hxxps://github[.]com/Techcraft7/YouAreAnIdiot-Fake-Virus/releases/download/v1[.]1/You-are-an-idiot[.]zip

Resubmissions

11/02/2025, 01:59

250211-ceplwavnat 3

07/07/2024, 20:19

240707-y3y14sxfjr 1

Analysis

max time kernel
174s
max time network
265s
platform
windows11-21h2_x64
resource
win11-20240704-en
resource tags

arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system
submitted
07/07/2024, 20:19

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://github.com/Techcraft7/YouAreAnIdiot-Fake-Virus/releases/download/v1.1/You-are-an-idiot.zip

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\SearchScopesUpgradeVersion = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IE11SS&market={language}"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\Recovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.22000.1\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\Main\ImageStoreRandomFolder = "5thro3p"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\Suggested Sites\DataStreamEnabledState = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31117491"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\SearchScopes\UpgradeTime = ae96cd8984ceda01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IESS02&market={language}"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "2631054957"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\Main\Start Page_TIMESTAMP = 3956a665abd0da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IESS02&market={language}"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\Download Directory = "C:\\Users\\Admin\\Downloads\\You-are-an-idiot"	YouAreAnIdiot.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\Main\SyncHomePage Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTSuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&market={language}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IENTSS"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTSR"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000eb980b6b60bc6b488854ae9f6d31520400000000020000000000106600000001000020000000a23cdb6454c2864b8e2188b34ca940bc193368cbaa0049a899862f4cf8811b76000000000e800000000200002000000045fa7fb09efeb64a47dbdb204b8db7782a0615de0054e3f22d4d287dc0fb948b500000009b3f98e3de6f881351e0c6d7a2d0eb3a9a4c886bcae2efc755167a2fcf368c76e626cb6e3cd09be5d438c9a1eefa6ac45c944dc1fea6dc4d032cec017909420254398dcd865c7ee37014c9a5bfb4c24d400000005c26c35ed3ff72333d67f3d71e1c4bc29b7985091cb050db8994a5730d7aecf457e3b3f199da1ff9619ec0998388f2247600f5d3649c341c205145a7d5013d09	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000eb980b6b60bc6b488854ae9f6d31520400000000020000000000106600000001000020000000fb24cca53d6b15f26b86eed42a836ec7be898b8eaa5cd24bc9a86b76cd6d9c4b000000000e8000000002000020000000ab7e11bdbdc3970ee7631bd08cdb00ccc7a067fac91af3849554c41d442eb8f850000000f53590d5235f631f29b68032f4b88a48d9188386db10660c55ada7bef16adf2d4995e0d3ece63a4fc468c12598f7ac7ce7b06da20036f49b663386f3ce61671e459a32839bf7648705c332fcba01686b40000000945c924912090f07f5543cdeba1bb4c45cf5b6d6c542a2cf971783ab3b13c0ef0f79aa34160fc5a3553b933e5787d56fdf721231fa3f471fe2e7793891e057e0	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000eb980b6b60bc6b488854ae9f6d31520400000000020000000000106600000001000020000000daa12f26c9df8f65ced8090eadcdce5d6bbbdd58eb89fbf2d785d020b7146f58000000000e80000000020000200000000d07482f4fcd8dc0686bf08035030f8b09573a98a77e594f0d3a80fe819f92fe100000000a561ac7bca5c22cfed49cc16fe58ed940000000006a2d842275ec4ca5deeb71a89e0e747c0afef28ba6daaec9428e554be34c1195dc7087801f9b58e6727bb4e14bdde12b5392c7e5e26faa3faac861ebadb374	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	YouAreAnIdiot.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\Main\NotifyDownloadComplete = "yes"	YouAreAnIdiot.exe
Key created	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\Suggested Sites	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\Suggested Sites\MigrationTime = ae96cd8984ceda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\Main	YouAreAnIdiot.exe
Key created	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName = "Bing"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	YouAreAnIdiot.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	YouAreAnIdiot.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\Main	YouAreAnIdiot.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\Main\NotifyDownloadComplete = "yes"	YouAreAnIdiot.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A11A6EE8-3C9E-11EF-BC53-529AA27424FC} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\User Preferences	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoURL = "http://go.microsoft.com/fwlink/?LinkID=403856&language={language}&scale={scalelevel}&contrast={contrast}"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000eb980b6b60bc6b488854ae9f6d315204000000000200000000001066000000010000200000002cbe76af092ce9b25b072afaed967355a36fdada6d6a3092428727bf51ac63b7000000000e800000000200002000000077c28dbdedf2aae63302c7824ab0e1b7cf913c31cf50b1cdf09bc37d181f15b550000000d40b6723acb420de8bd43ecfca1ba9c0c87f6d9dc3621e56495b9b9b9c386898ca74b81fb212b1f2e9cfd974d401ca8ab3c72b194477a0a7f5e42e43ae0927eebb891ae03c962f3779fd1d2dc20382aa400000004729b8641d28bdd85dd9b1e6c4b2d2543dff7e11e0ada1e7d940543e1de0b9664506018bad1fc69ad1de11b2603518a6e90e20ed24703b66c0a461b26f8cf0d3	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://go.microsoft.com/fwlink/p/?LinkId=255141"	iexplore.exe

Modifies registry class 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings	YouAreAnIdiot.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	YouAreAnIdiot.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	YouAreAnIdiot.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	YouAreAnIdiot.exe
Key created	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	YouAreAnIdiot.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	YouAreAnIdiot.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	YouAreAnIdiot.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	YouAreAnIdiot.exe
Key created	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	YouAreAnIdiot.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	YouAreAnIdiot.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	YouAreAnIdiot.exe
Key created	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	YouAreAnIdiot.exe
Key created	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	YouAreAnIdiot.exe
Key created	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	YouAreAnIdiot.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	YouAreAnIdiot.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	YouAreAnIdiot.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	YouAreAnIdiot.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	YouAreAnIdiot.exe
Key created	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	YouAreAnIdiot.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	YouAreAnIdiot.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	YouAreAnIdiot.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	YouAreAnIdiot.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	YouAreAnIdiot.exe
Key created	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	YouAreAnIdiot.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	YouAreAnIdiot.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	YouAreAnIdiot.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	YouAreAnIdiot.exe
Key created	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	YouAreAnIdiot.exe
Key created	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	YouAreAnIdiot.exe
Key created	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	YouAreAnIdiot.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	YouAreAnIdiot.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	YouAreAnIdiot.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	YouAreAnIdiot.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	YouAreAnIdiot.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	YouAreAnIdiot.exe
Key created	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	YouAreAnIdiot.exe
Key created	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	YouAreAnIdiot.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	YouAreAnIdiot.exe
Key created	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	YouAreAnIdiot.exe
Key created	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	YouAreAnIdiot.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	YouAreAnIdiot.exe
Key created	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	YouAreAnIdiot.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	YouAreAnIdiot.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\You-are-an-idiot.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
760	msedge.exe
760	msedge.exe
3296	msedge.exe
3296	msedge.exe
772	identity_helper.exe
772	identity_helper.exe
1044	msedge.exe
1044	msedge.exe
4104	msedge.exe
4104	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
1204	YouAreAnIdiot.exe
1204	YouAreAnIdiot.exe
1204	YouAreAnIdiot.exe
4560	iexplore.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
556	YouAreAnIdiot.exe
556	YouAreAnIdiot.exe
1204	YouAreAnIdiot.exe
1204	YouAreAnIdiot.exe
1204	YouAreAnIdiot.exe
3352	YouAreAnIdiot.exe
3352	YouAreAnIdiot.exe
4560	iexplore.exe
4560	iexplore.exe
3324	IEXPLORE.EXE
3324	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 572	3296	msedge.exe	78
PID 3296 wrote to memory of 572	3296	msedge.exe	78
PID 3296 wrote to memory of 4708	3296	msedge.exe	79
PID 3296 wrote to memory of 4708	3296	msedge.exe	79
PID 3296 wrote to memory of 4708	3296	msedge.exe	79
PID 3296 wrote to memory of 4708	3296	msedge.exe	79
PID 3296 wrote to memory of 4708	3296	msedge.exe	79
PID 3296 wrote to memory of 4708	3296	msedge.exe	79
PID 3296 wrote to memory of 4708	3296	msedge.exe	79
PID 3296 wrote to memory of 4708	3296	msedge.exe	79
PID 3296 wrote to memory of 4708	3296	msedge.exe	79
PID 3296 wrote to memory of 4708	3296	msedge.exe	79
PID 3296 wrote to memory of 4708	3296	msedge.exe	79
PID 3296 wrote to memory of 4708	3296	msedge.exe	79
PID 3296 wrote to memory of 4708	3296	msedge.exe	79
PID 3296 wrote to memory of 4708	3296	msedge.exe	79
PID 3296 wrote to memory of 4708	3296	msedge.exe	79
PID 3296 wrote to memory of 4708	3296	msedge.exe	79
PID 3296 wrote to memory of 4708	3296	msedge.exe	79
PID 3296 wrote to memory of 4708	3296	msedge.exe	79
PID 3296 wrote to memory of 4708	3296	msedge.exe	79
PID 3296 wrote to memory of 4708	3296	msedge.exe	79
PID 3296 wrote to memory of 4708	3296	msedge.exe	79
PID 3296 wrote to memory of 4708	3296	msedge.exe	79
PID 3296 wrote to memory of 4708	3296	msedge.exe	79
PID 3296 wrote to memory of 4708	3296	msedge.exe	79
PID 3296 wrote to memory of 4708	3296	msedge.exe	79
PID 3296 wrote to memory of 4708	3296	msedge.exe	79
PID 3296 wrote to memory of 4708	3296	msedge.exe	79
PID 3296 wrote to memory of 4708	3296	msedge.exe	79
PID 3296 wrote to memory of 4708	3296	msedge.exe	79
PID 3296 wrote to memory of 4708	3296	msedge.exe	79
PID 3296 wrote to memory of 4708	3296	msedge.exe	79
PID 3296 wrote to memory of 4708	3296	msedge.exe	79
PID 3296 wrote to memory of 4708	3296	msedge.exe	79
PID 3296 wrote to memory of 4708	3296	msedge.exe	79
PID 3296 wrote to memory of 4708	3296	msedge.exe	79
PID 3296 wrote to memory of 4708	3296	msedge.exe	79
PID 3296 wrote to memory of 4708	3296	msedge.exe	79
PID 3296 wrote to memory of 4708	3296	msedge.exe	79
PID 3296 wrote to memory of 4708	3296	msedge.exe	79
PID 3296 wrote to memory of 4708	3296	msedge.exe	79
PID 3296 wrote to memory of 760	3296	msedge.exe	80
PID 3296 wrote to memory of 760	3296	msedge.exe	80
PID 3296 wrote to memory of 908	3296	msedge.exe	81
PID 3296 wrote to memory of 908	3296	msedge.exe	81
PID 3296 wrote to memory of 908	3296	msedge.exe	81
PID 3296 wrote to memory of 908	3296	msedge.exe	81
PID 3296 wrote to memory of 908	3296	msedge.exe	81
PID 3296 wrote to memory of 908	3296	msedge.exe	81
PID 3296 wrote to memory of 908	3296	msedge.exe	81
PID 3296 wrote to memory of 908	3296	msedge.exe	81
PID 3296 wrote to memory of 908	3296	msedge.exe	81
PID 3296 wrote to memory of 908	3296	msedge.exe	81
PID 3296 wrote to memory of 908	3296	msedge.exe	81
PID 3296 wrote to memory of 908	3296	msedge.exe	81
PID 3296 wrote to memory of 908	3296	msedge.exe	81
PID 3296 wrote to memory of 908	3296	msedge.exe	81
PID 3296 wrote to memory of 908	3296	msedge.exe	81
PID 3296 wrote to memory of 908	3296	msedge.exe	81
PID 3296 wrote to memory of 908	3296	msedge.exe	81
PID 3296 wrote to memory of 908	3296	msedge.exe	81
PID 3296 wrote to memory of 908	3296	msedge.exe	81
PID 3296 wrote to memory of 908	3296	msedge.exe	81

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Techcraft7/YouAreAnIdiot-Fake-Virus/releases/download/v1.1/You-are-an-idiot.zip
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe62dc3cb8,0x7ffe62dc3cc8,0x7ffe62dc3cd8
  2⤵
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,18279978028841243340,17625163514354059491,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1880,18279978028841243340,17625163514354059491,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1880,18279978028841243340,17625163514354059491,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,18279978028841243340,17625163514354059491,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,18279978028841243340,17625163514354059491,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1880,18279978028841243340,17625163514354059491,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,18279978028841243340,17625163514354059491,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1880,18279978028841243340,17625163514354059491,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4836 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1880,18279978028841243340,17625163514354059491,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,18279978028841243340,17625163514354059491,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,18279978028841243340,17625163514354059491,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,18279978028841243340,17625163514354059491,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,18279978028841243340,17625163514354059491,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4928

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2188

C:\Users\Admin\Downloads\You-are-an-idiot\YouAreAnIdiot.exe
"C:\Users\Admin\Downloads\You-are-an-idiot\YouAreAnIdiot.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:556

C:\Users\Admin\Downloads\You-are-an-idiot\YouAreAnIdiot.exe
"C:\Users\Admin\Downloads\You-are-an-idiot\YouAreAnIdiot.exe"
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1204

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:3232

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:4692

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:2448

C:\Users\Admin\Downloads\You-are-an-idiot\YouAreAnIdiot.exe
"C:\Users\Admin\Downloads\You-are-an-idiot\YouAreAnIdiot.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3352

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:2404

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4560
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4560 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3324

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\4d35770005a6454497b8d913aa4abacb /t 3096 /p 3352
1⤵
PID:5052

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\d6444eab5652459cb06a3e1c488c0cb7 /t 3736 /p 1204
1⤵
PID:2576

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\a0205e20bce5491796f0bcd815e4a41c /t 436 /p 556
1⤵
PID:4104

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:3504

C:\Users\Admin\Desktop\YouAreAnIdiot.exe
"C:\Users\Admin\Desktop\YouAreAnIdiot.exe"
1⤵
PID:3164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1636

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a33055 /state1:0x41c64e6d
1⤵
PID:1668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D

Filesize
313B

MD5
dc2380955353a7f0bcce9482d41bf5c3

SHA1
3e48b7d739d0d1aba3bb27f74bc15d1abb911d52

SHA256
e948aca430677c445e72c739ef6644e5545a045cc2cada1d067aa056f06ca075

SHA512
d76a7f68689739af84e5cca844eb01596f56fa11dbd50806d1d9f2813834a96bd663626a6c43850cc8266ca7e62195863d433cd64c361742ee435ef3ba625e6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D

Filesize
400B

MD5
c456e294a100044d90b3841f4217cef0

SHA1
bb767c0d790fa9cd7578bded59cdb43254c2cecd

SHA256
366c20cee9f09ced1ff0c1d8c2499a9586addea391a063d1ef16e3d464c18d20

SHA512
849f6134f7b791fbc68458dbb3d4bab3283f5b6bf0b6a639c7a4d65306a7f019cdbc6d63540849f399af2d52a306f6bd19069b8b02d8c014004fb62293227c43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0176e968a02096540e4a096219a8fe34

SHA1
cd301ea619d7c92daf64446caea1f1293da48373

SHA256
f9319c68cc75bc8e334037d946cc89ad65605606c1bfd12a2fe2ebd711b14067

SHA512
b6aba8640823d43f8968ff31a2e5a48b6f6def43ea6f83cef801294ea1ca9eb1fa16cec516893485b650d7b4407e34536b380712fb72bc9da581cc2e1e0ae2d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6c1de55e8af0859bea07b6af77782896

SHA1
d5efde7bcf31d692d697ebbc54ccd13fb3624856

SHA256
130afd8eb97d11640a28231e9314983eee9eff75964c93abd71e84e6412f710f

SHA512
9664d41b0b1767ddc4012318fca427edf9606c525f868a5ba98e5987bf5e71e4710dd19a0ed7223c706588b5803f3b118ee949c51d6fd99696049befff5fd510

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
265B

MD5
f5cd008cf465804d0e6f39a8d81f9a2d

SHA1
6b2907356472ed4a719e5675cc08969f30adc855

SHA256
fcea95cc39dc6c2a925f5aed739dbedaa405ee4ce127f535fcf1c751b2b8fb5d

SHA512
dc97034546a4c94bdaa6f644b5cfd1e477209de9a03a5b02a360c254a406c1d647d6f90860f385e27387b35631c41f0886cb543ede9116436941b9af6cd3285d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d40e8182b1a1259f40455c0dc7a6b8da

SHA1
52124781ee6bbe0d3bf7de9fbb97d38cfeed3eae

SHA256
b16a9db2845e1bb45a97107216691ec8a66ac52af2d46d4050538ec488f90c84

SHA512
4442684940b27cdd2c59fb5c1d45ecf8159ed89648104cccf1ec24f5e1b0078ffd69ab7152d55d845c84cf8c1fbf6d2d2526aeb7e74fdfdccff34725c7414a2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fa48ed5028e3631951aeb40ab9824bc7

SHA1
34ebcafa97905d13ed75424bf693e77168059ec2

SHA256
72020bd4da22308334550e5d644b6abc812a12665c98c2f4c375283c37834b7a

SHA512
4a6bba8bc9d254dad0f866c97c99c7d8cc4855c731cfb6ed8343e2d97d7cc6005fbd6999dc3905f85655f73e2dd815023846e0de54054f048cb0ee4c2efe2254

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ef51d0b2c21d4c81ae72e09f19f6bd93

SHA1
30344e5171fc9c63ec9c988a0541bfe067474230

SHA256
19a4fce725281b8882877975b064a6f390ad7030d6c8aee6357861620bebbe19

SHA512
c526592921b3e9f8e0ce8dec127f59566fdadde156ba54f94a93082b2a50bc8ff47c546029eef7c1890cd517d8ea596ecaa910cbc132e5e0259a4a2fd74f6f2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fb8c628c1da620b296107ecb7b2c2e03

SHA1
24fdd5421fcf994a4910168bc91a826286e2c4ff

SHA256
0bee9893a3ec75ae45f059eaffe11c4f1c695e44e7fc95d4988b9eb0f89adbb9

SHA512
61bf050278b3ee43905779bbd3143e1c10935019cf8ff47368b7a20e08148710d9d4c0dd841e2cc4f13d647c0e841e7aae2fa5aca0753e61f76f9a36795099f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7c0dbfa22b2715ab0d5a9c055d4aa485

SHA1
a1a6ead888253a4fb00051482e8379334366e38d

SHA256
b504abf188b711d44840eaaee70c19cf7022cc3bcc983983dd6ffeca8b80b806

SHA512
a6c7aebbb2ee512385148456451a157d01b894e2e2f99a734461919492706c1a44050f352991c7a9f53ce3f9f5bea12472fe698ba4bc5de9448e20ff7fd21068

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c88b6d57bf85b1007982308cfb7750c4

SHA1
20d556da7c76a230befb404c906ba74798c5aaff

SHA256
8d0d8ea9cb2b28bdb4dacc8061661cb1138815f017fd3255884c9790d6314639

SHA512
8ea63b1f88dc18a419c191c19dc0fabaaf136fb983873ed8ee37a3f14d4c2dbc98a01daf1bd6411cc476ec9a026f341f0879d8cf2961ea1715721a7d8251ce20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\5thro3p\imagestore.dat

Filesize
4KB

MD5
d352752aabe2f3fedefe796ec0754eed

SHA1
6bdadf6a6ed023b36c239220c9a24441118694bc

SHA256
f6a68884da99d356aa5895a03f662f7d121e2c84e994a2ee4d36e9b3e96d7ace

SHA512
fc26c7bad52ca38a0af97ef6dbf7d6f17f6255ce962977be37e30dbae309a60d3c70a8c58272aaaf57bb645be0f6aca84ca887ebf1446052613eeecf0aaee0b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4IKSOAL6\favicon-trans-bg-blue-mg[1].ico

Filesize
4KB

MD5
30967b1b52cb6df18a8af8fcc04f83c9

SHA1
aaf67cd84fcd64fb2d8974d7135d6f1e4fc03588

SHA256
439b6089e45ef1e0c37ef88764d5c99a3b2752609c4e2af3376480d7ffcfaf2e

SHA512
7cb3c09a81fbd301741e7cf5296c406baf1c76685d354c54457c87f6471867390a1aeed9f95701eb9361d7dfacce31afd1d240841037fc1de4a120c66c1b088c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZKB1WBPS\naLR3tyQRmAp89MaTSxuapGkS-c.gz[1].css

Filesize
53KB

MD5
3c77fa3d379a82aaed87ad074d25ec0f

SHA1
448f89c6e09e6fa72f988b25ac110d1e509a9e0a

SHA256
61ac75a5e6779385d6c7102cfb786a1438ca966bb7484361fee3136358da5e2f

SHA512
52aa2068eead08bfebdf154a4a77250a956b38ce099d1fddd8310a28f2aaf8ee1eb7979c813e63ef8ef9f6314c8fbbc407d492f240907c083b1330e102f579c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Kno23A6.tmp

Filesize
88KB

MD5
002d5646771d31d1e7c57990cc020150

SHA1
a28ec731f9106c252f313cca349a68ef94ee3de9

SHA256
1e2e25bf730ff20c89d57aa38f7f34be7690820e8279b20127d0014dd27b743f

SHA512
689e90e7d83eef054a168b98ba2b8d05ab6ff8564e199d4089215ad3fe33440908e687aa9ad7d94468f9f57a4cc19842d53a9cd2f17758bdadf0503df63629c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF048E579E9091E64F.TMP

Filesize
16KB

MD5
bb96dccbe5b13b4a609ac46c040cabf7

SHA1
6b46af390027677468c51afe4820413f63f27f1d

SHA256
09fd1c9737de2c21559e79ccd4de1caa86b7fec545fe9645ce8f0931904c8dfe

SHA512
9934daab15cfb858988109b9cef188695b0e7c631715dabf5db5c25d74fbd92c8493192703b043739829aeef81c5c5ab36fa5442f16dab0bf6e8585d1128a4b3

Download Submit
C:\Users\Admin\Downloads\You-are-an-idiot.zip

Filesize
33KB

MD5
05018c0faa868f3f41a1d885fde9c047

SHA1
29814769fc1f44af2e81c4e331b243c97a114313

SHA256
bb2c312e4f45517af54572e0723308361347578b23339745420e39b773c21e08

SHA512
f8538f08c03b6caa57346580b78efee7ace4aa1b962fb45c25e0f9256e62f5eec481eeb5ca23082c4f5997f6b23da83e1a363bda13d15ea9b3eaed7d484672f5

Download Submit
C:\Users\Admin\Downloads\You-are-an-idiot.zip:Zone.Identifier

Filesize
591B

MD5
efbdc95a400c18fc86a4f6aa8ba94be7

SHA1
e26c114c58883ce765153d2991da3e9bf258d19c

SHA256
789630a41f0f2bc3f596a3ca0b441148ca7b5bf4cadc00054f05152d2e935549

SHA512
966a2aa675205f7e660384d1c89e7db8f863c9f763b98bda1d2a78f4dfc0462bdeab8b0b5acb002759ac6400c761c886c1b2dabce64fa6870c2822af3431c13d

Download Submit
memory/556-80-0x0000000004D50000-0x0000000004D5A000-memory.dmp

Filesize
40KB

Download
memory/556-79-0x0000000004BA0000-0x0000000004C32000-memory.dmp

Filesize
584KB

Download
memory/556-69-0x00000000050B0000-0x0000000005656000-memory.dmp

Filesize
5.6MB

Download
memory/556-68-0x0000000000230000-0x000000000023C000-memory.dmp

Filesize
48KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads