Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/08/2024, 21:52

General

  • Target

    4348d5c448a95a8d3baa21992e114ba00d000591a626cd32af5ba77e32a89907.exe

  • Size

    3.1MB

  • MD5

    12c2115cde52bc47dfccd8cb849c96f5

  • SHA1

    c64149d1594abe616be646965526c4653e7451e2

  • SHA256

    4348d5c448a95a8d3baa21992e114ba00d000591a626cd32af5ba77e32a89907

  • SHA512

    036a000bdd9699ef1b3a6327f0a07151f6ff637e46d3b05d23c7fac0b2c765dfe494f17934750b44ad01576c24cbf12e5cb05c8efa2d6d117c7437bdd3c6f750

  • SSDEEP

    49152:TVAbwWYb12jHSVaHO3Vg3gfRv9yuqohghbpVOpmV4w1Z6nPI4gyJv:5AJY5oHhb0FqWgFQlw2w4gG

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4348d5c448a95a8d3baa21992e114ba00d000591a626cd32af5ba77e32a89907.exe
    "C:\Users\Admin\AppData\Local\Temp\4348d5c448a95a8d3baa21992e114ba00d000591a626cd32af5ba77e32a89907.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:112
    • C:\Users\Admin\AppData\Local\Temp\7zS070521C7\setup.exe
      C:\Users\Admin\AppData\Local\Temp\7zS070521C7\setup.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:440
      • C:\Users\Admin\AppData\Local\Temp\7zS070521C7\setup.exe
        C:\Users\Admin\AppData\Local\Temp\7zS070521C7\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=112.0.5197.74 --initial-client-data=0x324,0x328,0x32c,0x300,0x330,0x74931b54,0x74931b60,0x74931b6c
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:768
      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe" --version
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4808
      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408212152461\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408212152461\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:428
      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408212152461\assistant\assistant_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408212152461\assistant\assistant_installer.exe" --version
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1744
        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408212152461\assistant\assistant_installer.exe
          "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408212152461\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0xed4f48,0xed4f58,0xed4f64
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1440

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408212152461\additional_file0.tmp

    Filesize

    1.4MB

    MD5

    e9a2209b61f4be34f25069a6e54affea

    SHA1

    6368b0a81608c701b06b97aeff194ce88fd0e3c0

    SHA256

    e950f17f4181009eeafa9f5306e8a9dfd26d88ca63b1838f44ff0efc738e7d1f

    SHA512

    59e46277ca79a43ed8b0a25b24eff013e251a75f90587e013b9c12851e5dd7283b6172f7d48583982f6a32069457778ee440025c1c754bf7bb6ce8ae1d2c3fc5

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408212152461\assistant\assistant_installer.exe

    Filesize

    1.8MB

    MD5

    4c8fbed0044da34ad25f781c3d117a66

    SHA1

    8dd93340e3d09de993c3bc12db82680a8e69d653

    SHA256

    afe569ce9e4f71c23ba5f6e8fd32be62ac9538e397cde8f2ecbe46faa721242a

    SHA512

    a04e6fd052d2d63a0737c83702c66a9af834f9df8423666508c42b3e1d8384300239c9ddacdc31c1e85140eb1193bcfac209f218750b40342492ffce6e9da481

  • C:\Users\Admin\AppData\Local\Temp\7zS070521C7\setup.exe

    Filesize

    6.4MB

    MD5

    24ceb5521ec9daf20512eecdb1695958

    SHA1

    ffcb26e536dae0c7380c5cf784a7df1439815ae4

    SHA256

    9b400311b1b05422be39c6aa1410534edb32cf46da21348364cbcde7e8167ad8

    SHA512

    a0cc14b5e1c861c4eafb885beb65bcfa752c850c4c8225aeee728ee5cbf4a448a5e98d34dd985125acd261919a154000e8c7146485427be7ad7bb15dbe6b83f8

  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_240821215246040440.dll

    Filesize

    5.9MB

    MD5

    7916599e12ee8885e6a27d0d4573439f

    SHA1

    6959f0546e76b32d95c167aab10774261657f319

    SHA256

    3d3e546fbcd332e4a3bdadb2933a705bbc39e7a0c2f1e012a5269742a612afe2

    SHA512

    67d01ca3938abe1aa2018c49d3c089baaa0022b4ce35bf4950877d0a7b5e4df09d165c9a29afc33d8869fafb772ebc64ad65422ebd9d6473c76699d3021f1d93

  • C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat

    Filesize

    40B

    MD5

    4bd1165ebe2485d9cf727496c9089fa9

    SHA1

    a1aaa621ad7f5392fc334d969c5e477118f7facc

    SHA256

    bee12c284d79297991f843301baf02b2a996466c74f27927773e0944a89bdf08

    SHA512

    6e3942f2a33789da9926e807daa6d8508601cfd99c25d0ccc8f045039ce349fd9ae59dc9dd850173e8966c8fcd85e816f42bb62370ac32a97172caa532ed080b