Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    139s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/08/2024, 23:25

General

  • Target

    3117e3a4a00d8f0ffc4be9ac526beeb2c7a8adb48e9cff48a735c023b89d3a3e.exe

  • Size

    3.1MB

  • MD5

    1bfece71241360400c358dd5e3c871de

  • SHA1

    93a8719a69184925226678fd6e9307e96cd6067c

  • SHA256

    3117e3a4a00d8f0ffc4be9ac526beeb2c7a8adb48e9cff48a735c023b89d3a3e

  • SHA512

    c5544d35fc2cf9cfb8de19a669690d21abaa019c1db0ac0f49f0e5a5e9a2a2d56c4793ac3a6102aca47a50847a8fe6a8ba4871d027b3128fd6b9e52208f11688

  • SSDEEP

    98304:mAcRTd/kggQSwydThBmnXodHG+z92I0xkZV8zDzSC:MRTFkg3SwyhsXoRG+zAkZCzDz/

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3117e3a4a00d8f0ffc4be9ac526beeb2c7a8adb48e9cff48a735c023b89d3a3e.exe
    "C:\Users\Admin\AppData\Local\Temp\3117e3a4a00d8f0ffc4be9ac526beeb2c7a8adb48e9cff48a735c023b89d3a3e.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2952
    • C:\Users\Admin\AppData\Local\Temp\7zS88B961B7\setup.exe
      C:\Users\Admin\AppData\Local\Temp\7zS88B961B7\setup.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2572
      • C:\Users\Admin\AppData\Local\Temp\7zS88B961B7\setup.exe
        C:\Users\Admin\AppData\Local\Temp\7zS88B961B7\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=112.0.5197.104 --initial-client-data=0x32c,0x330,0x334,0x328,0x338,0x74501b54,0x74501b60,0x74501b6c
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2460
      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe" --version
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4504
      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408252325111\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408252325111\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2392
      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408252325111\assistant\assistant_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408252325111\assistant\assistant_installer.exe" --version
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4496
        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408252325111\assistant\assistant_installer.exe
          "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408252325111\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0x704f48,0x704f58,0x704f64
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3628

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408252325111\additional_file0.tmp

    Filesize

    1.4MB

    MD5

    e9a2209b61f4be34f25069a6e54affea

    SHA1

    6368b0a81608c701b06b97aeff194ce88fd0e3c0

    SHA256

    e950f17f4181009eeafa9f5306e8a9dfd26d88ca63b1838f44ff0efc738e7d1f

    SHA512

    59e46277ca79a43ed8b0a25b24eff013e251a75f90587e013b9c12851e5dd7283b6172f7d48583982f6a32069457778ee440025c1c754bf7bb6ce8ae1d2c3fc5

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408252325111\assistant\assistant_installer.exe

    Filesize

    1.8MB

    MD5

    4c8fbed0044da34ad25f781c3d117a66

    SHA1

    8dd93340e3d09de993c3bc12db82680a8e69d653

    SHA256

    afe569ce9e4f71c23ba5f6e8fd32be62ac9538e397cde8f2ecbe46faa721242a

    SHA512

    a04e6fd052d2d63a0737c83702c66a9af834f9df8423666508c42b3e1d8384300239c9ddacdc31c1e85140eb1193bcfac209f218750b40342492ffce6e9da481

  • C:\Users\Admin\AppData\Local\Temp\7zS88B961B7\setup.exe

    Filesize

    6.4MB

    MD5

    b4da1657d31832c9965d54c5037a3402

    SHA1

    c312863d621b0b5ec9ec930b1db73de3c95f7141

    SHA256

    563fcd4ca2678ddb6c1366c92aa4daa410d7eba73d68d9336fb967f732770c8d

    SHA512

    643d2ec57767443e0efcc580a0e5abe062375f34b936daa22aa24e20d837b84854de18f636dc0ca5d100b4309a456746d733a65f8d1ccb173fe590ab5bf99007

  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2408252325101472572.dll

    Filesize

    5.9MB

    MD5

    e730bd98eb4754f9c0abd490461fbf1d

    SHA1

    783ea46e2b4d9e48feda3f9839bfbff40d8cf3ae

    SHA256

    0129372834853db0b565c20cceb3781a021fd7893d44d045f2ae671477a6a92a

    SHA512

    579cd23108d9cec9ff29447f89b770ee9308b261968242bf8046a3e4ca01704a2cd40072b6814b18d5e0eaa413033eb369c7a65146b3126be14899b73f634167

  • C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat

    Filesize

    40B

    MD5

    bbc3b5db35ca9e6996e41bcf3c9be833

    SHA1

    80f62a1fd6eaecd64f7e0fbb557adfe61bfb431c

    SHA256

    a68736eb5e5bd752003f2dfbae4170d0020b12c6572a502f5af3fc69ff324577

    SHA512

    cf09fda16595a6507ba498eab6ab0396b8ba7f4e8e48b80fdb1f2f6f55b1d57e5141a413a139087f664e474827f153b6b6a3e0d4629a30c3b3856adaf93a0af2