hxxp://youareanidiot[.]org

Analysis

max time kernel
1680s
max time network
1684s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2024, 17:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://youareanidiot.org
Sample240204-wc83aafee7

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4336	msedge.exe
4336	msedge.exe
1432	msedge.exe
1432	msedge.exe
4488	identity_helper.exe
4488	identity_helper.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 3076	1432	msedge.exe	85
PID 1432 wrote to memory of 3076	1432	msedge.exe	85
PID 1432 wrote to memory of 1240	1432	msedge.exe	88
PID 1432 wrote to memory of 1240	1432	msedge.exe	88
PID 1432 wrote to memory of 1240	1432	msedge.exe	88
PID 1432 wrote to memory of 1240	1432	msedge.exe	88
PID 1432 wrote to memory of 1240	1432	msedge.exe	88
PID 1432 wrote to memory of 1240	1432	msedge.exe	88
PID 1432 wrote to memory of 1240	1432	msedge.exe	88
PID 1432 wrote to memory of 1240	1432	msedge.exe	88
PID 1432 wrote to memory of 1240	1432	msedge.exe	88
PID 1432 wrote to memory of 1240	1432	msedge.exe	88
PID 1432 wrote to memory of 1240	1432	msedge.exe	88
PID 1432 wrote to memory of 1240	1432	msedge.exe	88
PID 1432 wrote to memory of 1240	1432	msedge.exe	88
PID 1432 wrote to memory of 1240	1432	msedge.exe	88
PID 1432 wrote to memory of 1240	1432	msedge.exe	88
PID 1432 wrote to memory of 1240	1432	msedge.exe	88
PID 1432 wrote to memory of 1240	1432	msedge.exe	88
PID 1432 wrote to memory of 1240	1432	msedge.exe	88
PID 1432 wrote to memory of 1240	1432	msedge.exe	88
PID 1432 wrote to memory of 1240	1432	msedge.exe	88
PID 1432 wrote to memory of 1240	1432	msedge.exe	88
PID 1432 wrote to memory of 1240	1432	msedge.exe	88
PID 1432 wrote to memory of 1240	1432	msedge.exe	88
PID 1432 wrote to memory of 1240	1432	msedge.exe	88
PID 1432 wrote to memory of 1240	1432	msedge.exe	88
PID 1432 wrote to memory of 1240	1432	msedge.exe	88
PID 1432 wrote to memory of 1240	1432	msedge.exe	88
PID 1432 wrote to memory of 1240	1432	msedge.exe	88
PID 1432 wrote to memory of 1240	1432	msedge.exe	88
PID 1432 wrote to memory of 1240	1432	msedge.exe	88
PID 1432 wrote to memory of 1240	1432	msedge.exe	88
PID 1432 wrote to memory of 1240	1432	msedge.exe	88
PID 1432 wrote to memory of 1240	1432	msedge.exe	88
PID 1432 wrote to memory of 1240	1432	msedge.exe	88
PID 1432 wrote to memory of 1240	1432	msedge.exe	88
PID 1432 wrote to memory of 1240	1432	msedge.exe	88
PID 1432 wrote to memory of 1240	1432	msedge.exe	88
PID 1432 wrote to memory of 1240	1432	msedge.exe	88
PID 1432 wrote to memory of 1240	1432	msedge.exe	88
PID 1432 wrote to memory of 1240	1432	msedge.exe	88
PID 1432 wrote to memory of 4336	1432	msedge.exe	86
PID 1432 wrote to memory of 4336	1432	msedge.exe	86
PID 1432 wrote to memory of 1144	1432	msedge.exe	87
PID 1432 wrote to memory of 1144	1432	msedge.exe	87
PID 1432 wrote to memory of 1144	1432	msedge.exe	87
PID 1432 wrote to memory of 1144	1432	msedge.exe	87
PID 1432 wrote to memory of 1144	1432	msedge.exe	87
PID 1432 wrote to memory of 1144	1432	msedge.exe	87
PID 1432 wrote to memory of 1144	1432	msedge.exe	87
PID 1432 wrote to memory of 1144	1432	msedge.exe	87
PID 1432 wrote to memory of 1144	1432	msedge.exe	87
PID 1432 wrote to memory of 1144	1432	msedge.exe	87
PID 1432 wrote to memory of 1144	1432	msedge.exe	87
PID 1432 wrote to memory of 1144	1432	msedge.exe	87
PID 1432 wrote to memory of 1144	1432	msedge.exe	87
PID 1432 wrote to memory of 1144	1432	msedge.exe	87
PID 1432 wrote to memory of 1144	1432	msedge.exe	87
PID 1432 wrote to memory of 1144	1432	msedge.exe	87
PID 1432 wrote to memory of 1144	1432	msedge.exe	87
PID 1432 wrote to memory of 1144	1432	msedge.exe	87
PID 1432 wrote to memory of 1144	1432	msedge.exe	87
PID 1432 wrote to memory of 1144	1432	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://youareanidiot.org
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfb5946f8,0x7ffcfb594708,0x7ffcfb594718
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,1765182990320732175,1046555395649480531,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,1765182990320732175,1046555395649480531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,1765182990320732175,1046555395649480531,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1765182990320732175,1046555395649480531,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1765182990320732175,1046555395649480531,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1765182990320732175,1046555395649480531,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,1765182990320732175,1046555395649480531,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,1765182990320732175,1046555395649480531,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1765182990320732175,1046555395649480531,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1765182990320732175,1046555395649480531,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1765182990320732175,1046555395649480531,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1765182990320732175,1046555395649480531,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,1765182990320732175,1046555395649480531,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2728 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 53b34e24e3fbb6a7f473192fc4dec2ae668974494f5636f0359b6ca27d7c65e3
MD5 3e71d66ce903fcba6050e4b99b624fa7
SHA1 139d274762405b422eab698da8cc85f405922de5
SHA512 17e2f1400000dd6c54c8dc067b31bcb0a3111e44a9d2c5c779f484a51ada92d88f5b6e6847270faae8ff881117b7ceaaf8dfe9df427cbb8d9449ceacd0480388
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 98863a0d8a8f8c82135646bed5acc0cb297e69b4f08b1920c311bebc5958dc18
MD5 54aeefd5da27453d6f83b37a4ea8379e
SHA1 a5d4c93a2b9d9cb5c495caa6ca61a36ba796beb9
SHA512 36c4dedbcec9f6d7524384cd94320f599909469f14c414934c55197c66722f8e4c62bb67bbfa7504575a9551e150be8ea645efdb53a8453fa39642256eceec9b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 02523b0f045636fe526119bbd8be4ed82ac561ca69ada810bb92fd090196e25e
MD5 9791312f24f400f0c27db6c57447cd56
SHA1 fb8acc52468221f9096142cc71c941e7332ace71
SHA512 03f7563a206316cc066f9197a62d14e9a2a72c453dc79e527837ac02adca8affb0d8319b958808f3592d4ebd65f77ddee517665dfa7bd1bba5d54969ac36ad89
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 bf9542584788c419e47bdc50d2c688baa09859f22368736fd1d6b9b903c74a86
MD5 36bfb31c9be07b50790feabdf094fa13
SHA1 e1ee3f7bdd4bb5d3d0f21506cf8424062a5bf5b2
SHA512 1d9c9639808dd6a7aceafe81b4c15bc3139aae89402796687958a965025bf3a4041c1ee2ab29d6f600e71865c5734473e3910b404c8c91932f8c6b746192b319
SSDEEP 96:nZk7q1cOijwpvWMoiVmdejgYu8d1ZYIvhY02hpsg3xUWQyV+VD7AiEwb:nZk+2vGWMUYuW/YEY02lhrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 231f07e673fee9ef9337c47b14c8f0753d848769124d6a0d726e2eb50ef252ad
MD5 faa479f40e48deac61809a315ebd0b2a
SHA1 ba2784b3abd9360cf37cba2016cc8686f844a964
SHA512 b1a4e20b0cd60a60312f253cadc78234d84f1571c09fc1ac5f85cb54a7abb74a963048f1d669684b07e43509ac07ace1fd9a31ab0c4beeb50c49d7063398ccc6
SSDEEP 96:n/kAq1cOijwpvWMoiVmdeHhppUWQyV+VDCzia:n/kz2vGWMX5rj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 3dca3ec65d1f4109c6b66a1a47b2477afaf8d15306a523f297283da0eccbe8b1
MD5 1b1b142e24215f033793d1311e24f6e6
SHA1 74e23cffbf03f3f0c430e6f4481e740c55a48587
SHA512 a569385710e3a0dc0d6366476c457927a847a2b2298c839e423c485f7dcce2468a58d20133f6dc81913056fb579957e67f63cf1e20b910d61816210447cd1f1f
SSDEEP 768:nl2WUA8F1+UoAYDCx9Tuqh0VfUC9xbog/OVqLlEIrUhy:nl2WUAu1ja7L6hy
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 8bc4bc9cb2efdab15ef4b4eb8719851033a769cecee3bf5cf71759f7ddcfa4d5
MD5 6f2cb76239694589e39e3c7d421c0f0e
SHA1 c9c0cdb7cfb53b559773db6be5cadf01b2d0d2be
SHA512 05c0535c1fe3349107a4d2476d393b0a46e0d604b5deb2f2fac801d90b18116e66533e7004c6df5fe267bc1572ce9e57dd8f71a68a446cb55b11870a55f47cff
SSDEEP 192:ZoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupU6de2RUhEQbSXhTw8Aftw7:F9iIxuERzA83h09RZxYN5Dy86W2G
MD5 SHA1 SHA512 SSDEEP

Submit Download