Analysis
- user interaction
yes - max time kernel
134s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 08:47
Behavioral task
behavioral1
Sample
OperaInstaller.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
120 seconds
Behavioral task
behavioral2
Sample
OperaInstaller.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
120 seconds
General
- Target OperaInstaller.exe
- Size 178KB
- Sample260810-kqaabsveka
- SHA256 20b545c7b0b0cb56926972b7fc2a94f428b7aa3e4f9f4e65d1bd0ad800fb60b7
- MD5 4ef32b114eaa6f05340b46d0f48154c7
- SHA1 a07219dc2a0fa96f5f9a03b1bb350c9ab2679d3f
- SHA512 6631937f30fcfdc536bd14735870c9c4592f4414e9c1d71ec69c718bf341ff286174b782c6a23a6c29744be940bcac34aa93845e60727e090bee8423d738ea9d
- SSDEEP 3072:IYHHEa1Lz5KhEwh5kc9+5sFoq0X/r6LGV4RxJ0OZnS+Rl//bRRlTHGVJp99vqRy:IYEwP5KhVyc9esFoBvum4RvGJTEy
- TLSH T1EB046B823AC184B5E5B244321864DBB19A7DFC700F65D9DB73987A3B5DB02C09932F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OperaInstaller.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4772 taskmgr.exe Token: SeSystemProfilePrivilege 4772 taskmgr.exe Token: SeCreateGlobalPrivilege 4772 taskmgr.exe Token: 33 4772 taskmgr.exe Token: SeIncBasePriorityPrivilege 4772 taskmgr.exe - Suspicious use of FindShellTrayWindow 57 IoCs
pid Process 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe - Suspicious use of SendNotifyMessage 57 IoCs
pid Process 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe 4772 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4772 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\OperaInstaller.exe"C:\Users\Admin\AppData\Local\Temp\OperaInstaller.exe"1⤵
- System Location Discovery: System Language Discovery
PID:5996
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4772
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:1332