d5b72aa5b7c38546bf8b8bcd2ed5349f15a20e23cff2542ee77df782be549b3f

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/06/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
YandexPackSetup.exe
Size 10.1MB
Sample260619-pf3lcahs21
SHA256 d5b72aa5b7c38546bf8b8bcd2ed5349f15a20e23cff2542ee77df782be549b3f
MD5 38d9d64eb9eb245cb33643dbbf3d9373
SHA1 19804e2f156bbd3ce202e3b61a83221ee6b0371f
SHA512 5047bc348b7066d87f2502d19604d84073b663039bd71e1d38762577bf7d230d417271bf73d0434ace86a0a4d252c0791f05af449b44ab830060b132f65cf3b9
SSDEEP 196608:Ddad4T0xcsSB5orrcbSsi0s/lmPJ7N3VvXWrqufezvq:xadCoXrlAJ7N3pXW2uGzy
TLSH
T1B2B6D001B752C0B1EAD101B116BE9BBA487D9E144B3189C797C43E3DD9322E2673BF69
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

adware defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	YandexPackSetup.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\G:	YandexPackSetup.exe
File opened (read-only)	\??\L:	YandexPackSetup.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	YandexPackSetup.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	YandexPackSetup.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\A:	YandexPackSetup.exe
File opened (read-only)	\??\B:	YandexPackSetup.exe
File opened (read-only)	\??\J:	YandexPackSetup.exe
File opened (read-only)	\??\Q:	YandexPackSetup.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	YandexPackSetup.exe
File opened (read-only)	\??\M:	YandexPackSetup.exe
File opened (read-only)	\??\N:	YandexPackSetup.exe
File opened (read-only)	\??\U:	YandexPackSetup.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\P:	YandexPackSetup.exe
File opened (read-only)	\??\R:	YandexPackSetup.exe
File opened (read-only)	\??\V:	YandexPackSetup.exe
File opened (read-only)	\??\Y:	YandexPackSetup.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\E:	YandexPackSetup.exe
File opened (read-only)	\??\S:	YandexPackSetup.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Z:	YandexPackSetup.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	YandexPackSetup.exe
File opened (read-only)	\??\O:	YandexPackSetup.exe
File opened (read-only)	\??\T:	YandexPackSetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI47C5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI47E5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4806.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4885.tmp	msiexec.exe
File created	C:\Windows\Installer\e584532.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI46E7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4932.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5B964E0E-B9A3-4276-9ED9-4D5A5720747A}	msiexec.exe
File opened for modification	C:\Windows\Installer\e584532.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4786.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4835.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4736.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI48C4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI49EF.tmp	msiexec.exe

Executes dropped EXE 3 IoCs

pid	Process
1888	lite_installer.exe
5756	seederexe.exe
13280	sender.exe

Loads dropped DLL 10 IoCs

pid	Process
3392	MsiExec.exe
3392	MsiExec.exe
3392	MsiExec.exe
3392	MsiExec.exe
3392	MsiExec.exe
3392	MsiExec.exe
3392	MsiExec.exe
3392	MsiExec.exe
3392	MsiExec.exe
3392	MsiExec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YandexPackSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lite_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	seederexe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sender.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\SearchScopes	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Main	seederexe.exe

Modifies system certificate store 2 TTPs 8 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	YandexPackSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	YandexPackSetup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	YandexPackSetup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	YandexPackSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8	YandexPackSetup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b8200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	YandexPackSetup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 1900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	YandexPackSetup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	YandexPackSetup.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3640	YandexPackSetup.exe
3640	YandexPackSetup.exe
3224	msiexec.exe
3224	msiexec.exe
1888	lite_installer.exe
1888	lite_installer.exe
5756	seederexe.exe
5756	seederexe.exe
13280	sender.exe
13280	sender.exe
1888	lite_installer.exe
1888	lite_installer.exe

Suspicious use of AdjustPrivilegeToken 60 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3640	YandexPackSetup.exe
Token: SeIncreaseQuotaPrivilege	3640	YandexPackSetup.exe
Token: SeSecurityPrivilege	3224	msiexec.exe
Token: SeCreateTokenPrivilege	3640	YandexPackSetup.exe
Token: SeAssignPrimaryTokenPrivilege	3640	YandexPackSetup.exe
Token: SeLockMemoryPrivilege	3640	YandexPackSetup.exe
Token: SeIncreaseQuotaPrivilege	3640	YandexPackSetup.exe
Token: SeMachineAccountPrivilege	3640	YandexPackSetup.exe
Token: SeTcbPrivilege	3640	YandexPackSetup.exe
Token: SeSecurityPrivilege	3640	YandexPackSetup.exe
Token: SeTakeOwnershipPrivilege	3640	YandexPackSetup.exe
Token: SeLoadDriverPrivilege	3640	YandexPackSetup.exe
Token: SeSystemProfilePrivilege	3640	YandexPackSetup.exe
Token: SeSystemtimePrivilege	3640	YandexPackSetup.exe
Token: SeProfSingleProcessPrivilege	3640	YandexPackSetup.exe
Token: SeIncBasePriorityPrivilege	3640	YandexPackSetup.exe
Token: SeCreatePagefilePrivilege	3640	YandexPackSetup.exe
Token: SeCreatePermanentPrivilege	3640	YandexPackSetup.exe
Token: SeBackupPrivilege	3640	YandexPackSetup.exe
Token: SeRestorePrivilege	3640	YandexPackSetup.exe
Token: SeShutdownPrivilege	3640	YandexPackSetup.exe
Token: SeDebugPrivilege	3640	YandexPackSetup.exe
Token: SeAuditPrivilege	3640	YandexPackSetup.exe
Token: SeSystemEnvironmentPrivilege	3640	YandexPackSetup.exe
Token: SeChangeNotifyPrivilege	3640	YandexPackSetup.exe
Token: SeRemoteShutdownPrivilege	3640	YandexPackSetup.exe
Token: SeUndockPrivilege	3640	YandexPackSetup.exe
Token: SeSyncAgentPrivilege	3640	YandexPackSetup.exe
Token: SeEnableDelegationPrivilege	3640	YandexPackSetup.exe
Token: SeManageVolumePrivilege	3640	YandexPackSetup.exe
Token: SeImpersonatePrivilege	3640	YandexPackSetup.exe
Token: SeCreateGlobalPrivilege	3640	YandexPackSetup.exe
Token: SeRestorePrivilege	3224	msiexec.exe
Token: SeTakeOwnershipPrivilege	3224	msiexec.exe
Token: SeRestorePrivilege	3224	msiexec.exe
Token: SeTakeOwnershipPrivilege	3224	msiexec.exe
Token: SeRestorePrivilege	3224	msiexec.exe
Token: SeTakeOwnershipPrivilege	3224	msiexec.exe
Token: SeRestorePrivilege	3224	msiexec.exe
Token: SeTakeOwnershipPrivilege	3224	msiexec.exe
Token: SeRestorePrivilege	3224	msiexec.exe
Token: SeTakeOwnershipPrivilege	3224	msiexec.exe
Token: SeRestorePrivilege	3224	msiexec.exe
Token: SeTakeOwnershipPrivilege	3224	msiexec.exe
Token: SeRestorePrivilege	3224	msiexec.exe
Token: SeTakeOwnershipPrivilege	3224	msiexec.exe
Token: SeRestorePrivilege	3224	msiexec.exe
Token: SeTakeOwnershipPrivilege	3224	msiexec.exe
Token: SeRestorePrivilege	3224	msiexec.exe
Token: SeTakeOwnershipPrivilege	3224	msiexec.exe
Token: SeRestorePrivilege	3224	msiexec.exe
Token: SeTakeOwnershipPrivilege	3224	msiexec.exe
Token: SeRestorePrivilege	3224	msiexec.exe
Token: SeTakeOwnershipPrivilege	3224	msiexec.exe
Token: SeRestorePrivilege	3224	msiexec.exe
Token: SeTakeOwnershipPrivilege	3224	msiexec.exe
Token: SeRestorePrivilege	3224	msiexec.exe
Token: SeTakeOwnershipPrivilege	3224	msiexec.exe
Token: SeRestorePrivilege	3224	msiexec.exe
Token: SeTakeOwnershipPrivilege	3224	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3640	YandexPackSetup.exe
3640	YandexPackSetup.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3224 wrote to memory of 3392	3224	msiexec.exe	90
PID 3392 wrote to memory of 1888	3392	MsiExec.exe	91
PID 3392 wrote to memory of 5756	3392	MsiExec.exe	93
PID 5756 wrote to memory of 13280	5756	seederexe.exe	94

C:\Users\Admin\AppData\Local\Temp\YandexPackSetup.exe
"C:\Users\Admin\AppData\Local\Temp\YandexPackSetup.exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3640

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0FBFB119E53831B4FD8D0D908085A2B3
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3392
- - C:\Users\Admin\AppData\Local\Temp\DAB80854-C211-4C19-8E51-276DA3A01E81\lite_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\DAB80854-C211-4C19-8E51-276DA3A01E81\lite_installer.exe" --use-user-default-locale --silent --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1888
- - C:\Users\Admin\AppData\Local\Temp\8D79ECAF-A989-4516-93B4-44CB2B99C89B\seederexe.exe
    "C:\Users\Admin\AppData\Local\Temp\8D79ECAF-A989-4516-93B4-44CB2B99C89B\seederexe.exe" "--yqs=" "--yhp=" "--ilight=" "--oem=" "--nopin=n" "--pin_custom=n" "--pin_desktop=n" "--pin_taskbar=y" "--locale=us" "--browser=" "--browser_default=" "--loglevel=trace" "--ess=" "--clids=C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml" "--sender=C:\Users\Admin\AppData\Local\Temp\5C8AA722-D5FD-4D3C-AC2E-8E31A9FDBFDD\sender.exe" "--is_elevated=yes" "--ui_level=5" "--good_token=x" "--no_opera=n"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5756
  - - C:\Users\Admin\AppData\Local\Temp\5C8AA722-D5FD-4D3C-AC2E-8E31A9FDBFDD\sender.exe
      C:\Users\Admin\AppData\Local\Temp\5C8AA722-D5FD-4D3C-AC2E-8E31A9FDBFDD\sender.exe --send "/status.xml?clid=2255073&uuid=24ef7cc0-4eda-4f92-9865-ca9a1fc80018&vnt=Windows 10x64&file-no=8%0A15%0A25%0A45%0A57%0A59%0A102%0A111%0A125%0A129%0A"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:13280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e584533.rbs

Path C:\Config.Msi\e584533.rbs
Size 575B
SHA256 263bef7d20026187a4d3a3841cc9873c5adda6ada2ecdc72ba0ebf4ae50993ac
MD5 7fa6c75535014bdb7b7f84a10c0be3c9
SHA1 b9f6d687cc0073fc2d79f07aa4a18639dae4f449
SHA512 2b0c2ca7a5e0197a4a907ee213234ce90248c3d8fe10726cff6799c9595638c5c24f012a16af21f59d7d18273a51311600a01d2a463470a53251dd84543527ca
TLSH
T1D9F0248F637C96C6C484C0305F424CE3645BF6389A1658D4EC2A6D1A750A2313F5819B
MD5 SHA1 SHA512 TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_394487CAFBCFB8C5917AD7A10924C8A7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_394487CAFBCFB8C5917AD7A10924C8A7
Size 1KB
SHA256 870a1fdc22b8d01a28dd8ee1129d70af5c6b713529c813fe959a6b1089fe69e3
MD5 9c54b41131f930b9762038ebd29831f3
SHA1 d87b63dbd92a4a6a629bc92ee02be618e8f23e8f
SHA512 196b5e9484085741596f4df67b6047ac09a0612e3a41982bf2971e7f549556b9ab1ea8eacf76114ca63f2935fdbc2dcefb0308816d43633d31350b807a143a8e
TLSH
T10A311D89121D38C6AEC6CF68DDC755093D64B0E43FF89151643B413678003D36FF4026
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 1KB
SHA256 dbf985456d5ac583940336a55fcfa96dd3ffdb72478c30682461b94bd9a0e647
MD5 a951508fa3ddd4497b1c998e52551e0e
SHA1 37b25c7dcce57f872275c8a2051447e5f7b9b964
SHA512 6facc5c3f4d0fcb19be1bb987e5160634f101f6ab6a79df35038005dada924a796369417dc7b67f232c6d770253eb5750016002fb5cfac6651ac3f60139ea8ab
TLSH
T18D31D82B5F2C24214E118D483ACCE87718B0D6D46DD914BA7125DA271C80BB24F4A41F
MD5 SHA1 SHA512 TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_394487CAFBCFB8C5917AD7A10924C8A7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_394487CAFBCFB8C5917AD7A10924C8A7
Size 536B
SHA256 d44acf0525350362c8dc22f602b73e275a277a092376a669d6eecf2daa16ba2f
MD5 5d7c1df8431334e55d8e4b3a0ef2a4b8
SHA1 0fd267e2d6ad0eceb3b4c7f7f8fd4d1d771ed7fd
SHA512 3fd170b52a010fa0d35176e922d9a9174abfba33674180ead1e3cd740592256693591e9e4d08a00a8caed94f0736413ddfc7cf2fca872c4c98c17c4045e4acb5
TLSH
T1CFF09E3815FE002FF072CA3C06E19BD66E59F92334255A183AED0309F815E40BD23A39
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 536B
SHA256 20f62dab79ea20b12a04798723081b994a7438178fa95b7dedb4f35b3f6cbdc6
MD5 7e841f0f650a4ca828f95b3d4e1f9737
SHA1 ecbdcbb5ce876dc45b1925c11fa8070a5aaefcff
SHA512 a8749f55c712805bb5687cee3d2a135320df6ec84cc7651e7ae9e7d8e548d6fc99bc4be8b0a53d4ddca6a25a06731f01d5c5f05d9ae222d0d966ee34d7cdc716
TLSH
T14EF0973801F5823EF0B1DE7A0ED85667CA29F8222C22422502925B0E6820F006DF392E
MD5 SHA1 SHA512 TLSH

Submit Download

sender.exe

Path C:\Users\Admin\AppData\Local\Temp\5C8AA722-D5FD-4D3C-AC2E-8E31A9FDBFDD\sender.exe
Size 260KB
SHA256 36022c6ecb3426791e6edee9074a3861fe5b660d98f2b2b7c13b80fe11a75577
MD5 f1a8f60c018647902e70cf3869e1563f
SHA1 3caf9c51dfd75206d944d4c536f5f5ff8e225ae9
SHA512 c02dfd6276ad136283230cdf07d30ec2090562e6c60d6c0d4ac3110013780fcafd76e13931be53b924a35cf473d0f5ace2f6b5c3f1f70ce66b40338e53d38d1e
SSDEEP 6144:HivzZ4S0lBeFv/XSI/yhFrWLygHmWGYzZ/4hJOnN:CvzZ4SuBeFvPSnkygvGYzih8n
TLSH
T1E4449E217992C833E573053259B88A76693DBD310F3499CBA3D80B6D9E741C2A630F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

seederexe.exe

Path C:\Users\Admin\AppData\Local\Temp\8D79ECAF-A989-4516-93B4-44CB2B99C89B\seederexe.exe
Size 8.6MB
SHA256 35585d12899435e13e186490fcf1d270adbe3c74a1e0578b3d9314858bf2d797
MD5 225ba20fa3edd13c9c72f600ff90e6cb
SHA1 5f1a9baa85c2afe29619e7cc848036d9174701e4
SHA512 97e699cffe28d3c3611570d341ccbc1a0f0eec233c377c70e0e20d4ed3b956b6fe200a007f7e601a5724e733c97eaddc39d308b9af58d45f7598f10038d94ab3
SSDEEP 196608:44T0xcsSB5orrcbSsi0s/lmPJ7N3VvXWrqufezvq:4CoXrlAJ7N3pXW2uGzy
TLSH
T1F396D001B752C1B1EAC101B116BE6BBE497DCE148B718DC397C41E79D9322E2673BB68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lite_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\DAB80854-C211-4C19-8E51-276DA3A01E81\lite_installer.exe
Size 419KB
SHA256 688d0b782437ccfae2944281ade651a2da063f222e80b3510789dbdce8b00fdc
MD5 aafdfaa7a989ddb216510fc9ae5b877f
SHA1 41cf94692968a7d511b6051b7fe2b15c784770cb
SHA512 6e2b76ff6df79c6de6887cf739848d05c894fbd70dc9371fff95e6ccd9938d695c46516cb18ec8edd01e78cad1a6029a3d633895f7ddba4db4bf9cd39271bd44
SSDEEP 6144:bahey96oZyvBupY5/af/l27Y547CaPWJTfnOMhym0Wk57YG2F89UUZEfk7:bry96RvBj0C7CaPWNPrHCt9UUZa6
TLSH
T1DC948D227982E032E46205705F7ECBBA287DBB310F6144CBBBD85A6D1E744C19635F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YandexSearch00000.log

Path C:\Users\Admin\AppData\Local\Temp\YandexSearch00000.log
Size 34KB
SHA256 ae222be520cce89e5a45c739f11a399af88467f23296d62b7c942bfdbb2c7566
MD5 c733b4bb96bcac3635910afec3be7771
SHA1 d8c9e63ede29d2a3afe2bdafca1369f951039975
SHA512 a1c02dd95b46c33ff4db075e9a133d8aedbe318cc3975fc84fcfe5bcbcb2d33ef54f0867ab724f8d3e10567a9f2d5fac77b9848fba894ccd1ffb0868b49b5298
SSDEEP 768:SAAnTWfbjTXNnYcB6fWOMOQLN+Ryvs8oc9NNnbCC+yC5hTDGDWCPFmRCwpgngjnD:SAAnTcbf9bB6fJrQ5+Ryvs8oc9/nbCCg
TLSH
T1E9F2492A6EE80119F2B7EA978FF744215A37B92B6935DD0C20C1C10D4476D1A6E6C3EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clids-yasearch.xml

Path C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml
Size 560B
SHA256 52d8e057664a63a6c14fb766f45ad5a5b2f40383a81a1251b3de94291adb7845
MD5 69125566d57aa360d6eae6a586ce6738
SHA1 c05e48f53a881bb1d545000f6da96b36799ef51c
SHA512 6ca096cd038b9ceab6674422a24b26739a37d556758f9e93ea17d7fe9796efccc896c4d1bd836aa467ab8c248f4325ca07ae50526272808c52e40baea5defbc6
TLSH
T142F0F800868CEEE967F503300A3CFAF4E5E4FFC56850EF88B244279395125BA0384BB0
MD5 SHA1 SHA512 TLSH

Submit Download

omnija-20261719.zip

Path C:\Users\Admin\AppData\Local\Temp\omnija-20261719.zip
Size 45.1MB
SHA256 7d5072b7fa0880c245cb54a627474b67df7b4f3f33a7ae828b39417f9621eef0
MD5 e90fbef1ee0ca14a0e36139114dfdb03
SHA1 eb9ea0e98fd72b7b049b193fb94ee8d864101305
SHA512 eec962d4fdf6bdf8a236ef2bebc579e7815469b22e02d4362da865ce20c81b231e41d5d43b10c4f52f7d3d4651293f508d2babc6fea967cdee5dc5004fd27fa3
SSDEEP 98304:GsHE6AKr4JCwEnjKq3EOriDGAIGPEJUgCmubWaJEc3yQBT90oBXborXmtYOJ5vsr:d4JCwsuqUOrFAIGPEJUvyarOsXXbi
TLSH
T1E4A74B1AA3F6117185936079AF5F6041F635801B2419FC58BEDC83AC2F8D53D82FABE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp5756aaaaaa

Path C:\Users\Admin\AppData\Local\Temp\tmp5756aaaaaa
Size 2.5MB
SHA256 74d5e8d3cd8d659d8df8e6f306832dfc252e1a6e676bb60334e31b5943deb4fb
MD5 fefc3d677388386c29d8720c15b9db3f
SHA1 370f1f40ae5c652d87b3b8f42e67d827af2b1754
SHA512 b462ca1ffb0798bedc39c945daa75ff73e0efbb1c6dfdb262e6b2936158933f514f0b4169e811069df11aaeaebd39c826ce0caf9f6eb6d77de249fca6abe39fe
SSDEEP 49152:n8dw1NTHYpAmF3cs/6fpjzbwI8ELIlBCUxqPTz+ltC+3eLaLelnCaL/su:ntv0pmsEWrqufezvEu
TLSH
T1EDC53328A5374017C4A9363902C507615C8FE4C806A774E59F5CFF886EB06FABB96E7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vendor00000.xml

Path C:\Users\Admin\AppData\Local\Temp\vendor00000.xml
Size 577B
SHA256 d68fa576fc72424371c6a475337ab2cec8b3a305f8c3979e144ff3edf4898a2f
MD5 e02067c0b7d025431220ad98ec6b5327
SHA1 a65894d1aa59c37ac80fca68f2a5192720a6fdf5
SHA512 a8cff8910f40eb911999fbaeb5d8cde798e8a7ec1e4a5f7ff24693ec57324a2d0e1e06fcda8f6fb5d7102400ee784de9d14c25a2ef29cb0328202f4287506a01
TLSH
T16EF06200DA8C6629E7F54721063DFAFC25E0FEC5A891EE8CB641276095115B6075BFB4
MD5 SHA1 SHA512 TLSH

Submit Download

YandexSearch.msi

Path C:\Users\Admin\AppData\Local\Temp\{5B964E0E-B9A3-4276-9ED9-4D5A5720747A}\YandexSearch.msi
Size 9.8MB
SHA256 bfb1e5c8aee5ce902c33d2bf8d57c8a868c4e0e3fb2e776ab53efc42b758b98e
MD5 89fb994869d3674fb97a51ddc9603c66
SHA1 97cfe6c1524ac8928e2c6bca06fe98af201d2a8b
SHA512 7fa846a2a105f2469a4621fa993133a0a85fc61d2b1a3240ed5809644d2b3c409d50c3132681deb349269c8fb3ebd18694af55360043c2dfe7c1e9813f02e558
SSDEEP 196608:Odad4T0xcsSB5orrcbSsi0s/lmPJ7N3VvXWrqufezvq0:CadCoXrlAJ7N3pXW2uGzy0
TLSH
T197A6D101B752C1B1EAC101B116BE5BBE487D9E148B318DC797C42E7DD9322E2673BB68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

places.sqlite-20260619121726.061680.backup

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdkjtsyx.Admin\places.sqlite-20260619121726.061680.backup
Size 68KB
SHA256 b6d278384a3684409a2a86f03e4f52869818ce7dd8b5779876960353f7d35dc1
MD5 314cb7ffb31e3cc676847e03108378ba
SHA1 3667d2ade77624e79d9efa08a2f1d33104ac6343
SHA512 dc795fa35ea214843a781ee2b2ef551b91b6841a799bef2c6fb1907d90f6c114071a951ebb7b2b30e81d52b594d447a26ab12ddb57c331e854577d11e5febef5
SSDEEP 48:TV6UcMtYJqqEgbEwq3hF+gBNxw2BAl7FdickdaxL5HoVQJlu:x6HkTBB2ljvoS0
TLSH
T19363DD5B1A343122D8EA90737EE2506E093CF13A8F6776513DF010A6CCA1D62E5799FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bookmarks-20260619121726.108557.backup

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Bookmarks-20260619121726.108557.backup
Size 1KB
SHA256 2b167248e8136c4d45c2c46e2bff6fb5e5137dd4dfdccde998599be2df2e9335
MD5 3adec702d4472e3252ca8b58af62247c
SHA1 35d1d2f90b80dca80ad398f411c93fe8aef07435
SHA512 7562e093d16ee6305c1bb143a3f5d60dafe8b5de74952709abc68a0c353b65416bf78b1fa1a6720331615898848c1464a7758c5dfe78f8098f77fbfa924784c0
TLSH
T1B43172ABF66398CF989C5DCF4174CBCBF98D083A95C01EDAB189352AC09480E127F756
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences-20260619121726.108557.backup

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Preferences-20260619121726.108557.backup
Size 313B
SHA256 ed6a32e11cc99728771989b01f5ae813de80c46a59d3dc68c23a4671a343cb8c
MD5 af006f1bcc57b11c3478be8babc036a8
SHA1 c3bb4fa8c905565ca6a1f218e39fe7494910891e
SHA512 3d20689b0f39b414349c505be607e6bfc1f33ac401cf62a32f36f7114e4a486552f3e74661e90db29402bb85866944e9f8f31baba9605aa0c6def621511a26af
TLSH
T1ACE07227F8202FF309F1117D11AA3F9462380041E0AA24DB08DFF9A8022C0D8CABAC27
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 bb10625eacfba3829a74bdeb6d96abb9503b55abb8851dc778339501b5423dc2
MD5 faf7d92d51f43f6a79885e8d863d225a
SHA1 715a2ef5cbbf29c5942f79aa21873001ca4e00dc
SHA512 0e3d4f177b6eafaf8dff1f92b5f4948b149017646cc5ee7dcaf5a08b761266c9ef12730f2e3222b3079cd55c047d215ceb718546f9521f117fc436fc8edef79e
MD5 SHA1 SHA512

Submit Download

MSI46E7.tmp

Path C:\Windows\Installer\MSI46E7.tmp
Size 181KB
SHA256 a5dd2f97c6787c335b7807ff9b6966877e9dd811f9e26326837a7d2bd224de86
MD5 0c80a997d37d930e7317d6dac8bb7ae1
SHA1 018f13dfa43e103801a69a20b1fab0d609ace8a5
SHA512 fe1caef6d727344c60df52380a6e4ab90ae1a8eb5f96d6054eced1b7734357ce080d944fa518cf1366e14c4c0bd9a41db679738a860800430034a75bb90e51a5
SSDEEP 3072:LIgxsEwKIE4SaX1xQrlm4taQqPvvNCqv8bcDR0wYyMP3XrZ+bx0PWWX+xA6QpS:LIgxsEbIE45ArptaQqPtCG8SR0waB7Bo
TLSH
T1DE048D127180C075E6FB1A3C4578DAB65A3E79305B74C8DB63948E2B2E702C1AF35B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI4736.tmp

Path C:\Windows\Installer\MSI4736.tmp
Size 189KB
SHA256 669cc0aae068ced3154acaecb0c692c4c5e61bc2ca95b40395a3399e75fcb9b2
MD5 e6fd0e66cf3bfd3cc04a05647c3c7c54
SHA1 6a1b7f1a45fb578de6492af7e2fede15c866739f
SHA512 fc8613f31acaf6155852d3ad6130fc3b76674b463dcdcfcd08a3b367dfd9e5b991e3f0a26994bcaf42f9e863a46a81e2520e77b1d99f703bcb08800bdca4efcb
SSDEEP 3072:iAJayVkvIkE3fqPDgvlevYwlv57GqosaJlpJKzhY9A3w9FtGJ2EYJxZi5V2O2M:ickvIDvWgvlevYwFVaJlp8z++bnYsX2Y
TLSH
T1A1149E107881C13AE2BF093995BAA6724D7CB5301FB8C8DF63949D351E706C1AB39B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download