Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

03/01/2025, 17:30

250103-v3fb8avmdw 8

03/01/2025, 17:29

250103-v2veravmbz 8

Analysis

  • max time kernel
    623s
  • max time network
    435s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-es
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-eslocale:es-esos:windows10-2004-x64systemwindows
  • submitted
    03/01/2025, 17:29

General

  • Target

    OperaGXSetup.exe

  • Size

    3.8MB

  • MD5

    fb23e09da4b0ebd20a0072e75fd994f4

  • SHA1

    bc3433296ae972d574a368d50b737fd984cf3d38

  • SHA256

    e478c912ca786de43cc76bfece772eef194600726e5641dcaab4e0cb260fa90e

  • SHA512

    26d8005aaedb6066b65c1d564234ce25ab0aa9c318610a473aaa7e7fc71fcf5a4cb99fc9422be932ae36367ff48855a046eb0286ac848f34d575c8d519b19222

  • SSDEEP

    49152:SVAbwA+j3AtriaXicL8D8nqdZqb8oM28CBHmLOIt/ZwDAakqbMz3Lnn7cAWFJJx:WA+jxJIfMKmLOIt/yDh7MbLnnXWFl

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:864
    • C:\Users\Admin\AppData\Local\Temp\7zS06302A87\setup.exe
      C:\Users\Admin\AppData\Local\Temp\7zS06302A87\setup.exe --server-tracking-blob=ZWJhYzcxNjgwMzIwMTNlNzhiYjU3YWE2ODViZjJjNjBmODRiODk1NzUwNDllMjY4ZWEzMDZkMDA5MzQyMDNkMDp7ImNvdW50cnkiOiJDTyIsImVkaXRpb24iOiJzdGQtMiIsImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYUdYU2V0dXAuZXhlIiwicHJvZHVjdCI6Im9wZXJhX2d4IiwicXVlcnkiOiIvb3BlcmFfZ3gvc3RhYmxlL3dpbmRvd3M/ZWRpdGlvbj1zdGQtMiZ1dG1fc291cmNlPVBXTmdhbWVzJnV0bV9tZWRpdW09cGEmdXRtX2NhbXBhaWduPVBXTl9DTyZlZGl0aW9uPXN0ZC0yJnV0bV9jb250ZW50PTEyMjJfMzY1M2I5YmJlYjhmYzRkMTEwZDRmNWUxZTZjZDA4YTQmdXRtX2lkPWUzNjYyMWNkYWVkZTRhNjc4ZTI0OGMzY2EzNzFjZTBiJmh0dHBfcmVmZXJyZXI9bWlzc2luZyZ1dG1fc2l0ZT1vcGVyYV9jb20mdXRtX2xhc3RwYWdlPW9wZXJhLmNvbSUyRmd4JnV0bV9pZD1lMzY2MjFjZGFlZGU0YTY3OGUyNDhjM2NhMzcxY2UwYiZkbF90b2tlbj03MTQyNDE5MyIsInRpbWVzdGFtcCI6IjE3MzU4NzEyOTguMzk0OCIsInVzZXJhZ2VudCI6Ik1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMzEuMC4wLjAgU2FmYXJpLzUzNy4zNiBFZGcvMTMxLjAuMC4wIiwidXRtIjp7ImNhbXBhaWduIjoiUFdOX0NPIiwiY29udGVudCI6IjEyMjJfMzY1M2I5YmJlYjhmYzRkMTEwZDRmNWUxZTZjZDA4YTQiLCJpZCI6ImUzNjYyMWNkYWVkZTRhNjc4ZTI0OGMzY2EzNzFjZTBiIiwibGFzdHBhZ2UiOiJvcGVyYS5jb20vZ3giLCJtZWRpdW0iOiJwYSIsInNpdGUiOiJvcGVyYV9jb20iLCJzb3VyY2UiOiJQV05nYW1lcyJ9LCJ1dWlkIjoiZDYxOTcwZjItZjM0YS00MGEwLTkyMGItNmIxNTM3Y2ExZWU5In0=
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3572
      • C:\Users\Admin\AppData\Local\Temp\7zS06302A87\setup.exe
        C:\Users\Admin\AppData\Local\Temp\7zS06302A87\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=115.0.5322.124 --initial-client-data=0x32c,0x330,0x334,0x304,0x338,0x7463ed4c,0x7463ed58,0x7463ed64
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4912
      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe" --version
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:628
      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202501031730041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202501031730041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4796
      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202501031730041\assistant\assistant_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202501031730041\assistant\assistant_installer.exe" --version
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4724
        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202501031730041\assistant\assistant_installer.exe
          "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202501031730041\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0xc44f48,0xc44f58,0xc44f64
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1952

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202501031730041\additional_file0.tmp

    Filesize

    1.4MB

    MD5

    e9a2209b61f4be34f25069a6e54affea

    SHA1

    6368b0a81608c701b06b97aeff194ce88fd0e3c0

    SHA256

    e950f17f4181009eeafa9f5306e8a9dfd26d88ca63b1838f44ff0efc738e7d1f

    SHA512

    59e46277ca79a43ed8b0a25b24eff013e251a75f90587e013b9c12851e5dd7283b6172f7d48583982f6a32069457778ee440025c1c754bf7bb6ce8ae1d2c3fc5

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202501031730041\assistant\assistant_installer.exe

    Filesize

    1.8MB

    MD5

    4c8fbed0044da34ad25f781c3d117a66

    SHA1

    8dd93340e3d09de993c3bc12db82680a8e69d653

    SHA256

    afe569ce9e4f71c23ba5f6e8fd32be62ac9538e397cde8f2ecbe46faa721242a

    SHA512

    a04e6fd052d2d63a0737c83702c66a9af834f9df8423666508c42b3e1d8384300239c9ddacdc31c1e85140eb1193bcfac209f218750b40342492ffce6e9da481

  • C:\Users\Admin\AppData\Local\Temp\7zS06302A87\setup.exe

    Filesize

    7.3MB

    MD5

    a147d284d9191cd8783a8055a21bfcce

    SHA1

    6f87e8302e28192475a3c362ec1d7597427b016c

    SHA256

    f7b4074a646e742f61d2ecf4b1e78e56216748a35670e23e8ef585a8008aa761

    SHA512

    37d4de184b8b41a41324258ee4e5de5429228bfc89d1c9ca11a786382f11741e4741d11bc392351ee0620cb08151d710c04d92ed5e42ee165c4463d5897c5984

  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2501031730029933572.dll

    Filesize

    6.7MB

    MD5

    f526bf02296cae65098cd1a01dd9ce60

    SHA1

    58784200e942c798ccbe2e9030826703f3a0f985

    SHA256

    d122a48b7642d0b49b0c48f3d42d43aa18cd5c60d6497d8ce42b567e4d580b33

    SHA512

    6eee16d9bbe45d82473f302f513be8bcc84dd02d546b116f71a319b8f832df6d90c8e3469305fe18e2059842f02ea74f4ddf19dab8e4fe816eaf105fd87693df

  • C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat

    Filesize

    40B

    MD5

    3a6bdfefbf5c9fd7949ab72e8d2bce05

    SHA1

    d6f3117d202e9d05157aa3ba3a7e5a8a3c63d077

    SHA256

    f8b50724664f17faaf8d331ca39ff2a96f5d3200acc1b30843a11a129db7b390

    SHA512

    63569613378b3ad741b2e80507749c3b82896777d26b027935101607449b82fc5c991c9c8650eae82c73766e85ca0c21916f1bfd4b1d6641cb788f37a4c73477