Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/08/2024, 23:10

General

  • Target

    c8f83ac331e182d1fd2836cf6e2e01a1fcd3b60b6b50a4d2b95fb90c73dc3a5b.exe

  • Size

    3.1MB

  • MD5

    1e573dc68aa904f919dee7883695db3a

  • SHA1

    3b099b7edfc134ec63a3afe6242a0f9698b7cd68

  • SHA256

    c8f83ac331e182d1fd2836cf6e2e01a1fcd3b60b6b50a4d2b95fb90c73dc3a5b

  • SHA512

    4731b2a51311eac697e02b3dbb992f8c219b9b971d9b66e3430a16b739dedd3071027252ad23374466879b12300b135a07c9ca406afc9b233a5d3b1ae6f4c83c

  • SSDEEP

    49152:aVAbw8VyRPkVwSdyKE6a8anqApzEVZnk8m0Uf89+zvi1QXsy4TpM+DWUl+n1aso:uA7VyRPS7MLq4ykF09+riyXWz6Ha

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c8f83ac331e182d1fd2836cf6e2e01a1fcd3b60b6b50a4d2b95fb90c73dc3a5b.exe
    "C:\Users\Admin\AppData\Local\Temp\c8f83ac331e182d1fd2836cf6e2e01a1fcd3b60b6b50a4d2b95fb90c73dc3a5b.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:888
    • C:\Users\Admin\AppData\Local\Temp\7zS873C3187\setup.exe
      C:\Users\Admin\AppData\Local\Temp\7zS873C3187\setup.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3504
      • C:\Users\Admin\AppData\Local\Temp\7zS873C3187\setup.exe
        C:\Users\Admin\AppData\Local\Temp\7zS873C3187\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=112.0.5197.60 --initial-client-data=0x32c,0x330,0x334,0x300,0x338,0x741d1b54,0x741d1b60,0x741d1b6c
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:3828
      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe" --version
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:112
      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408172310421\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408172310421\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3720
      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408172310421\assistant\assistant_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408172310421\assistant\assistant_installer.exe" --version
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1252
        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408172310421\assistant\assistant_installer.exe
          "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408172310421\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0xbb4f48,0xbb4f58,0xbb4f64
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2104

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408172310421\additional_file0.tmp

    Filesize

    1.4MB

    MD5

    e9a2209b61f4be34f25069a6e54affea

    SHA1

    6368b0a81608c701b06b97aeff194ce88fd0e3c0

    SHA256

    e950f17f4181009eeafa9f5306e8a9dfd26d88ca63b1838f44ff0efc738e7d1f

    SHA512

    59e46277ca79a43ed8b0a25b24eff013e251a75f90587e013b9c12851e5dd7283b6172f7d48583982f6a32069457778ee440025c1c754bf7bb6ce8ae1d2c3fc5

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408172310421\assistant\assistant_installer.exe

    Filesize

    1.8MB

    MD5

    4c8fbed0044da34ad25f781c3d117a66

    SHA1

    8dd93340e3d09de993c3bc12db82680a8e69d653

    SHA256

    afe569ce9e4f71c23ba5f6e8fd32be62ac9538e397cde8f2ecbe46faa721242a

    SHA512

    a04e6fd052d2d63a0737c83702c66a9af834f9df8423666508c42b3e1d8384300239c9ddacdc31c1e85140eb1193bcfac209f218750b40342492ffce6e9da481

  • C:\Users\Admin\AppData\Local\Temp\7zS873C3187\setup.exe

    Filesize

    6.4MB

    MD5

    607fb47ad9d20bb16f90e4a38c93bbfe

    SHA1

    578ea8b4bd0bbd32114bfd61910118c3d9cfc355

    SHA256

    8a82ae5c857123cc6972b93828f3a6202c0db4d325ea6d5b1e36dcfb290c1e09

    SHA512

    23470d0aa5989132efa1fcd4b1d183374384e3b75249910c08e22d2fedf315f084028b7299d6f6c0a5230b2ec78179485d0f187d0a87f710d25f1eac81939e47

  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2408172310419923504.dll

    Filesize

    5.9MB

    MD5

    1e6485e90130bb0cffd2ae2ca7fef2a2

    SHA1

    b9c01fddb3921b6f56d8d774eb0364f7024428e8

    SHA256

    907cb59383443ce62fdcd2eb90e4bf32cf3a0de6078e708f694dfc7bd7166b5b

    SHA512

    e28ec73e1465591827f092b71ab740a8de0b7ffcf5af0b3e4c1c8be37f16f1a87ae4fdfe23c25a305741a5aaf30fd2aab77f55061eb729f0dc5e64aef3dd6527

  • C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat

    Filesize

    40B

    MD5

    9aa910fda6318ea53b732f21c6175035

    SHA1

    ec31d2bb78be7e6b91ca8384491e8bdf6b8fcd43

    SHA256

    58900993f3cd92ebb38a4db882dab78e5b178b5e2f6830a2476174ee0e01ca16

    SHA512

    7ae84d7322ecd7c4a75a4ffd84d06e12249b4b43e91af69b260d40bab01be5506866aa33694fcd228ecb369b97889512230598e6bc6ad6396375fdf3f9b44ebd