0784140c6ea41b8eeb85f81186967ba0eb674188b37837755d06647630221ccd

General

Target

OperaGXSetup.exe
Size

3.1MB
MD5

4361cd63cd257e7c0c2b877aa1e2509f
SHA1

a9f4924104c51dc7bcafc9e752f138d077ec26a4
SHA256

0784140c6ea41b8eeb85f81186967ba0eb674188b37837755d06647630221ccd
SHA512

32eb5d63483e693581dc6bdca8789cbed84a142c609dd488d63e7e953cd7d2c27027169362faa14c3f33b2660b611e33c93f3b9f54670c7613fb82df45325e72
SSDEEP

49152:zNEyYQPMB2nYlQWY9p/RxOgkDA5/uzsKFuaLU0kOyrRBzfMUNYpoMjw+:JEsY213Rx+87aLU0kPElX

Score

8^/10

spyware stealer

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 8 IoCs

pid	Process
3768	setup.exe
3456	setup.exe
1764	setup.exe
3964	setup.exe
3688	setup.exe
4488	Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
1300	assistant_installer.exe
2740	assistant_installer.exe

Loads dropped DLL 5 IoCs

pid	Process
3768	setup.exe
3456	setup.exe
1764	setup.exe
3964	setup.exe
3688	setup.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	setup.exe
File opened (read-only)	\??\F:	setup.exe
File opened (read-only)	\??\D:	setup.exe
File opened (read-only)	\??\F:	setup.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	setup.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3768	setup.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 3768	1368	OperaGXSetup.exe	78
PID 1368 wrote to memory of 3768	1368	OperaGXSetup.exe	78
PID 1368 wrote to memory of 3768	1368	OperaGXSetup.exe	78
PID 3768 wrote to memory of 3456	3768	setup.exe	79
PID 3768 wrote to memory of 3456	3768	setup.exe	79
PID 3768 wrote to memory of 3456	3768	setup.exe	79
PID 3768 wrote to memory of 1764	3768	setup.exe	80
PID 3768 wrote to memory of 1764	3768	setup.exe	80
PID 3768 wrote to memory of 1764	3768	setup.exe	80
PID 3768 wrote to memory of 3964	3768	setup.exe	82
PID 3768 wrote to memory of 3964	3768	setup.exe	82
PID 3768 wrote to memory of 3964	3768	setup.exe	82
PID 3964 wrote to memory of 3688	3964	setup.exe	83
PID 3964 wrote to memory of 3688	3964	setup.exe	83
PID 3964 wrote to memory of 3688	3964	setup.exe	83
PID 3768 wrote to memory of 4488	3768	setup.exe	84
PID 3768 wrote to memory of 4488	3768	setup.exe	84
PID 3768 wrote to memory of 4488	3768	setup.exe	84
PID 3768 wrote to memory of 1300	3768	setup.exe	85
PID 3768 wrote to memory of 1300	3768	setup.exe	85
PID 3768 wrote to memory of 1300	3768	setup.exe	85
PID 1300 wrote to memory of 2740	1300	assistant_installer.exe	86
PID 1300 wrote to memory of 2740	1300	assistant_installer.exe	86
PID 1300 wrote to memory of 2740	1300	assistant_installer.exe	86

C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
"C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Users\Admin\AppData\Local\Temp\7zS855FD397\setup.exe
  C:\Users\Admin\AppData\Local\Temp\7zS855FD397\setup.exe --server-tracking-blob=MDg4Mzc2NGQzMWVkMDg2NGUzODUwZDYxMmYyODI4MWYzMTI4NzViYWFiNTIxMGQxN2VjYjA0ZGMxMzFmN2Y2OTp7ImNvdW50cnkiOiJVUyIsImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYUdYU2V0dXAuZXhlIiwicHJvZHVjdCI6Im9wZXJhX2d4IiwicXVlcnkiOiIvb3BlcmFfZ3gvc3RhYmxlL3dpbmRvd3M/dXRtX3NvdXJjZT1nb29nbGUmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249T0dYX1VTX1NlYXJjaF9FTl9UMV9CcmFuZF9WMiZ1dG1fY29udGVudD02MzQzNzk5MTg1NTImdXRtX2lkPUNqd0tDQWp3a0ptMEJoQnhFaXdBd1QxQVhCbUhrN0d2cWxSNjNfd1BfLWFXb3V3VEdjNDZqRUtCcEQ5TEZxdmQ0cFNXT3JCeHotTXBBeG9DWG1BUUF2RF9Cd0UmaHR0cF9yZWZlcnJlcj1odHRwcyUzQSUyRiUyRnd3dy5vcGVyYS5jb20lMkZneCUyRmd4LWJyb3dzZXIlM0Z1dG1faWQlM0RDandLQ0Fqd2tKbTBCaEJ4RWl3QXdUMUFYQm1IazdHdnFsUjYzX3dQXy1hV291d1RHYzQ2akVLQnBEOUxGcXZkNHBTV09yQnh6LU1wQXhvQ1htQVFBdkRfQndFJTI2dXRtX21lZGl1bSUzRHBhJTI2dXRtX3NvdXJjZSUzRGdvb2dsZSUyNnV0bV9jYW1wYWlnbiUzRE9HWF9VU19TZWFyY2hfRU5fVDFfQnJhbmRfVjIlMjZ1dG1fY29udGVudCUzRDYzNDM3OTkxODU1MiUyNmdhZF9zb3VyY2UlM0QxJTI2Z2NsaWQlM0RDandLQ0Fqd2tKbTBCaEJ4RWl3QXdUMUFYQm1IazdHdnFsUjYzX3dQXy1hV291d1RHYzQ2akVLQnBEOUxGcXZkNHBTV09yQnh6LU1wQXhvQ1htQVFBdkRfQndFJnV0bV9zaXRlPW9wZXJhX2NvbSZ1dG1fbGFzdHBhZ2U9b3BlcmEuY29tJTJGZ3gtYnJvd3NlciZ1dG1faWQ9Q2p3S0NBandrSm0wQmhCeEVpd0F3VDFBWEJtSGs3R3ZxbFI2M193UF8tYVdvdXdUR2M0NmpFS0JwRDlMRnF2ZDRwU1dPckJ4ei1NcEF4b0NYbUFRQXZEX0J3RSZkbF90b2tlbj0yODY0NTI5MSIsInRpbWVzdGFtcCI6IjE3MjAxMjMxMTMuNjEyMSIsInVzZXJhZ2VudCI6Ik1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMjMuMC4wLjAgU2FmYXJpLzUzNy4zNiBPUFIvMTA5LjAuMC4wIChFZGl0aW9uIHN0ZC0xKSIsInV0bSI6eyJjYW1wYWlnbiI6Ik9HWF9VU19TZWFyY2hfRU5fVDFfQnJhbmRfVjIiLCJjb250ZW50IjoiNjM0Mzc5OTE4NTUyIiwiaWQiOiJDandLQ0Fqd2tKbTBCaEJ4RWl3QXdUMUFYQm1IazdHdnFsUjYzX3dQXy1hV291d1RHYzQ2akVLQnBEOUxGcXZkNHBTV09yQnh6LU1wQXhvQ1htQVFBdkRfQndFIiwibGFzdHBhZ2UiOiJvcGVyYS5jb20vZ3gtYnJvd3NlciIsIm1lZGl1bSI6InBhIiwic2l0ZSI6Im9wZXJhX2NvbSIsInNvdXJjZSI6Imdvb2dsZSJ9LCJ1dWlkIjoiYTAyMDFmNzUtMTU5Yi00YzliLWJmNTItZjk3OTlkZDE0MzEwIn0=
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Modifies system certificate store
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3768
- - C:\Users\Admin\AppData\Local\Temp\7zS855FD397\setup.exe
    C:\Users\Admin\AppData\Local\Temp\7zS855FD397\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=111.0.5168.54 --initial-client-data=0x32c,0x330,0x334,0x308,0x338,0x74571138,0x74571144,0x74571150
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3456
- - C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe" --version
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1764
- - C:\Users\Admin\AppData\Local\Temp\7zS855FD397\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS855FD397\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=1 --general-interests=1 --general-location=1 --personalized-content=1 --personalized-ads=1 --vought_browser=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=3768 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20240704195929" --session-guid=80a17f41-18b1-4611-a711-7c870e920cb6 --server-tracking-blob=OWM2OWM2Zjg4YTc0N2M4N2FhNTc2NGU4N2JkYjU2YmYzMDY4OGJhN2RjMWY4ZTBlOTczMDczYWFiYzZmZTQxMDp7ImNvdW50cnkiOiJVUyIsImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYUdYU2V0dXAuZXhlIiwicHJvZHVjdCI6eyJuYW1lIjoib3BlcmFfZ3gifSwicXVlcnkiOiIvb3BlcmFfZ3gvc3RhYmxlL3dpbmRvd3M/dXRtX3NvdXJjZT1nb29nbGUmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249T0dYX1VTX1NlYXJjaF9FTl9UMV9CcmFuZF9WMiZ1dG1fY29udGVudD02MzQzNzk5MTg1NTImdXRtX2lkPUNqd0tDQWp3a0ptMEJoQnhFaXdBd1QxQVhCbUhrN0d2cWxSNjNfd1BfLWFXb3V3VEdjNDZqRUtCcEQ5TEZxdmQ0cFNXT3JCeHotTXBBeG9DWG1BUUF2RF9Cd0UmaHR0cF9yZWZlcnJlcj1odHRwcyUzQSUyRiUyRnd3dy5vcGVyYS5jb20lMkZneCUyRmd4LWJyb3dzZXIlM0Z1dG1faWQlM0RDandLQ0Fqd2tKbTBCaEJ4RWl3QXdUMUFYQm1IazdHdnFsUjYzX3dQXy1hV291d1RHYzQ2akVLQnBEOUxGcXZkNHBTV09yQnh6LU1wQXhvQ1htQVFBdkRfQndFJTI2dXRtX21lZGl1bSUzRHBhJTI2dXRtX3NvdXJjZSUzRGdvb2dsZSUyNnV0bV9jYW1wYWlnbiUzRE9HWF9VU19TZWFyY2hfRU5fVDFfQnJhbmRfVjIlMjZ1dG1fY29udGVudCUzRDYzNDM3OTkxODU1MiUyNmdhZF9zb3VyY2UlM0QxJTI2Z2NsaWQlM0RDandLQ0Fqd2tKbTBCaEJ4RWl3QXdUMUFYQm1IazdHdnFsUjYzX3dQXy1hV291d1RHYzQ2akVLQnBEOUxGcXZkNHBTV09yQnh6LU1wQXhvQ1htQVFBdkRfQndFJnV0bV9zaXRlPW9wZXJhX2NvbSZ1dG1fbGFzdHBhZ2U9b3BlcmEuY29tJTJGZ3gtYnJvd3NlciZ1dG1faWQ9Q2p3S0NBandrSm0wQmhCeEVpd0F3VDFBWEJtSGs3R3ZxbFI2M193UF8tYVdvdXdUR2M0NmpFS0JwRDlMRnF2ZDRwU1dPckJ4ei1NcEF4b0NYbUFRQXZEX0J3RSZkbF90b2tlbj0yODY0NTI5MSIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTcyMDEyMzExMy42MTIxIiwidXNlcmFnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEyMy4wLjAuMCBTYWZhcmkvNTM3LjM2IE9QUi8xMDkuMC4wLjAgKEVkaXRpb24gc3RkLTEpIiwidXRtIjp7ImNhbXBhaWduIjoiT0dYX1VTX1NlYXJjaF9FTl9UMV9CcmFuZF9WMiIsImNvbnRlbnQiOiI2MzQzNzk5MTg1NTIiLCJpZCI6IkNqd0tDQWp3a0ptMEJoQnhFaXdBd1QxQVhCbUhrN0d2cWxSNjNfd1BfLWFXb3V3VEdjNDZqRUtCcEQ5TEZxdmQ0cFNXT3JCeHotTXBBeG9DWG1BUUF2RF9Cd0UiLCJsYXN0cGFnZSI6Im9wZXJhLmNvbS9neC1icm93c2VyIiwibWVkaXVtIjoicGEiLCJzaXRlIjoib3BlcmFfY29tIiwic291cmNlIjoiZ29vZ2xlIn0sInV1aWQiOiJhMDIwMWY3NS0xNTliLTRjOWItYmY1Mi1mOTc5OWRkMTQzMTAifQ== --desktopshortcut=1 --wait-for-package --initial-proc-handle=A808000000000000
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - Suspicious use of WriteProcessMemory
    PID:3964
  - - C:\Users\Admin\AppData\Local\Temp\7zS855FD397\setup.exe
      C:\Users\Admin\AppData\Local\Temp\7zS855FD397\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=111.0.5168.54 --initial-client-data=0x31c,0x320,0x324,0x2f8,0x328,0x71de1138,0x71de1144,0x71de1150
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3688
- - C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202407041959291\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202407041959291\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"
    3⤵
    - Executes dropped EXE
    PID:4488
- - C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202407041959291\assistant\assistant_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202407041959291\assistant\assistant_installer.exe" --version
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1300
  - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202407041959291\assistant\assistant_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202407041959291\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0xf24f48,0xf24f58,0xf24f64
      4⤵
      Executes dropped EXE
      PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202407041959291\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe

Filesize
1.4MB

MD5
e9a2209b61f4be34f25069a6e54affea

SHA1
6368b0a81608c701b06b97aeff194ce88fd0e3c0

SHA256
e950f17f4181009eeafa9f5306e8a9dfd26d88ca63b1838f44ff0efc738e7d1f

SHA512
59e46277ca79a43ed8b0a25b24eff013e251a75f90587e013b9c12851e5dd7283b6172f7d48583982f6a32069457778ee440025c1c754bf7bb6ce8ae1d2c3fc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202407041959291\assistant\assistant_installer.exe

Filesize
1.8MB

MD5
4c8fbed0044da34ad25f781c3d117a66

SHA1
8dd93340e3d09de993c3bc12db82680a8e69d653

SHA256
afe569ce9e4f71c23ba5f6e8fd32be62ac9538e397cde8f2ecbe46faa721242a

SHA512
a04e6fd052d2d63a0737c83702c66a9af834f9df8423666508c42b3e1d8384300239c9ddacdc31c1e85140eb1193bcfac209f218750b40342492ffce6e9da481

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS855FD397\setup.exe

Filesize
6.4MB

MD5
97d3cae40268951e9e8da731c0820f0a

SHA1
34358b04b5fb6c97a94a4bad28bdeed5888b2241

SHA256
e19f63f813df6f8b2d0e6ecc09e91b81caf6d330acde1996296120ae58e67baf

SHA512
ba0c7ab04c8a1ff77c900d9f84e57eb1846e3bd697982884ad8790a65ff6fb8aa19d622368bbd9f8efaf79872d207f3e568e57fe3d7288c912591f7c02adf3c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2407041959291033768.dll

Filesize
5.9MB

MD5
c6cbf40287bc8a4ec0f0801b8a6905ab

SHA1
5a62c2d2acbcc3bb8bbad3a5913f65b134008966

SHA256
344093a219d1b4ae17ef4a188d87057e0c83c897381a9883eb76b9f06fb08160

SHA512
7704f3d09d2d6b08d624427a950d3a31ba750a3327862b6d96b5e60e3b6450f36860e5f55b5b39ff46b0105d6f6eaec32f344e2beae112757e8c52e359014b15

Download Submit
C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat

Filesize
40B

MD5
b9bc2485ea3d5b7450d76bd261537983

SHA1
141436b74b1543e3139a353481e32e07160a780f

SHA256
aad0fe52ae4114b0dcca2153fdf6e083a3f116fd141f7a7eb23dd32cdcb8696e

SHA512
43f7b3081a29ee3852c65af92d36f6a7c78e017263647b6a95cab9080a69815909c70c078d60bc3e2b4f9b211f94ba9e0aa4991c25739ad4902e5429a4e76b39

Download Submit

Analysis

Sharing