Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
6Static
static
1Trojan.JS....!.html
windows10-1703-x64
5Trojan.JS....ax.msi
windows10-1703-x64
6FP_AX_CAB_...64.exe
windows10-1703-x64
3Trojan.JS....you.js
windows10-1703-x64
1Trojan.JS....l.html
windows10-1703-x64
4Trojan.JS....ax.msi
windows10-1703-x64
6FP_AX_CAB_...64.exe
windows10-1703-x64
3Trojan.JS....you.js
windows10-1703-x64
1Trojan.JS....!.html
windows10-1703-x64
4Trojan.JS....you.js
windows10-1703-x64
1Trojan.JS....l.html
windows10-1703-x64
4Trojan.JS....you.js
windows10-1703-x64
1Analysis
-
max time kernel
135s -
max time network
150s -
platform
windows10-1703_x64 -
resource
win10-20240221-en -
resource tags
arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system -
submitted
15/03/2024, 21:54
Static task
static1
Behavioral task
behavioral1
Sample
Trojan.JS.Youareanidiot-main/Mostly Local/Idiot!.html
Resource
win10-20240221-en
Behavioral task
behavioral2
Sample
Trojan.JS.Youareanidiot-main/Mostly Local/Idiot!_files/flashplayer32_0r0_371_winax.msi
Resource
win10-20240221-en
Behavioral task
behavioral3
Sample
FP_AX_CAB_INSTALLER64.exe
Resource
win10-20240221-en
Behavioral task
behavioral4
Sample
Trojan.JS.Youareanidiot-main/Mostly Local/Idiot!_files/you.js
Resource
win10-20240214-en
Behavioral task
behavioral5
Sample
Trojan.JS.Youareanidiot-main/Mostly Local/lol.html
Resource
win10-20240221-en
Behavioral task
behavioral6
Sample
Trojan.JS.Youareanidiot-main/Mostly Local/lol_files/flashplayer32_0r0_371_winax.msi
Resource
win10-20240214-en
Behavioral task
behavioral7
Sample
FP_AX_CAB_INSTALLER64.exe
Resource
win10-20240221-en
Behavioral task
behavioral8
Sample
Trojan.JS.Youareanidiot-main/Mostly Local/lol_files/you.js
Resource
win10-20240221-en
Behavioral task
behavioral9
Sample
Trojan.JS.Youareanidiot-main/Mostly Online/Idiot!.html
Resource
win10-20240221-en
Behavioral task
behavioral10
Sample
Trojan.JS.Youareanidiot-main/Mostly Online/Idiot!_files/you.js
Resource
win10-20240221-en
Behavioral task
behavioral11
Sample
Trojan.JS.Youareanidiot-main/Mostly Online/lol.html
Resource
win10-20240221-en
Behavioral task
behavioral12
Sample
Trojan.JS.Youareanidiot-main/Mostly Online/lol_files/you.js
Resource
win10-20240221-en
General
-
Target
FP_AX_CAB_INSTALLER64.exe
-
Size
757KB
-
MD5
c7a36096c3c7fe45a70fe9375cabfbd7
-
SHA1
a8ce9a12c963874a28cf067eb4f187d63e82f356
-
SHA256
b1124fb749b2e46e6d5e572b28f847f20c3432dc693c41c765b569e17485d95b
-
SHA512
06c9eadeddcdd5c4274b430336c96d39ee3df2fa6814272cbf937e24a8f07661bad276de9486fb5570202855b97e7a1fa266d4f36885457215f581fada88000b
-
SSDEEP
12288:FZi53OdV+TLBLD5bHoIP4+9B7OzbgxyT08CAAAAAAAAAAAAAAAXAbAAAAAAAAAA6:FZ23Odc1R94zbvT0bW
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417304720" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31094563" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000975e778a95a9ad4fa32c3348f33dafa3000000000200000000001066000000010000200000007219c7a1ccd6a184eb5dcfae00d3dec14ef1c31f49e5f4c3fc1c7e9e01b53997000000000e800000000200002000000068690de938ee7cc338cbd0e21a74cf2cd1b406dc7b92ad51fa7b90a3ff2c3e83200000004f4baa43ed7e9af6ce0fd496bb20e3f3a1a695232b57fba9c2e5dc64da85457940000000321853f1ba628a04b6b3e470bb2bc77fce03aff5c7271aed188b5dbd73552a355f63f1555fa1b7f068b36034b9c4a48857932327b88e37d774d324258ccd45b9 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "417353305" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2609083924" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10b8019c2377da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20fdfc9b2377da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31094563" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31094563" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000975e778a95a9ad4fa32c3348f33dafa300000000020000000000106600000001000020000000fd09e4b91cb43d243a5718cf34cf80cf6e184811f30ddd8d8cca5c1e39c3bd32000000000e8000000002000020000000c6df249ba17dc109c31aa967962d18d73cc2936286ba802ff487000111afcd4b20000000686a5cbda5a5bc470b40872d4270067ed417448b3b2013aca716471c60c85340400000004d7a6c424c986423684462ea768732edfe6ec8db582f167f4a2dc8678262f7020abb215900649d09879d9f3602c1dd82a7da2e123c3c949e14f316376e34118f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2609552533" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "417321314" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz! iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C6887AF3-E316-11EE-A294-F289FAF2DAA1} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31094563" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2609083924" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\FlipAhead iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2609552533" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/ iexplore.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3308 FP_AX_CAB_INSTALLER64.exe 3308 FP_AX_CAB_INSTALLER64.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 208 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 208 iexplore.exe 208 iexplore.exe 4212 IEXPLORE.EXE 4212 IEXPLORE.EXE 4212 IEXPLORE.EXE 4212 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3308 wrote to memory of 208 3308 FP_AX_CAB_INSTALLER64.exe 74 PID 3308 wrote to memory of 208 3308 FP_AX_CAB_INSTALLER64.exe 74 PID 208 wrote to memory of 4212 208 iexplore.exe 75 PID 208 wrote to memory of 4212 208 iexplore.exe 75 PID 208 wrote to memory of 4212 208 iexplore.exe 75
Processes
-
C:\Users\Admin\AppData\Local\Temp\FP_AX_CAB_INSTALLER64.exe"C:\Users\Admin\AppData\Local\Temp\FP_AX_CAB_INSTALLER64.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://www.adobe.com/software/flash/about/2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:208 CREDAT:82945 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4212
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD53752459352c1f1cb603d0cb700cccec3
SHA1003f35792d54be17d517a4af7c3dbef49a23bddf
SHA2569bd9b22ad8b16128aa257e9629ec146612d2c14ccd422248a5cd60128c0fb534
SHA512ceceac9e5e353507b28d3755cf1c372a669d793287c05b6c6dc0d4465289b9846399d16b396ddaffdf699b1cc474566648e5239c20288fca3b3d9c7d620283f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD59a172db557347493646f29ed4ddb595c
SHA1d2a782809c1bb0465ad592c4c1eac7822d0a4351
SHA256a0a7c755b63bd80b9c0c1605800b5c66aaf028565965dbf7277eeabba5b5fecb
SHA512b5b14190a4c7acae54c7e653a384090a09a7c395c2e99d7a017640529301ebc75f3fa74886f71d237b470aac3fd5728155adc8d737b39da456c95ff5f1555711
-
Filesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
545B
MD57d6e15876890e0cf7b020029b230e9df
SHA11f7b628d007bd8c0535797138c35eca1a7214264
SHA2568823b8842c53c2a5c06b92201d56ab31157eabefa7cc890e35a736cebc23868f
SHA512be3638c229aa85b4c2df0c3afd0413d3b8675ee191e760f9ad8f1dba2127dd923f57d46cba1184583fe8fc536cb9bad6c4a9e8e09aecdcb5967dc2a1349c7e1d