hxxp://youareanidiot[.]org

Analysis

max time kernel
36s
max time network
40s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
25/04/2023, 08:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://youareanidiot.org

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
540	chrome.exe
540	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
540	chrome.exe
540	chrome.exe
540	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 3692	540	chrome.exe	84
PID 540 wrote to memory of 3692	540	chrome.exe	84
PID 540 wrote to memory of 3220	540	chrome.exe	85
PID 540 wrote to memory of 3220	540	chrome.exe	85
PID 540 wrote to memory of 3220	540	chrome.exe	85
PID 540 wrote to memory of 3220	540	chrome.exe	85
PID 540 wrote to memory of 3220	540	chrome.exe	85
PID 540 wrote to memory of 3220	540	chrome.exe	85
PID 540 wrote to memory of 3220	540	chrome.exe	85
PID 540 wrote to memory of 3220	540	chrome.exe	85
PID 540 wrote to memory of 3220	540	chrome.exe	85
PID 540 wrote to memory of 3220	540	chrome.exe	85
PID 540 wrote to memory of 3220	540	chrome.exe	85
PID 540 wrote to memory of 3220	540	chrome.exe	85
PID 540 wrote to memory of 3220	540	chrome.exe	85
PID 540 wrote to memory of 3220	540	chrome.exe	85
PID 540 wrote to memory of 3220	540	chrome.exe	85
PID 540 wrote to memory of 3220	540	chrome.exe	85
PID 540 wrote to memory of 3220	540	chrome.exe	85
PID 540 wrote to memory of 3220	540	chrome.exe	85
PID 540 wrote to memory of 3220	540	chrome.exe	85
PID 540 wrote to memory of 3220	540	chrome.exe	85
PID 540 wrote to memory of 3220	540	chrome.exe	85
PID 540 wrote to memory of 3220	540	chrome.exe	85
PID 540 wrote to memory of 3220	540	chrome.exe	85
PID 540 wrote to memory of 3220	540	chrome.exe	85
PID 540 wrote to memory of 3220	540	chrome.exe	85
PID 540 wrote to memory of 3220	540	chrome.exe	85
PID 540 wrote to memory of 3220	540	chrome.exe	85
PID 540 wrote to memory of 3220	540	chrome.exe	85
PID 540 wrote to memory of 3220	540	chrome.exe	85
PID 540 wrote to memory of 3220	540	chrome.exe	85
PID 540 wrote to memory of 3220	540	chrome.exe	85
PID 540 wrote to memory of 3220	540	chrome.exe	85
PID 540 wrote to memory of 3220	540	chrome.exe	85
PID 540 wrote to memory of 3220	540	chrome.exe	85
PID 540 wrote to memory of 3220	540	chrome.exe	85
PID 540 wrote to memory of 3220	540	chrome.exe	85
PID 540 wrote to memory of 3220	540	chrome.exe	85
PID 540 wrote to memory of 3220	540	chrome.exe	85
PID 540 wrote to memory of 3852	540	chrome.exe	86
PID 540 wrote to memory of 3852	540	chrome.exe	86
PID 540 wrote to memory of 4036	540	chrome.exe	87
PID 540 wrote to memory of 4036	540	chrome.exe	87
PID 540 wrote to memory of 4036	540	chrome.exe	87
PID 540 wrote to memory of 4036	540	chrome.exe	87
PID 540 wrote to memory of 4036	540	chrome.exe	87
PID 540 wrote to memory of 4036	540	chrome.exe	87
PID 540 wrote to memory of 4036	540	chrome.exe	87
PID 540 wrote to memory of 4036	540	chrome.exe	87
PID 540 wrote to memory of 4036	540	chrome.exe	87
PID 540 wrote to memory of 4036	540	chrome.exe	87
PID 540 wrote to memory of 4036	540	chrome.exe	87
PID 540 wrote to memory of 4036	540	chrome.exe	87
PID 540 wrote to memory of 4036	540	chrome.exe	87
PID 540 wrote to memory of 4036	540	chrome.exe	87
PID 540 wrote to memory of 4036	540	chrome.exe	87
PID 540 wrote to memory of 4036	540	chrome.exe	87
PID 540 wrote to memory of 4036	540	chrome.exe	87
PID 540 wrote to memory of 4036	540	chrome.exe	87
PID 540 wrote to memory of 4036	540	chrome.exe	87
PID 540 wrote to memory of 4036	540	chrome.exe	87
PID 540 wrote to memory of 4036	540	chrome.exe	87
PID 540 wrote to memory of 4036	540	chrome.exe	87

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://youareanidiot.org
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff85c8d9758,0x7ff85c8d9768,0x7ff85c8d9778
  2⤵
  PID:3692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1820 --field-trial-handle=1836,i,6992113766144614061,276979638760691759,131072 /prefetch:2
  2⤵
  PID:3220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1836,i,6992113766144614061,276979638760691759,131072 /prefetch:8
  2⤵
  PID:3852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1836,i,6992113766144614061,276979638760691759,131072 /prefetch:8
  2⤵
  PID:4036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3104 --field-trial-handle=1836,i,6992113766144614061,276979638760691759,131072 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3124 --field-trial-handle=1836,i,6992113766144614061,276979638760691759,131072 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4532 --field-trial-handle=1836,i,6992113766144614061,276979638760691759,131072 /prefetch:1
  2⤵
  PID:3960

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4444

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
7201c627c3e7b897b2bf2d467b159d8f

SHA1
a5186cecafc17a9e4f5019bc40c83a0be56b2bbe

SHA256
edd1afca829491103babdbed2c65a053e3f0d9d30949a1a7cfabc105c3cb12a0

SHA512
b20cfc59333a2b248386ca5d082aa7f9e03ea0d0460c9883753331a05082886404d3dfedccd1361a12e5d84da960c53c9d6127aade9f2591a5543cf438433529

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
f7fcab3de297702360e0c6e6a890674f

SHA1
4432876d8a7813cc277f3973bafda6edc84f25ea

SHA256
8495b2f3ed546dac6fa3aedd04cfc220edb37e980328cdfe8257ac49fda7570f

SHA512
6b38777b119b406c1a582f64d33aff918ab9cb537690fa397ca7611062c395da675d4ec4ca7e1cc7a3d9f15d6a43c9a55cd934becb82f75434b1509e20d2134b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
200KB

MD5
8a413a02758356b6fd863b45a1545bdf

SHA1
749d0c4374f0bd67c0b5e31868b7277fb0fc78c4

SHA256
563fd1c1906b50584c2b52bed4d06a4b5abc3e59b1a15dcc58d935d965c53512

SHA512
45a1d53039ced6a46b0dae6f0c86e811ea31610d8c2ea09e9c2a8f5481e021990e4ca142d05d65f318a4299c1801274c0e7197a0fb77d0143cc4a6d0d84c0c16

Download Submit