1731919d2dc81ad27833aaaf162c923c8c0e9ec12f0517c7db0409b74e9550c6

Analysis

max time kernel
135s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 18:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

zvgfd-main/OperaGXSetup.exe
Size

5.7MB
MD5

441310f56849af8b53ea48cc94ca3ddb
SHA1

64fceb7e1097a27285cc843a4bffd10a42d95033
SHA256

161d60e3b2cc2cd0248fea9a8869050095ee71ec7244734951b9af377cd765bf
SHA512

2a9be6f43c5a6d5e77fecd1746942c8baf17aa0c22bf276ce9640ddb3899e1fbc58d67555f942946948487f1444edafff209c82d91894e37267f4fe2b596caf6
SSDEEP

98304:m0NFy6666666666666666666666666666666x666666666666666fwwwwwwwwwwE:C75isWNadkX6dOoS0vyy9qldfA9b6JTz

Score

8^/10

spyware stealer

Malware Config

Signatures

Downloads MZ/PE file
Executes dropped EXE 4 IoCs

Processes:

OperaGXSetup.exeOpera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeassistant_installer.exeassistant_installer.exe

pid process

2184 OperaGXSetup.exe
4916 Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
3032 assistant_installer.exe
1592 assistant_installer.exe
Loads dropped DLL 3 IoCs

Processes:

OperaGXSetup.exeOperaGXSetup.exeOperaGXSetup.exe

pid process

3388 OperaGXSetup.exe
4816 OperaGXSetup.exe
2184 OperaGXSetup.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

OperaGXSetup.exe

description ioc process

File opened (read-only) \??\D: OperaGXSetup.exe
File opened (read-only) \??\F: OperaGXSetup.exe

pid	process
2184	OperaGXSetup.exe
4916	Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
3032	assistant_installer.exe
1592	assistant_installer.exe

pid	process
3388	OperaGXSetup.exe
4816	OperaGXSetup.exe
2184	OperaGXSetup.exe

description	ioc	process
File opened (read-only)	\??\D:	OperaGXSetup.exe
File opened (read-only)	\??\F:	OperaGXSetup.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

OperaGXSetup.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	OperaGXSetup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	OperaGXSetup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	OperaGXSetup.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OperaGXSetup.exe

pid process

3388 OperaGXSetup.exe

pid	process
3388	OperaGXSetup.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

OperaGXSetup.exeassistant_installer.exe

description	pid	process	target process
PID 3388 wrote to memory of 4816	3388	OperaGXSetup.exe	OperaGXSetup.exe
PID 3388 wrote to memory of 4816	3388	OperaGXSetup.exe	OperaGXSetup.exe
PID 3388 wrote to memory of 4816	3388	OperaGXSetup.exe	OperaGXSetup.exe
PID 3388 wrote to memory of 2184	3388	OperaGXSetup.exe	OperaGXSetup.exe
PID 3388 wrote to memory of 2184	3388	OperaGXSetup.exe	OperaGXSetup.exe
PID 3388 wrote to memory of 2184	3388	OperaGXSetup.exe	OperaGXSetup.exe
PID 3388 wrote to memory of 4916	3388	OperaGXSetup.exe	Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
PID 3388 wrote to memory of 4916	3388	OperaGXSetup.exe	Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
PID 3388 wrote to memory of 4916	3388	OperaGXSetup.exe	Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
PID 3388 wrote to memory of 3032	3388	OperaGXSetup.exe	assistant_installer.exe
PID 3388 wrote to memory of 3032	3388	OperaGXSetup.exe	assistant_installer.exe
PID 3388 wrote to memory of 3032	3388	OperaGXSetup.exe	assistant_installer.exe
PID 3032 wrote to memory of 1592	3032	assistant_installer.exe	assistant_installer.exe
PID 3032 wrote to memory of 1592	3032	assistant_installer.exe	assistant_installer.exe
PID 3032 wrote to memory of 1592	3032	assistant_installer.exe	assistant_installer.exe

C:\Users\Admin\AppData\Local\Temp\zvgfd-main\OperaGXSetup.exe
"C:\Users\Admin\AppData\Local\Temp\zvgfd-main\OperaGXSetup.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3388

C:\Users\Admin\AppData\Local\Temp\zvgfd-main\OperaGXSetup.exe
C:\Users\Admin\AppData\Local\Temp\zvgfd-main\OperaGXSetup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=109.0.5097.108 --initial-client-data=0x2a4,0x2a8,0x2ac,0x27c,0x2b0,0x753342b8,0x753342c4,0x753342d0
2⤵
- Loads dropped DLL
PID:4816

C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\OperaGXSetup.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\OperaGXSetup.exe" --version
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184

C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202407011831341\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202407011831341\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"
2⤵
- Executes dropped EXE
PID:4916

C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202407011831341\assistant\assistant_installer.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202407011831341\assistant\assistant_installer.exe" --version
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032

C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202407011831341\assistant\assistant_installer.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202407011831341\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0x1134f48,0x1134f58,0x1134f64
3⤵
- Executes dropped EXE
PID:1592

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\OperaGXSetup.exe
Filesize
5.7MB

MD5
441310f56849af8b53ea48cc94ca3ddb

SHA1
64fceb7e1097a27285cc843a4bffd10a42d95033

SHA256
161d60e3b2cc2cd0248fea9a8869050095ee71ec7244734951b9af377cd765bf

SHA512
2a9be6f43c5a6d5e77fecd1746942c8baf17aa0c22bf276ce9640ddb3899e1fbc58d67555f942946948487f1444edafff209c82d91894e37267f4fe2b596caf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202407011831341\additional_file0.tmp
Filesize
1.4MB

MD5
e9a2209b61f4be34f25069a6e54affea

SHA1
6368b0a81608c701b06b97aeff194ce88fd0e3c0

SHA256
e950f17f4181009eeafa9f5306e8a9dfd26d88ca63b1838f44ff0efc738e7d1f

SHA512
59e46277ca79a43ed8b0a25b24eff013e251a75f90587e013b9c12851e5dd7283b6172f7d48583982f6a32069457778ee440025c1c754bf7bb6ce8ae1d2c3fc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202407011831341\assistant\assistant_installer.exe
Filesize
1.8MB

MD5
4c8fbed0044da34ad25f781c3d117a66

SHA1
8dd93340e3d09de993c3bc12db82680a8e69d653

SHA256
afe569ce9e4f71c23ba5f6e8fd32be62ac9538e397cde8f2ecbe46faa721242a

SHA512
a04e6fd052d2d63a0737c83702c66a9af834f9df8423666508c42b3e1d8384300239c9ddacdc31c1e85140eb1193bcfac209f218750b40342492ffce6e9da481

Download Submit
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2407011831332053388.dll
Filesize
5.2MB

MD5
f5f48b76552484d175d8fbc95b1ecfb0

SHA1
9720d008dcb0bf5e398506c2d158cc8b5a498e2a

SHA256
1c4f4930b75fe2211afb11862044a6ce8783db69bc0d5735480df6005b1b547e

SHA512
debc2970e1c9de9a7dc5a18357a6750823c7ca0a65230c9a26eef418918744b4dbf32fb2a9b757a60c1012070c88ff2c1b9e203572874ef2a5bbcba505743855

Download Submit
C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
Filesize
40B

MD5
21b410d63aac10db4969c14e61467a7b

SHA1
924332588221c4e1d33ce15972b35cb989442fc7

SHA256
6dea6c7198463f29b5f5abf2d4387aa3566b5ac1a2cf2124df7c6a02e1706903

SHA512
011a52d88b7c0ce05190871587cb8cb20851c2373fa6dd05b512f559f043023c756debc109e4f7835cbbb955141f8c217e58df2747a6dc35e31247d4874bb9fc

Download Submit