hxxps://youareanidiot[.]cc/

Analysis

max time kernel
41s
max time network
35s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-02-2024 15:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://youareanidiot.cc/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e000000000200000000001066000000010000200000007f6eee91722040daa20f158016b722050e17d8addc293ca6388cf092813efaf2000000000e8000000002000020000000ceb8309e23c4a98eb0999217ba3cf374fe1a08d1a413f7678191b0b96caf5d1e20000000221412cd9e4d9f74c39c36a6f0352232517ca7b24687daceb1cc54ff652f547d400000005245dd068b6197f336fad7665a2fb0b0649a6b6822be228ee1b56cb536ff9f9f3f44461437ad6d1b7d57f2b8a7d89ded333b5d5b013352cc392b771bc8996df8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0effc587166da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8D30C411-D264-11EE-B9BD-569FD5A164C1} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e00000000020000000000106600000001000020000000141caa45d5b7e3dfb4a16db698b182e84a08e91d995570ba8e3de25c1724a983000000000e8000000002000020000000f2f4ece4ad3d7c129bd50cc7940dd9275bfaeb3786228527ba7febe847fa135490000000c47980717c99e3adc23ce44f6a32bbd7bac23b9be1887511ea8df560d25fac3fee7c371536819aa239f08512349605032f5d8469e78fe87521593517082d2c0cd0c4022bf0957a57629928ff3b5796ca42ae08eca34254c60e8a768f85f378d7a00ed2624f3d32183bbde759a8664c13f2420ab9085a3f451dcbf37c011e2ec885dd7c206b4a7aa9d8449341b4b4dcdb40000000e143e4c8586e5351e94ad7d93a111d946b63c78d2cd0381f7aa866281a8db8709653d60c66eb6ac7348960fcdcea5bb0f3562adfcf23221d933c0211981fc750	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2860	IEXPLORE.EXE
Token: SeIncBasePriorityPrivilege	2860	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
884	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
884	iexplore.exe
884	iexplore.exe
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 2860	884	iexplore.exe	28
PID 884 wrote to memory of 2860	884	iexplore.exe	28
PID 884 wrote to memory of 2860	884	iexplore.exe	28
PID 884 wrote to memory of 2860	884	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://youareanidiot.cc/
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:884
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:884 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02f866bae462efcaaaa210511ba0b78d

SHA1
f6fad22e26b668c033eb5c2931dc92ef2509cf69

SHA256
547207947ab1bf8b9dc42b36278db5aa7c6bfce1acfc2526b03d13fd4f19e96b

SHA512
e13ada8e51288daeff545324c1b53ff8425d966a71cd6f848eee6a6d46cd94b9051cf849293b534784c95f6b449b521c01081a0ecfc194c19beda2e883036fd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fce2c055e7abd8d7cb22ecc64f311c93

SHA1
0e0b5275b9b52e35f21e9fc4910d542d085e8feb

SHA256
e7146d0c8416bd9c6cda9c8b0af5cd111a889f7592dd1d19bb59f233d758f783

SHA512
0666952cc3f68060c3a41ecd7bf77ddfcd1e6fb9c1272db60eab7a93e45c5994cc782e2a062e2f3a42effd20f5ebfc26814d815d7086f02696ed9fc6e0062a01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c005170d2571bf80b8bd2b8fcf4c01ad

SHA1
5d7f3729383a5fc132255228e51f0a0a25b43f4a

SHA256
09f39af7c8a56e36d604fb8fdccd1d972210c13bb1e48634c84f872d78bc800c

SHA512
dd5c0b56b46b0c17456aac886abf823fbf20d3a5e7c17b007aaf4424519aef9f49f8a224a5a263632580c0de574a67b0e42c2ef44223aaa448ea68565959ac09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b5505a9f7fcf1698dd4176b048f587e

SHA1
ec103d134d74ac4fa3e2d88f7f65bc89c7fe3e2a

SHA256
b46855eb4bedc3e79055ead9816ea69795ae2162fb77ceb060a0030eeb0986de

SHA512
00d0a479fa7fc7a80884ffed16d2b36060029bd2a9187540be6629bf418b596521e3e542b5bbae478d0938f04079af874f853a6b29ef492b67cfe24626e1750d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c12bb911e5124318903911fc195c2ea

SHA1
f56763cbaf1e67d4f8d2ca2e528b88bb067a4c5e

SHA256
7f973018ddae0d654538b3eba3203487e5fb652a47f8b04822cee6e5d7c34776

SHA512
14a5d981091eee017a999a92a980c6b196089ec7fd0986c9882e6f3158b4ddd1db285f9069a631bfbb388ff0cdd0990d86c7e312a8d5cd97001442e139c729ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1efa754bb677e88e3481271a682f8f59

SHA1
987f9e909cf9840551359bd73caa2d9510b6ff7c

SHA256
f984916a3fce8bc6d9378f423afd7bd740030e33d337852a73a1d79483126515

SHA512
413afb791c8a22806a16ca3238a7c934addc02c6ee9ad39a27c93f6570a0e0904708cc09d2a0049a6cee755e626c0bd589f6252d25535d4121ab54fcadb78c90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1100b6982f0800e990665de7f961c6f

SHA1
20388fa4d4a6e610fe487b105c3e3beff20e87fa

SHA256
46634f86cfe664b53e469d5167187dcce6316ee9e0eca49e81eb681becfe0104

SHA512
f9104bbd5960ae9ce4d55e2352a90a116acb5f24ce397516efce0235d3708150b23b7b6c7d90c829a7700a2478b3c5cfb686b16f89a0899af2bef2216a3666e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb138e75bcb36eb2b6db1e2fb25a791c

SHA1
01022b266e892cf9e8e52935365c6b9e3ef97122

SHA256
63934fa2ba6b9931b89c02b7f290593bd063574a8f776a7eff0ada0bd604413c

SHA512
a730b00c9d0cef987a3d357b4161910c7ce2421c9ea6c3c32fe3e474546332a24545b05dd0a24dbcaf34a819811ab36bde273a73181439ca424ba8c712f1081a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d12b1dfcf0ae740bf5a9137da8d345ae

SHA1
6872d8d9d8174d467db4ff9a6738f543137c69e4

SHA256
1b209704f503aa96ec0e961fad24908764708f975b81a6c5a239ba2d9fe2bb27

SHA512
cd072e8a834dfa00e286b71ccf7f82ed20ca5a9de0feacc160dc433a9a92ee2245c7c463a5aa2f85e7f7621590b8c02eda9178d2a38a7ade8c30af84e3d439d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6595d0f1c85f2dbc84ee18c525c4370c

SHA1
8ea2d704a0c13b4dabcf508f8b770115ff578f83

SHA256
3279cd4240d2bdd72c89ca229ee58515771b776171d935ef9e06892f3151f6e9

SHA512
c983c1ec51aeeb9c3810cde70b757a5006edba52eb46d9bb526c9ce7ae12313fd6dc6dd4d6181b4264202463317f86af8cea4c642304c560ed0ab06285943eb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\jre0bgm\imagestore.dat

Filesize
105KB

MD5
36ce2a6d0a7eb03b0129fcf98af1055f

SHA1
7b53a3ad6b98c3e6a8869d135afa8a8ea910b863

SHA256
95212d94ded28f77bd18d4b799bc91476c9b61e8190dd21a8a23c9367253d612

SHA512
85ee05d9ec151c0f79fff75be80348fabe3292935a1bb78c8d4eec786f955eced50b211851c77c100c5f528eb0797a73ff20c7cb3d17a028108eb149809b75ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\jre0bgm\imagestore.dat

Filesize
1KB

MD5
7ab5c633165e66140206dcb44d0af287

SHA1
12c61873646a85197d7c6829531f3e0750d71b8a

SHA256
ba82e2cb4a47db8334cb26cf3691737fe626f22bd80ebd0649d45ce3bfd613c0

SHA512
315f2ede624318de0393b0e988065c6311fe18f6e7c2ccd80d7310874f23f14cf74d1f12858a1f90b255007c9533bbf65b5e604788ff696c56f4e08e4442a0e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B4HDT8MX\favicon[1].ico

Filesize
104KB

MD5
3fb315ef4774bf9d76ff10254829a29c

SHA1
2dc02161b4e1f781d942dd5b5407743c7ef38373

SHA256
4172fa160efaccf8726ce46fe6eea79da2d77ff1978848b06f663a80c53f786f

SHA512
5bb21677b59b52b5580e720a3fa45cf19bdcab46ebeb2b5f3061ad3f92c62b758e41dbfa61c88e124a0afe86201a6af03151ea81368c42884c91cab6f9348a74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CTT6L9LH\favicon[1].ico

Filesize
1KB

MD5
0b6dcf9c1429088c7f079d7cc291bb66

SHA1
d23f9a17c55011a829c1365bcba999b27c4115f4

SHA256
4b0358b16230208179720a09d205b99a3e9764e63815b09e9f1716a02fccadcb

SHA512
50b3d19252cf4601c93108639c0c82cd578c1869aeedbb327a7f917c7c9142ebe893347c9a065ad8dbd61b0edcb160b5169b7272c2f3a3f807649b007461ab74

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6A58.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6A6B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit