Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    420s
  • max time network
    423s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/12/2024, 16:28

General

  • Target

    OperaGXX.exe

  • Size

    9.8MB

  • MD5

    e70c39d1f1ac0e52fcc52d64fa871f30

  • SHA1

    f17425132831a1ad0a112c75b7a7f04fed73c965

  • SHA256

    1ef1e0470f27e25343087cd3ae225d4dd8711a31f308b314b83affe57b3181bb

  • SHA512

    50d4e45b23b50b531b6d1db7bbb8683a427b9060df77cd993bd6ef36163f44d882985c3217a4d15fab8e53437582d670da7549778918f5c0d68205b61794fb69

  • SSDEEP

    98304:hH6fVmD1C2gnoWoS7Kr7Eg7ru9MvE9pRD4Z4S5bovr:hH31C2bSI7Eg7ySsqBRovr

Malware Config

Extracted

Family

skuld

C2

https://discord.com/api/webhooks/1313142704439427092/YKwWrnk0E-QciBzXVfcEmZg-CAYCUchZuAphpzY_DvCmjRKFsYGLIEowP8dExV6arEe2

Signatures

  • Skuld family
  • Skuld stealer

    An info stealer written in Go lang.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops file in Drivers directory 3 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Views/modifies file attributes 1 TTPs 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\OperaGXX.exe
    "C:\Users\Admin\AppData\Local\Temp\OperaGXX.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3460
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\OperaGXX.exe
      2⤵
      • Views/modifies file attributes
      PID:4712
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\OperaGXX.exe
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2276
    • C:\Windows\System32\Wbem\wmic.exe
      wmic os get Caption
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4960
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
      2⤵
      • Views/modifies file attributes
      PID:4492
    • C:\Windows\System32\Wbem\wmic.exe
      wmic cpu get Name
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2712
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:4400
    • C:\Windows\System32\Wbem\wmic.exe
      wmic path win32_VideoController get name
      2⤵
      • Detects videocard installed
      PID:3096
    • C:\Windows\System32\Wbem\wmic.exe
      wmic csproduct get UUID
      2⤵
        PID:5040
      • C:\Windows\system32\attrib.exe
        attrib -r C:\Windows\System32\drivers\etc\hosts
        2⤵
        • Drops file in Drivers directory
        • Views/modifies file attributes
        PID:1040
      • C:\Windows\system32\attrib.exe
        attrib +r C:\Windows\System32\drivers\etc\hosts
        2⤵
        • Drops file in Drivers directory
        • Views/modifies file attributes
        PID:1164
      • C:\Windows\system32\netsh.exe
        netsh wlan show profiles
        2⤵
        • Event Triggered Execution: Netsh Helper DLL
        • System Network Configuration Discovery: Wi-Fi Discovery
        PID:4652
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3020
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xnit5uqb\xnit5uqb.cmdline"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4596
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC880.tmp" "c:\Users\Admin\AppData\Local\Temp\xnit5uqb\CSCF665C37F9505454B88D47D99B39834E.TMP"
            4⤵
              PID:3512

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

        Filesize

        2KB

        MD5

        d85ba6ff808d9e5444a4b369f5bc2730

        SHA1

        31aa9d96590fff6981b315e0b391b575e4c0804a

        SHA256

        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

        SHA512

        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        944B

        MD5

        77d622bb1a5b250869a3238b9bc1402b

        SHA1

        d47f4003c2554b9dfc4c16f22460b331886b191b

        SHA256

        f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

        SHA512

        d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        944B

        MD5

        01fff31a70e26012f37789b179059e32

        SHA1

        555b6f05cce7daf46920df1c01eb5c55dc62c9e6

        SHA256

        adf65afaf1c83572f05a99bf2ede8eb7be1aab0717d5254f501d5e09ba6f587b

        SHA512

        ac310c9bc5c1effc45e1e425972b09d1f961af216b50e1a504caa046b7f1a5f3179760e0b29591d83756ecb686d17a24770cf06fcea57e6f287ca5bbf6b6971b

      • C:\Users\Admin\AppData\Local\Temp\RESC880.tmp

        Filesize

        1KB

        MD5

        00a7a997b05ad363142a842022bba8da

        SHA1

        2acea484f597a53243ba89201c6ff25f29bce02a

        SHA256

        bcd700fb21774745b85299c3a12ab184cfc02aa1242c7a564dd394b28f8b3a30

        SHA512

        57f616277b7df546e4e9a56b17ed2af928418f1c873b747f922330feb55367b7582875c51e679a13f3fef18ecd188a9f6b90ff14bffa797dce92d8e745b40d8d

      • C:\Users\Admin\AppData\Local\Temp\UTbe5DWALB\Display (1).png

        Filesize

        430KB

        MD5

        9a5acb5bb7f3fd9a65abc397764891d1

        SHA1

        0409ced74c4aae90785b9d565f2f160c0517e68f

        SHA256

        dc0fa80501b5b01580a67237a62ef23c355969e001b856cbea362a00d05a07ec

        SHA512

        f4af044ab42eb8d9830fb04892b3d926a61abb3b9919218f078ed7cc30939eb8dc48bd3aa00fafedb85755cedaf0ad330973d57a6831aa4d11a3f4f2b7617019

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kdbvavtq.21e.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Admin\AppData\Local\Temp\xnit5uqb\xnit5uqb.dll

        Filesize

        4KB

        MD5

        ff9a18e3e0e006b801e42bbde6d5e57d

        SHA1

        df5ca40ef5a732d7330dbed129c8b0b8bfd4f0dc

        SHA256

        28338390193b1369d1e1b61f9b05cab2bee9488812a17221c5bc61b044a91da9

        SHA512

        4b0270d2b170e1922189496eef3a94c587a0b6a3ffcff017c704aacb84c672a5dd8567bd0644a8da580cb92f677d26aaab1b9321cb6f2c9ac1d0bbecf1cebabd

      • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe

        Filesize

        9.8MB

        MD5

        e70c39d1f1ac0e52fcc52d64fa871f30

        SHA1

        f17425132831a1ad0a112c75b7a7f04fed73c965

        SHA256

        1ef1e0470f27e25343087cd3ae225d4dd8711a31f308b314b83affe57b3181bb

        SHA512

        50d4e45b23b50b531b6d1db7bbb8683a427b9060df77cd993bd6ef36163f44d882985c3217a4d15fab8e53437582d670da7549778918f5c0d68205b61794fb69

      • C:\Windows\System32\drivers\etc\hosts

        Filesize

        2KB

        MD5

        6e2386469072b80f18d5722d07afdc0b

        SHA1

        032d13e364833d7276fcab8a5b2759e79182880f

        SHA256

        ade1813ae70d7da0bfe63d61af8a4927ed12a0f237b79ce1ac3401c0646f6075

        SHA512

        e6b96f303935f2bbc76f6723660b757d7f3001e1b13575639fb62d68a734b4ce8c833b991b2d39db3431611dc2cacde879da1aecb556b23c0d78f5ee67967acb

      • \??\c:\Users\Admin\AppData\Local\Temp\xnit5uqb\CSCF665C37F9505454B88D47D99B39834E.TMP

        Filesize

        652B

        MD5

        78b173567aa12ae80615ddfaf3d3f24e

        SHA1

        fb7170ec2cd5e4d8799249aa80391ad51aa07e69

        SHA256

        50c9afc6a61c7bfd86af0d2018d88fad9683eb5839fcc8cc6114bd2606bb7845

        SHA512

        ea19f743769370f0f375329f0adf9108682d2848f56a95b9aeec3dcc2efa61523bc1db6481ac2628ed750e192e989215deedb410e51678238d843f66c3503cde

      • \??\c:\Users\Admin\AppData\Local\Temp\xnit5uqb\xnit5uqb.0.cs

        Filesize

        1004B

        MD5

        c76055a0388b713a1eabe16130684dc3

        SHA1

        ee11e84cf41d8a43340f7102e17660072906c402

        SHA256

        8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

        SHA512

        22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

      • \??\c:\Users\Admin\AppData\Local\Temp\xnit5uqb\xnit5uqb.cmdline

        Filesize

        607B

        MD5

        0d453a778e1358f6b8df3a30b18c5027

        SHA1

        f3e8ff4bf9159772e4a38a81178291d4d2ec9f6e

        SHA256

        3c176a563c8cb703b6f07be5f0a77f56e4ade3a3fb8a95faa70571f03f818f14

        SHA512

        30968ca43ccbfd8e6eb4baadcd87e55c24bd72492ad0b4b3761fc8141d42132224a718d04b633c9b31c12264731f443bfcf182225fe60d9074dc99e5c4618bd1

      • memory/2276-0-0x00007FFD352C3000-0x00007FFD352C5000-memory.dmp

        Filesize

        8KB

      • memory/2276-22-0x00007FFD352C0000-0x00007FFD35D81000-memory.dmp

        Filesize

        10.8MB

      • memory/2276-12-0x000002C0ED800000-0x000002C0ED822000-memory.dmp

        Filesize

        136KB

      • memory/2276-2-0x00007FFD352C0000-0x00007FFD35D81000-memory.dmp

        Filesize

        10.8MB

      • memory/2276-1-0x00007FFD352C0000-0x00007FFD35D81000-memory.dmp

        Filesize

        10.8MB

      • memory/3020-63-0x00000266A1C10000-0x00000266A1C18000-memory.dmp

        Filesize

        32KB