Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
24s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
05/01/2024, 08:24 UTC
Static task
static1
Behavioral task
behavioral1
Sample
d36410c7b91e52ecfd8251e49b7941e5e5f43d0bb19cee7bd8a4b40f410affc0.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
d36410c7b91e52ecfd8251e49b7941e5e5f43d0bb19cee7bd8a4b40f410affc0.exe
Resource
win10v2004-20231215-en
General
-
Target
d36410c7b91e52ecfd8251e49b7941e5e5f43d0bb19cee7bd8a4b40f410affc0.exe
-
Size
5.1MB
-
MD5
b49cc0d64ca2a87d02cac47ed14b523a
-
SHA1
49044d48f995ab81d8c787518c1506406987cc1d
-
SHA256
d36410c7b91e52ecfd8251e49b7941e5e5f43d0bb19cee7bd8a4b40f410affc0
-
SHA512
f7dc8e63705abbc1e05c98163f1ff06f66cd390be983de2ef9767cc187880aa238cb668dc842fae0b3fc962acb6a4151e6e3f9a49403dbb312344981bde61419
-
SSDEEP
98304:8HenYKGxUcl3nT86Ytacv5Se1KdzOJDb4v+u:8Hr/YtacvuwN0v+u
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 784 d36410c7b91e52ecfd8251e49b7941e5e5f43d0bb19cee7bd8a4b40f410affc0.exe
Processes
Network
-
Remote address:8.8.8.8:53Requestapi.browser.yandex.ruIN AResponseapi.browser.yandex.ruIN A213.180.193.234
-
Remote address:8.8.8.8:53Requestapi.browser.yandex.netIN AResponseapi.browser.yandex.netIN A213.180.193.234
-
Remote address:8.8.8.8:53Requestdownload.cdn.yandex.netIN AResponsedownload.cdn.yandex.netIN CNAMEcdn.yandex.netcdn.yandex.netIN A5.45.205.244cdn.yandex.netIN A5.45.205.245cdn.yandex.netIN A5.45.205.241cdn.yandex.netIN A5.45.205.242cdn.yandex.netIN A5.45.205.243
-
GEThttps://api.browser.yandex.net/content/get/experiments/browser.proto?brand=yandex&partner=switch-brand&uid=F9B4D59A-AE10-4A56-9E7A-C4D83A5DC410&version=23.11.3.933d36410c7b91e52ecfd8251e49b7941e5e5f43d0bb19cee7bd8a4b40f410affc0.exeRemote address:213.180.193.234:443RequestGET /content/get/experiments/browser.proto?brand=yandex&partner=switch-brand&uid=F9B4D59A-AE10-4A56-9E7A-C4D83A5DC410&version=23.11.3.933 HTTP/1.1
Accept: */*
User-Agent: Yandex.Browser lite installer
Host: api.browser.yandex.net
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Content-Length: 491136
Content-Type: application/octet-stream
Date: Fri, 05 Jan 2024 08:24:54 GMT
Last-Modified: Fri, 29 Dec 2023 11:09:02 GMT
X-Country: gb
X-Seed-Signature: MEUCIQDzvX8ktSfM+yEQplVgXYj02Q4h6VagbcHI85SKie4DLwIgHnu9/xkHHj16PXCHcxndUDkncSyNofl0S7dWtW8KkdE=
X-Yandex-Req-Id: 1704443094770661-17196348472780400637-hvv4oywxjqx2pxkl-BAL
-
GEThttps://api.browser.yandex.ru/installstats/send/dtype=stred/pid=457/cid=72992/path=extended_stat/vars=-action=installer_started,-banner_id=0600000000:SW_4d4950b571c8,-brand_id=yandex,-browser_present=none,-dpi=100,-installer_type=lite,-launched=false,-lite_ver=23.11.3.933,-old_style=0,-old_ver=,-partner_id=switch_brand,-resolution=1280x720,-testids=,-ui=F9B4D59A_AE10_4A56_9E7A_C4D83A5DC410,-yandex_uid=6403098641704433535/*d36410c7b91e52ecfd8251e49b7941e5e5f43d0bb19cee7bd8a4b40f410affc0.exeRemote address:213.180.193.234:443RequestGET /installstats/send/dtype=stred/pid=457/cid=72992/path=extended_stat/vars=-action=installer_started,-banner_id=0600000000:SW_4d4950b571c8,-brand_id=yandex,-browser_present=none,-dpi=100,-installer_type=lite,-launched=false,-lite_ver=23.11.3.933,-old_style=0,-old_ver=,-partner_id=switch_brand,-resolution=1280x720,-testids=,-ui=F9B4D59A_AE10_4A56_9E7A_C4D83A5DC410,-yandex_uid=6403098641704433535/* HTTP/1.1
Accept: */*
User-Agent: Yandex.Browser installer
Host: api.browser.yandex.ru
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Content-Length: 13
Content-Type: text/javascript
Date: Fri, 05 Jan 2024 08:24:54 GMT
Set-Cookie: _yasc=2XsR0hmSE8ezNqcqbeU37UoKcs47qWq67B+rUVu19V1KbbBX5C1+WikUJisJbbbcDy9p; domain=.yandex.ru; path=/; expires=Mon, 02 Jan 2034 08:24:54 GMT; secure
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
X-Yandex-Req-Id: 1704443094764934-2718045712202714991-iryipb557edm2hwg-BAL
-
GEThttps://download.cdn.yandex.net/browser/switch-brand/23_11_3_933_52704/browser-setup.arc?from_installer=trued36410c7b91e52ecfd8251e49b7941e5e5f43d0bb19cee7bd8a4b40f410affc0.exeRemote address:5.45.205.244:443RequestGET /browser/switch-brand/23_11_3_933_52704/browser-setup.arc?from_installer=true HTTP/1.1
Accept: */*
User-Agent: Yandex.Browser lite installer
Host: download.cdn.yandex.net
Cache-Control: no-cache
ResponseHTTP/1.1 302 Found
Date: Fri, 05 Jan 2024 08:24:51 GMT
Content-Length: 0
Connection: keep-alive
Keep-Alive: timeout=5
Location: https://cachev2-mar-37.cdn.yandex.net/download.cdn.yandex.net/browser/switch-brand/23_11_3_933_52704/browser-setup.arc?from_installer=true&lid=26
X-Request-Id: 1704443091548365-3967454560980955935
X-Strm-Request-Id: 1704443091548365-3967454560980955935
X_h: strm-cacto-production-4.klg.yp-c.yandex.net
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Cache-Control: no-store,no-cache,must-revalidate
Pragma: no-cache
-
Remote address:8.8.8.8:53Request81.171.91.138.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request81.171.91.138.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request234.193.180.213.in-addr.arpaIN PTRResponse234.193.180.213.in-addr.arpaIN PTRapibrowseryandexnet
-
Remote address:8.8.8.8:53Request234.193.180.213.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request234.193.180.213.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request208.194.73.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request208.194.73.20.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request208.194.73.20.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request208.194.73.20.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request208.194.73.20.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request4.181.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request4.181.190.20.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request4.181.190.20.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request244.205.45.5.in-addr.arpaIN PTRResponse244.205.45.5.in-addr.arpaIN PTRcdnyandexnet
-
Remote address:8.8.8.8:53Request244.205.45.5.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request179.178.17.96.in-addr.arpaIN PTRResponse179.178.17.96.in-addr.arpaIN PTRa96-17-178-179deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request179.178.17.96.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request226.21.18.104.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request226.21.18.104.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request226.20.18.104.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request226.20.18.104.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request9.228.82.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestcachev2-mar-37.cdn.yandex.netIN AResponsecachev2-mar-37.cdn.yandex.netIN A37.9.116.13
-
Remote address:8.8.8.8:53Request13.116.9.37.in-addr.arpaIN PTRResponse13.116.9.37.in-addr.arpaIN PTRcachev2-mar-37cdnyandexnet
-
Remote address:8.8.8.8:53Request13.116.9.37.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request13.116.9.37.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request13.116.9.37.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request2.136.104.51.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request104.241.123.92.in-addr.arpaIN PTRResponse104.241.123.92.in-addr.arpaIN PTRa92-123-241-104deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request119.110.54.20.in-addr.arpaIN PTRResponse
-
104 B 2
-
213.180.193.234:443https://api.browser.yandex.net/content/get/experiments/browser.proto?brand=yandex&partner=switch-brand&uid=F9B4D59A-AE10-4A56-9E7A-C4D83A5DC410&version=23.11.3.933tls, httpd36410c7b91e52ecfd8251e49b7941e5e5f43d0bb19cee7bd8a4b40f410affc0.exe3.9kB 81.9kB 71 70
HTTP Request
GET https://api.browser.yandex.net/content/get/experiments/browser.proto?brand=yandex&partner=switch-brand&uid=F9B4D59A-AE10-4A56-9E7A-C4D83A5DC410&version=23.11.3.933HTTP Response
200 -
213.180.193.234:443https://api.browser.yandex.ru/installstats/send/dtype=stred/pid=457/cid=72992/path=extended_stat/vars=-action=installer_started,-banner_id=0600000000:SW_4d4950b571c8,-brand_id=yandex,-browser_present=none,-dpi=100,-installer_type=lite,-launched=false,-lite_ver=23.11.3.933,-old_style=0,-old_ver=,-partner_id=switch_brand,-resolution=1280x720,-testids=,-ui=F9B4D59A_AE10_4A56_9E7A_C4D83A5DC410,-yandex_uid=6403098641704433535/*tls, httpd36410c7b91e52ecfd8251e49b7941e5e5f43d0bb19cee7bd8a4b40f410affc0.exe1.5kB 5.7kB 14 11
HTTP Request
GET https://api.browser.yandex.ru/installstats/send/dtype=stred/pid=457/cid=72992/path=extended_stat/vars=-action=installer_started,-banner_id=0600000000:SW_4d4950b571c8,-brand_id=yandex,-browser_present=none,-dpi=100,-installer_type=lite,-launched=false,-lite_ver=23.11.3.933,-old_style=0,-old_ver=,-partner_id=switch_brand,-resolution=1280x720,-testids=,-ui=F9B4D59A_AE10_4A56_9E7A_C4D83A5DC410,-yandex_uid=6403098641704433535/*HTTP Response
200 -
5.45.205.244:443https://download.cdn.yandex.net/browser/switch-brand/23_11_3_933_52704/browser-setup.arc?from_installer=truetls, httpd36410c7b91e52ecfd8251e49b7941e5e5f43d0bb19cee7bd8a4b40f410affc0.exe2.2kB 4.9kB 20 12
HTTP Request
GET https://download.cdn.yandex.net/browser/switch-brand/23_11_3_933_52704/browser-setup.arc?from_installer=trueHTTP Response
302 -
124.0kB 2.6MB 1846 1860
-
2.2kB 979 B 12 8
-
52 B 1
-
9.0kB 262.7kB 192 191
-
16.3kB 41.5kB 31 38
-
46 B 1
-
46 B 1
-
46 B 1
-
92 B 80 B 2 2
-
92 B 80 B 2 2
-
138 B 111 B 3 2
-
8.8.8.8:53api.browser.yandex.rudnsd36410c7b91e52ecfd8251e49b7941e5e5f43d0bb19cee7bd8a4b40f410affc0.exe67 B 83 B 1 1
DNS Request
api.browser.yandex.ru
DNS Response
213.180.193.234
-
8.8.8.8:53api.browser.yandex.netdnsd36410c7b91e52ecfd8251e49b7941e5e5f43d0bb19cee7bd8a4b40f410affc0.exe68 B 84 B 1 1
DNS Request
api.browser.yandex.net
DNS Response
213.180.193.234
-
8.8.8.8:53download.cdn.yandex.netdnsd36410c7b91e52ecfd8251e49b7941e5e5f43d0bb19cee7bd8a4b40f410affc0.exe69 B 163 B 1 1
DNS Request
download.cdn.yandex.net
DNS Response
5.45.205.2445.45.205.2455.45.205.2415.45.205.2425.45.205.243
-
144 B 146 B 2 1
DNS Request
81.171.91.138.in-addr.arpa
DNS Request
81.171.91.138.in-addr.arpa
-
222 B 110 B 3 1
DNS Request
234.193.180.213.in-addr.arpa
DNS Request
234.193.180.213.in-addr.arpa
DNS Request
234.193.180.213.in-addr.arpa
-
360 B 158 B 5 1
DNS Request
208.194.73.20.in-addr.arpa
DNS Request
208.194.73.20.in-addr.arpa
DNS Request
208.194.73.20.in-addr.arpa
DNS Request
208.194.73.20.in-addr.arpa
DNS Request
208.194.73.20.in-addr.arpa
-
213 B 157 B 3 1
DNS Request
4.181.190.20.in-addr.arpa
DNS Request
4.181.190.20.in-addr.arpa
DNS Request
4.181.190.20.in-addr.arpa
-
142 B 99 B 2 1
DNS Request
244.205.45.5.in-addr.arpa
DNS Request
244.205.45.5.in-addr.arpa
-
144 B 137 B 2 1
DNS Request
179.178.17.96.in-addr.arpa
DNS Request
179.178.17.96.in-addr.arpa
-
146 B 144 B 2 1
DNS Request
95.221.229.192.in-addr.arpa
DNS Request
95.221.229.192.in-addr.arpa
-
144 B 134 B 2 1
DNS Request
226.21.18.104.in-addr.arpa
DNS Request
226.21.18.104.in-addr.arpa
-
144 B 134 B 2 1
DNS Request
226.20.18.104.in-addr.arpa
DNS Request
226.20.18.104.in-addr.arpa
-
70 B 156 B 1 1
DNS Request
9.228.82.20.in-addr.arpa
-
75 B 91 B 1 1
DNS Request
cachev2-mar-37.cdn.yandex.net
DNS Response
37.9.116.13
-
280 B 113 B 4 1
DNS Request
13.116.9.37.in-addr.arpa
DNS Request
13.116.9.37.in-addr.arpa
DNS Request
13.116.9.37.in-addr.arpa
DNS Request
13.116.9.37.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
2.136.104.51.in-addr.arpa
-
73 B 139 B 1 1
DNS Request
104.241.123.92.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
119.110.54.20.in-addr.arpa
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58cc9341e3d814125fca3c35d33ffe18e
SHA170d1be232eeb261f4a59012ace34abc36bb9d341
SHA25663f4bba6308980623a75248c4981457a20f9a4a0e622d28dcb87fe9d30889f47
SHA512466ed75cf9afd5defa6cd51b3a3b6045594eb46a0bb1ba1f9d7ea452dce774ca9da3b1c813a74c2e1a37fb9c6c589e002025d44124ed7a2a083f0102b609fd60
-
Filesize
6KB
MD5f475cf2bd97fb395a923055f676cd147
SHA1b3c92154e2186e5f75da4ad2e1e1bcb7b1efd944
SHA25640c80bc670d550575bbaeeb06d5328f4964881ef0bf8ae112f98466f5fe3e0c1
SHA512db45bb1501a474ac67c10bc6174e08522620c5f90ff0beaa5799eee5d438a8a6372108c3d8253c09dc2a54a55579e1a34e2749f59e86280ef976781e4c65b7f4
-
Filesize
38B
MD59bf1c6343df355f8338a0b9f022b339e
SHA14f4826e05558a73cb09fc72b2dd608430dba8596
SHA256c4a63bb989454bff63c47193d3dbd629142ecf47ff546e22752869ad421afd9c
SHA512990aa395dd65d4046657b427e3a6c3fc8c56330ae2ba4cd19431520169396777e4482a83f1f24093d85b1e6dcf9bf28f2be8151e10aa25512a3787f8ad699ffa