Technical Information
Malicious functions
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Creates the following files
- %TEMP%\7f4987fb1a6e43d69e3e94b29eb75926\seed.txt
- %APPDATA%\opera software\opera stable\preferences
- %APPDATA%\opera software\opera stable\bookmarks
- %TEMP%\omnija-20244526.zip
- %TEMP%\temp\chromiumtemp2500_212660448\{0a4ce5e3-d36f-4755-928c-6a216832ed1d}.exe
- %TEMP%\region.properties
- %TEMP%\lite_installer.log
- %TEMP%\brandfile
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\trans_index.ico
- %TEMP%\master_preferences
- %TEMP%\clids.xml
- %TEMP%\website.ico
- %TEMP%\abt_config_resource
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\places.sqlite-journal
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\places.sqlite
- %TEMP%\7f4987fb1a6e43d69e3e94b29eb75926\stat.2952.log
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\ya_favicon.ico
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\video_index.png
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\video_index.ico
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\vb-at-yandex.ru.xpi
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\vb-at-yandex.ru.json
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\travel_index.png
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\travel_index.ico
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\trans_index.png
- %TEMP%\partnerfile
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\sovetnik-at-metabar.xpi
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\sovetnik-at-metabar.json
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\realty-455x256.png
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\realty-32.png
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\realty-212x132.gif
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\realty-16.png
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\realty-16.ico
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\places.sqlite-shm
- %LOCALAPPDATA%\google\chrome\user data\default\top sites-20240826174600.879000.backup
- %LOCALAPPDATA%\yandex\yapin\yandex.lnk
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\prefs.js-20240826174559.650000.backup
- %LOCALAPPDATA%\google\chrome\user data\default\local storage\leveldb\000003.log
- %LOCALAPPDATA%\microsoft\internet explorer\services\yandex.ru.ico
- %LOCALAPPDATA%\microsoft\internet explorer\services\www.ya.ru.ico
- %HOMEPATH%\favorites\links\яндекс.url
- %APPDATA%\opera software\opera stable\preferences-20240826174607.299000.backup
- %APPDATA%\opera software\opera stable\bookmarks-20240826174607.299000.backup
- %APPDATA%\opera software\opera stable\local state
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\places.sqlite-wal
- %APPDATA%\opera software\opera stable\preferences-20240826174611.019000.backup
- %APPDATA%\opera software\opera stable\bookmarks-20240826174611.019000.backup
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\prefs.js
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\яндекс.website
- %LOCALAPPDATA%\yandex\yapin\яндекс.website
- %LOCALAPPDATA%\yandex\yapin\yandexworking.exe
- %LOCALAPPDATA%\google\chrome\user data\default\local storage\leveldb\log
- %LOCALAPPDATA%\google\chrome\user data\default\local storage\leveldb\000002.dbtmp
- %LOCALAPPDATA%\google\chrome\user data\default\local storage\leveldb\manifest-000002
- %LOCALAPPDATA%\google\chrome\user data\default\local storage\leveldb\000001.dbtmp
- %LOCALAPPDATA%\google\chrome\user data\default\local storage\leveldb\manifest-000001
- %TEMP%\1a639eb0-cd50-45a9-b40a-5b689ed2ec0b.tmp
- %TEMP%\ec08df92-1c59-44a8-89ae-ccc13edd8069.tmp
- %LOCALAPPDATA%\google\chrome\user data\default\bookmarks
- %LOCALAPPDATA%\google\chrome\user data\default\history-20240826174600.879000.backup
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\pogoda_index.png
- %LOCALAPPDATA%\google\chrome\user data\default\favicons-20240826174600.879000.backup
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\xulstore.json
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\searchplugins\yandex.ru-20244526.xml
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\searchplugins\yandex.ru-20244526.xml
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\places.sqlite-20240826174559.751000.backup
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\search.json.mozlz4-20240826174559.747000.backup
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\places.sqlite-20240826174559.650000.backup
- %TEMP%\61db67e1-6900-4a78-8026-d8fedd192da9
- %APPDATA%\opera software\opera stable\bookmarksextras
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\pogoda_index.ico
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\morda-455x256.ru.png
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\afisha_index.ico
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\afisha_index.png
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\auto-16.ico
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\auto-16.png
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\auto-216x132.gif
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\auto-32.png
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\context.json
- <BOOT_VOL>\boot\bcd.log
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\download.ps1
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\kinopoisk-16_32.ico
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\mail-16.png
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\mail-16_32.ico
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\mail-212x132.gif
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\mail-32.png
- %TEMP%\tmp1276aaaaaa
- %TEMP%\{0a4ce5e3-d36f-4755-928c-6a216832ed1d}.exe
- %TEMP%\seeder-1276.log
- %APPDATA%\yandex\ui
- %TEMP%\26507479-c311-4357-9675-55063af7e179\seederexe.exe
- %TEMP%\lite_installer.exe@2768.log
- %TEMP%\2bac1a8c-8a1b-4f70-b55d-24ee885ee759\lite_installer.exe
- %TEMP%\2fd4137e-0b3c-4d98-9c65-e591af88c722\sender.exe
- <BOOT_VOL>\boot\bcd
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\auto-455x256.png
- %TEMP%\clids-yasearch.xml
- %APPDATA%\yandex\clids-yabrowser.xml
- %TEMP%\vendor00000.xml
- %TEMP%\yandexsearch00000.log
- %TEMP%\{5b964e0e-b9a3-4276-9ed9-4d5a5720747a}\yandexsearch.msi
- %TEMP%\7f4987fb1a6e43d69e3e94b29eb75926\yandexpacksetup.exe
- %TEMP%\7f4987fb1a6e43d69e3e94b29eb75926\downloader.476.log
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\mail-455x256.png
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\market-32.png
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\news-455x256.png
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\maps-32.tr.png
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\morda-16_32.tr.ico
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\morda-216x132.ru.gif
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\morda-216x132.tr.gif
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\morda-32.ru.png
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\morda-32.tr.png
- %LOCALAPPDATA%\yandex\yapin\yandex.exe
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\morda-455x256.tr.png
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\maps-16.tr.png
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\morda-65x26.ru.png
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\morda-65x26.tr.png
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\news-16.ico
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\news-16.png
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\news-212x132.gif
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\news-32.png
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\morda-16_32.ru.ico
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\morda-16.tr.png
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\morda-16.ru.png
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\market_favicon.ico
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\market_16x16.png
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\market-455x256.ua.png
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\market-455x256.tr.png
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\market-455x256.png
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\market-455x256.kz.png
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\pinned-16_32.ru.ico
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\market-212x132.ua.gif
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\market-212x132.tr.gif
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\market-212x132.kz.gif
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\market-212x132.gif
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\market-16.png
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\market-16.ico
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\maps-455x256.tr.png
- %TEMP%\5ba78dcc-a82f-4703-8d9b-21850a989fe4\maps-212x132.tr.gif
- %TEMP%\yb4346.tmp
Deletes the following files
- %TEMP%\vendor00000.xml
- %TEMP%\tmp1276aaaaaa
- %TEMP%\{5b964e0e-b9a3-4276-9ed9-4d5a5720747a}\yandexsearch.msi
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\places.sqlite-journal
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\places.sqlite-shm
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\places.sqlite-wal
- %LOCALAPPDATA%\google\chrome\user data\default\local storage\leveldb\current
- %LOCALAPPDATA%\google\chrome\user data\default\local storage\leveldb\manifest-000001
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\яндекс.website
Moves the following files
- from %LOCALAPPDATA%\google\chrome\user data\default\local storage\leveldb\000001.dbtmp to %LOCALAPPDATA%\google\chrome\user data\default\local storage\leveldb\current
- from %LOCALAPPDATA%\google\chrome\user data\default\local storage\leveldb\000002.dbtmp to %LOCALAPPDATA%\google\chrome\user data\default\local storage\leveldb\current
Modifies the following files
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\xulstore.json
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\places.sqlite-wal
- %LOCALAPPDATA%\google\chrome\user data\default\favicons-journal
- %LOCALAPPDATA%\google\chrome\user data\default\favicons
- %LOCALAPPDATA%\google\chrome\user data\default\top sites-journal
- %LOCALAPPDATA%\google\chrome\user data\default\top sites
- %LOCALAPPDATA%\google\chrome\user data\default\history-journal
- %LOCALAPPDATA%\google\chrome\user data\default\history
- %LOCALAPPDATA%\google\chrome\user data\default\preferences
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\prefs.js
Substitutes the following files
- %TEMP%\vendor00000.xml
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\places.sqlite-journal
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\places.sqlite-shm
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\places.sqlite-wal
- %LOCALAPPDATA%\Google\Chrome\User Data\Default\Top Sites-journal
- %LOCALAPPDATA%\Google\Chrome\User Data\Default\History-journal
- %LOCALAPPDATA%\Google\Chrome\User Data\Default\Favicons-journal
- %LOCALAPPDATA%\google\chrome\user data\default\local storage\leveldb\current
Network activity
Connects to
- 'download.yandex.ru':80
- 'ca#######9-12.cdn.yandex.net':80
- 'do#####der.yandex.net':80
- 'ca#######ar-40.cdn.yandex.net':80
- 'clck.yandex.ru':80
- 'ca#######ar-39.cdn.yandex.net':80
- 'do#####d.cdn.yandex.net':443
- 'ap#.###wser.yandex.net':443
- 'ca########bmiran-02.cdn.yandex.net':443
- 'ca#######9-14.cdn.yandex.net':443
TCP
HTTP GET requests
- http://download.yandex.ru/yandex-pack/downloader/info.rss
- http://ca#######9-12.cdn.yandex.net/download.yandex.ru/yandex-pack/downloader/info.rss?li####
- http://do#####der.yandex.net/yandex-pack/70510/YandexPackSetup.exe
- http://ca#######ar-40.cdn.yandex.net/downloader.yandex.net/yandex-pack/70510/YandexPackSetup.exe?li####
- http://clck.yandex.ru/click/dtype=stred/pid=198/cid=73002/path=0.winapi_download/ui=2122f973-47EE-464D-8103-EDD1479Ea978/clid1=2597987-804/dt=0/ds=0/bits=7_5_7601_17514/bver=0_0_0_0/prod_versio...
- http://do#####der.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?cl######################################################
- http://ca#######ar-39.cdn.yandex.net/downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?cl#############################################################
- http://clck.yandex.ru/click/dtype=stred/pid=12/cid=72435/path=dwnldr/p=70510/rid=f6ed800a-0620-4657-a50c-a27ce22796ed/sbr=0-0/hrc=200-200/bd=267-10639168/gtpr=1-1-1-255-1/cdr=0-b7-b7-ff-b7/for=...
- http://clck.yandex.ru/click/dtype=stred/pid=198/cid=73002/path=1.run_dist/ui=2122f973-47EE-464D-8103-EDD1479Ea978/clid1=2597987-804/dt=121940000/ds=11176368/bits=7_5_7601_17514/bver=24_7_1_1081...
Other
- 'api.browser.yandex.ru':443
- 'download.yandex.ru':443
- 'ca########bmiran-02.cdn.yandex.net':443
- 'ca#######9-14.cdn.yandex.net':443
UDP
- DNS ASK download.yandex.ru
- DNS ASK ca#######9-12.cdn.yandex.net
- DNS ASK do#####der.yandex.net
- DNS ASK ca#######ar-40.cdn.yandex.net
- DNS ASK clck.yandex.ru
- DNS ASK ca#######ar-39.cdn.yandex.net
- DNS ASK api.browser.yandex.ru
- DNS ASK ap#.###wser.yandex.net
- DNS ASK do#####d.cdn.yandex.net
- DNS ASK ca########bmiran-02.cdn.yandex.net
- DNS ASK ca#######9-14.cdn.yandex.net
Miscellaneous
Searches for the following windows
- ClassName: 'Chrome_WidgetWin_1' WindowName: ''
Creates and executes the following
- '%TEMP%\7f4987fb1a6e43d69e3e94b29eb75926\yandexpacksetup.exe' /passive /msicl "VID=804 YABROWSER=y YAHOMEPAGE=y YAQSEARCH=y "
- '%TEMP%\2bac1a8c-8a1b-4f70-b55d-24ee885ee759\lite_installer.exe' --use-user-default-locale --silent --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_c...
- '%TEMP%\26507479-c311-4357-9675-55063af7e179\seederexe.exe' "--yqs=y" "--yhp=y" "--ilight=" "--oem=" "--nopin=n" "--pin_custom=n" "--pin_desktop=n" "--pin_taskbar=y" "--locale=us" "--browser=y" "--browser_default=" "--loglevel=trace" "--ess=" "--clids=...
- '%TEMP%\{0a4ce5e3-d36f-4755-928c-6a216832ed1d}.exe' --job-name=yBrowserDownloader-{D23EC3DB-AF71-45B1-B820-6939CA38003E} --send-statistics --local-path=%TEMP%\{0A4CE5E3-D36F-4755-928C-6A216832ED1D}.exe --YABROWSER --cumtom-welcome-page=https://b...
- '%TEMP%\temp\chromiumtemp2500_212660448\{0a4ce5e3-d36f-4755-928c-6a216832ed1d}.exe' --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --job-name=yBrowserDownloader-{D23EC3DB-AF71-45B1-B820-6939CA38003E} --local-path="%TEMP%\{0A4CE5E3-D36F-4755-928C-6A216832E...
- '%LOCALAPPDATA%\yandex\yapin\yandex.exe' --silent --pin-taskbar=y --pin-desktop=n
Restarts the analyzed sample
