Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
6Static
static
1Trojan.JS....!.html
windows10-1703-x64
5Trojan.JS....ax.msi
windows10-1703-x64
6FP_AX_CAB_...64.exe
windows10-1703-x64
3Trojan.JS....you.js
windows10-1703-x64
1Trojan.JS....l.html
windows10-1703-x64
4Trojan.JS....ax.msi
windows10-1703-x64
6FP_AX_CAB_...64.exe
windows10-1703-x64
3Trojan.JS....you.js
windows10-1703-x64
1Trojan.JS....!.html
windows10-1703-x64
4Trojan.JS....you.js
windows10-1703-x64
1Trojan.JS....l.html
windows10-1703-x64
4Trojan.JS....you.js
windows10-1703-x64
1Analysis
-
max time kernel
134s -
max time network
136s -
platform
windows10-1703_x64 -
resource
win10-20240221-en -
resource tags
arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system -
submitted
15/03/2024, 21:54
Static task
static1
Behavioral task
behavioral1
Sample
Trojan.JS.Youareanidiot-main/Mostly Local/Idiot!.html
Resource
win10-20240221-en
windows10-1703-x64
Behavioral task
behavioral2
Sample
Trojan.JS.Youareanidiot-main/Mostly Local/Idiot!_files/flashplayer32_0r0_371_winax.msi
Resource
win10-20240221-en
windows10-1703-x64
Behavioral task
behavioral3
Sample
FP_AX_CAB_INSTALLER64.exe
Resource
win10-20240221-en
windows10-1703-x64
Behavioral task
behavioral4
Sample
Trojan.JS.Youareanidiot-main/Mostly Local/Idiot!_files/you.js
Resource
win10-20240214-en
windows10-1703-x64
Behavioral task
behavioral5
Sample
Trojan.JS.Youareanidiot-main/Mostly Local/lol.html
Resource
win10-20240221-en
windows10-1703-x64
Behavioral task
behavioral6
Sample
Trojan.JS.Youareanidiot-main/Mostly Local/lol_files/flashplayer32_0r0_371_winax.msi
Resource
win10-20240214-en
windows10-1703-x64
Behavioral task
behavioral7
Sample
FP_AX_CAB_INSTALLER64.exe
Resource
win10-20240221-en
windows10-1703-x64
Behavioral task
behavioral8
Sample
Trojan.JS.Youareanidiot-main/Mostly Local/lol_files/you.js
Resource
win10-20240221-en
windows10-1703-x64
Behavioral task
behavioral9
Sample
Trojan.JS.Youareanidiot-main/Mostly Online/Idiot!.html
Resource
win10-20240221-en
windows10-1703-x64
Behavioral task
behavioral10
Sample
Trojan.JS.Youareanidiot-main/Mostly Online/Idiot!_files/you.js
Resource
win10-20240221-en
windows10-1703-x64
Behavioral task
behavioral11
Sample
Trojan.JS.Youareanidiot-main/Mostly Online/lol.html
Resource
win10-20240221-en
windows10-1703-x64
Behavioral task
behavioral12
Sample
Trojan.JS.Youareanidiot-main/Mostly Online/lol_files/you.js
Resource
win10-20240221-en
windows10-1703-x64
General
-
Target
Trojan.JS.Youareanidiot-main/Mostly Local/Idiot!_files/flashplayer32_0r0_371_winax.msi
-
Size
20.9MB
-
MD5
ee8a1e16c9c520929c565ea7c97b3189
-
SHA1
77fe833fb091475fd4cff01135273731c64d04c5
-
SHA256
06adb72a820e100c2ce2bf65605bebf835fbd0447b882a9ed6e99a340ba0f843
-
SHA512
c480be9096a4f4f384705f0e91dc3887ce507fd5670e64f571f8abcb079cdbdd07b85b9a1576cc97bb482adb6b8f12f33a5b0e17f1a27860b4321a1d673c614b
-
SSDEEP
393216:mktMY5dmLqNyGgUVuXb9eDjtUj7gNZyQLfrtjJ1b9Rd9vwRQYiPzDaOg:PfmewkuXpYsykSjJFb0RQbft
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 2 4560 msiexec.exe 4 4560 msiexec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe -
Loads dropped DLL 1 IoCs
pid Process 1196 MsiExec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4560 msiexec.exe Token: SeIncreaseQuotaPrivilege 4560 msiexec.exe Token: SeSecurityPrivilege 1760 msiexec.exe Token: SeCreateTokenPrivilege 4560 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4560 msiexec.exe Token: SeLockMemoryPrivilege 4560 msiexec.exe Token: SeIncreaseQuotaPrivilege 4560 msiexec.exe Token: SeMachineAccountPrivilege 4560 msiexec.exe Token: SeTcbPrivilege 4560 msiexec.exe Token: SeSecurityPrivilege 4560 msiexec.exe Token: SeTakeOwnershipPrivilege 4560 msiexec.exe Token: SeLoadDriverPrivilege 4560 msiexec.exe Token: SeSystemProfilePrivilege 4560 msiexec.exe Token: SeSystemtimePrivilege 4560 msiexec.exe Token: SeProfSingleProcessPrivilege 4560 msiexec.exe Token: SeIncBasePriorityPrivilege 4560 msiexec.exe Token: SeCreatePagefilePrivilege 4560 msiexec.exe Token: SeCreatePermanentPrivilege 4560 msiexec.exe Token: SeBackupPrivilege 4560 msiexec.exe Token: SeRestorePrivilege 4560 msiexec.exe Token: SeShutdownPrivilege 4560 msiexec.exe Token: SeDebugPrivilege 4560 msiexec.exe Token: SeAuditPrivilege 4560 msiexec.exe Token: SeSystemEnvironmentPrivilege 4560 msiexec.exe Token: SeChangeNotifyPrivilege 4560 msiexec.exe Token: SeRemoteShutdownPrivilege 4560 msiexec.exe Token: SeUndockPrivilege 4560 msiexec.exe Token: SeSyncAgentPrivilege 4560 msiexec.exe Token: SeEnableDelegationPrivilege 4560 msiexec.exe Token: SeManageVolumePrivilege 4560 msiexec.exe Token: SeImpersonatePrivilege 4560 msiexec.exe Token: SeCreateGlobalPrivilege 4560 msiexec.exe Token: SeCreateTokenPrivilege 4560 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4560 msiexec.exe Token: SeLockMemoryPrivilege 4560 msiexec.exe Token: SeIncreaseQuotaPrivilege 4560 msiexec.exe Token: SeMachineAccountPrivilege 4560 msiexec.exe Token: SeTcbPrivilege 4560 msiexec.exe Token: SeSecurityPrivilege 4560 msiexec.exe Token: SeTakeOwnershipPrivilege 4560 msiexec.exe Token: SeLoadDriverPrivilege 4560 msiexec.exe Token: SeSystemProfilePrivilege 4560 msiexec.exe Token: SeSystemtimePrivilege 4560 msiexec.exe Token: SeProfSingleProcessPrivilege 4560 msiexec.exe Token: SeIncBasePriorityPrivilege 4560 msiexec.exe Token: SeCreatePagefilePrivilege 4560 msiexec.exe Token: SeCreatePermanentPrivilege 4560 msiexec.exe Token: SeBackupPrivilege 4560 msiexec.exe Token: SeRestorePrivilege 4560 msiexec.exe Token: SeShutdownPrivilege 4560 msiexec.exe Token: SeDebugPrivilege 4560 msiexec.exe Token: SeAuditPrivilege 4560 msiexec.exe Token: SeSystemEnvironmentPrivilege 4560 msiexec.exe Token: SeChangeNotifyPrivilege 4560 msiexec.exe Token: SeRemoteShutdownPrivilege 4560 msiexec.exe Token: SeUndockPrivilege 4560 msiexec.exe Token: SeSyncAgentPrivilege 4560 msiexec.exe Token: SeEnableDelegationPrivilege 4560 msiexec.exe Token: SeManageVolumePrivilege 4560 msiexec.exe Token: SeImpersonatePrivilege 4560 msiexec.exe Token: SeCreateGlobalPrivilege 4560 msiexec.exe Token: SeCreateTokenPrivilege 4560 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4560 msiexec.exe Token: SeLockMemoryPrivilege 4560 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4560 msiexec.exe 4560 msiexec.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1760 wrote to memory of 1196 1760 msiexec.exe 75 PID 1760 wrote to memory of 1196 1760 msiexec.exe 75 PID 1760 wrote to memory of 1196 1760 msiexec.exe 75
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\Trojan.JS.Youareanidiot-main\Mostly Local\Idiot!_files\flashplayer32_0r0_371_winax.msi"1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4560
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A973DF6C7DE1F88CBFD683608F41F90F C2⤵
- Loads dropped DLL
PID:1196
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
141KB
MD5edb88affffd67bca3523b41d3e2e4810
SHA10055b93907665fed56d22a7614a581a87d060ead
SHA2564c3d85e7c49928af0f43623dcbed474a157ef50af3cba40b7fd7ac3fe3df2f15
SHA5122b9d99c57bfa9ab00d8582d55b18c5bf155a4ac83cf4c92247be23c35be818b082b3d6fe38fa905d304d2d8b957f3db73428da88e46acc3a7e3fee99d05e4daf