055dba3ead830574f6
SHA1800ba6757bf301a918a800ce15a3853e3941e019
SHA256f9cdff6fea65207cde93c637cca4b92939359ede3ac7337c2048e076085e7e5f
SHA512d3d363a221a3fa7a010194965cb8cc7210aa17d81be094a3e8ee89bb2de684c3b874ce1c6c55e8109091a849874d05c1bae132d450dabe2597167782d0063570
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406272311011\assistant\assistant_installer.exe
Filesize1.9MB
MD5a8c564c798ae8160230297d361952dd6
SHA134a45ee9eb7733ae9afbebb9f2951288a27f9df5
SHA2563f48e5331890159921f7b65103c4b06bbf08552065718313761647d1648f8a64
SHA512141ac3356a2fee32121231308cdd8afa5f76695185d66bba9fa977b66e5c6bad8bd4ea4656acdc743cd6b6f85c28a16626ab07f8b2c72652de82b4fb21c0bb54
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406272311011\assistant\dbgcore.DLL
Filesize166KB
MD5ff0364394f7bc74d0c68040a5fbcda6f
SHA1d19ce25e7d0e3043c377c5770b0f20cb42bd0295
SHA2563bd944ca30b77f9ce8a1f503a7ee0dbcb77b92ae9fcd68907abe0ef2e9275053
SHA5120676de1a65cc9c209f544e921f45c5eb8c5d42fb391ae1f370b0a2bedd26740f75f32ea5f17497d86e03edd6cf281ca51a7a54380a82de152d0e25a28297ccfd
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406272311011\assistant\dbghelp.dll
Filesize1.7MB
MD5eeb07dc97790e8b075d6938759fe6ee1
SHA1afb099be8ee28fef6488b5d253ba910b081a3b1b
SHA2562808772ce1653cdf659f4781c718a9dd6f3ac547d52a1080462487baccaeaf78
SHA512e541d839562c5045b5af0cc7ad2129393383df3fc528193cdef1a31ded4e894ffb8a02d34a009b3d6543d4987616534caaefa130a2b55ea73baf37ee0a294980
-
Filesize
5.2MB
MD56a39877aba485cd09c090e4e24f53de6
SHA1ada29b30d665203b7e6cda8f1b6114699ba472a7
SHA2562daba944e443aea09f4d50a0ac5ea2a6bb85b6f861c83c1bbd284e6d81e8a7e3
SHA512ecab25931ed2d985b396e62d5930dd5c7edc3c0835e3e3df3058197bb8800491a8ea13fc824935bcf187a848a29da176c7dd7dc8f43aaca108e17fed76dfb32c
-
Filesize
40B
MD54a649268ff4208496b29920d7d953973
SHA13b1176b04a5a3b28e68c5c2c934361b3262c9888
SHA256537ebae3e93852cd35570821bf3656ebceba3cfce9b07b77bc7f76d2c12e8ab8
SHA512ab88a92561534102149048817f168eec4ce8c115728ae74ffec5203a01ab57ce932bec203f80667dc98a1dfee4a955343a9afa780c37fbbec2e7efeb203e201a
-
Filesize
4.7MB
MD5b05a49fe0b700420401974a62cea7be6
SHA11dec7981c1d5eab1952c69c512dcc3877241c82e
SHA25612f8a3f3569cecd209e1a6e229e7e6c3d130ab1694fdf71c10d5e3b5154ba703
SHA51234fc1e8a9e046400107ea0e1be1aeb7d1d8a5e71380733bbce0ac5d15ee9b58762b63f7de4591762b6a7c32f5be83122bbf757d3a88a6f78e6d2c06ffd596833