Overview
overview
3Static
static
3You-Are-An...m1.vbs
windows7-x64
1You-Are-An...m1.vbs
windows10-2004-x64
1You-Are-An...t.html
windows7-x64
3You-Are-An...t.html
windows10-2004-x64
3You-Are-An...er.vbs
windows7-x64
1You-Are-An...er.vbs
windows10-2004-x64
1You-Are-An...es.vbs
windows7-x64
1You-Are-An...es.vbs
windows10-2004-x64
1You-Are-An...t.html
windows7-x64
3You-Are-An...t.html
windows10-2004-x64
3You-Are-An...ib.dll
windows7-x64
1You-Are-An...ib.dll
windows10-2004-x64
1You-Are-An...ot.exe
windows7-x64
3You-Are-An...ot.exe
windows10-2004-x64
3Resubmissions
04/07/2025, 17:03
250704-vkm94sbm6v427/06/2025, 15:25
250627-stk51afp3s402/08/2024, 14:44
240802-r4hl7asgrd302/08/2024, 14:41
240802-r2tlnssgla3Analysis
- max time kernel
119s - max time network
132s - platform
windows7_x64 - resource
win7-20240708-en - resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system - submitted
02/08/2024, 14:44
Static task
static1
Behavioral task
behavioral1
Sample
You-Are-An-Idiot-main/YouAreAnIdiot/Form1.vbs
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
You-Are-An-Idiot-main/YouAreAnIdiot/Form1.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
You-Are-An-Idiot-main/YouAreAnIdiot/Idiot.html
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
You-Are-An-Idiot-main/YouAreAnIdiot/Idiot.html
Resource
win10v2004-20240730-en
Behavioral task
behavioral5
Sample
You-Are-An-Idiot-main/YouAreAnIdiot/Properties/Resources.Designer.vbs
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
You-Are-An-Idiot-main/YouAreAnIdiot/Properties/Resources.Designer.vbs
Resource
win10v2004-20240730-en
Behavioral task
behavioral7
Sample
You-Are-An-Idiot-main/YouAreAnIdiot/Properties/Resources.vbs
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
You-Are-An-Idiot-main/YouAreAnIdiot/Properties/Resources.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
You-Are-An-Idiot-main/YouAreAnIdiot/bin/Debug/Idiot.html
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
You-Are-An-Idiot-main/YouAreAnIdiot/bin/Debug/Idiot.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
You-Are-An-Idiot-main/YouAreAnIdiot/bin/Debug/mscorlib.dll
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
You-Are-An-Idiot-main/YouAreAnIdiot/bin/Debug/mscorlib.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
You-Are-An-Idiot-main/YouAreAnIdiot/obj/Release/YouAreAnIdiot.exe
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
You-Are-An-Idiot-main/YouAreAnIdiot/obj/Release/YouAreAnIdiot.exe
Resource
win10v2004-20240730-en
General
- Target You-Are-An-Idiot-main/YouAreAnIdiot/Idiot.html
- Size 178B
- Sample240802-r4hl7asgrd
- SHA256 a58f42a785a7e8113f870470391e5f7898adfc85e9d95aaec7045b17d36fd782
- MD5 934a02d4710c7c4c60822dc2a0503696
- SHA1 9ba1a0c272b86b18cd397ca9f696a82f5e1cdeba
- SHA512 e5feb23374c7c50398d28de18377dd3a78c7cccb64f742d79c19b42da42cfa949aef32f1b21549c2e89e6fbe51f1f56a6be203fc8f41dd5cc165eeba8dab12ba
- MD5 SHA1 SHA512
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428771777" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CF24D9E1-50DD-11EF-A205-6AA0EDE5A32F} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000007fa6707be741a05cbc789470415e18bfd522acdcd683baef50683db4eebb4855000000000e8000000002000020000000a5eba704c859ac34f04ba149f06c86ca16ea4fbe36b15e99fd6f4964345d909d90000000d517116cfab551d4549c76f367b620e17c03afa81f8d53806a398c21def9df3020c29b1f8c8a2958d423fa91d8d2dd22f4f34935c1d59c5c17960c0889efea12ac7a45be392c6dc7b1b9f28ebe2a33ce781d1c4c3b066b7c400de710f645d2d10b349f40b88a37c4e950074ecc4a9d77b9a63171fe04bffd8ac11bf400e43eea8cf1a1f0cba33bf8c9fdcbff8cf922df400000004814de6d6eb03d31b18fc36dd1f1c6b50f48a926711ca9ee5670d6e2718440b9513749c32b7f85705accf965ae35c3fec4dd83bd8daa4a97dc37a5bdb8c1318c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0a098a3eae4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000007131ae7c3e9eff9ce0d2b02c490a684dd285603f5d21e075a316cfa9d473f50f000000000e8000000002000020000000c20765d0f852d108fb7fe587cd31846262e0837501e6cd27c0575bbc8a5a0771200000008c0bb38fff657fcf900dadab8c02b3e310468d0e068198a02fe40dc095f786c6400000000aa8336a3191b7ebafa0822f05f3c3d8163ef3e574de13ade36cb7f163a0987c24f6b3f45d6e8b58b5dd24acb37d0d76f2efc8db333db21308d8a9b8dbec943c iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3016 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3016 iexplore.exe 3016 iexplore.exe 1028 IEXPLORE.EXE 1028 IEXPLORE.EXE 1028 IEXPLORE.EXE 1028 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3016 wrote to memory of 1028 3016 iexplore.exe 30 PID 3016 wrote to memory of 1028 3016 iexplore.exe 30 PID 3016 wrote to memory of 1028 3016 iexplore.exe 30 PID 3016 wrote to memory of 1028 3016 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\You-Are-An-Idiot-main\YouAreAnIdiot\Idiot.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3016 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1028
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 a22199ddc1ef5053deffa78207cc32d7e824c08aace5e985c2112acd7d08c363
- MD5 8306372a9fc1bdfccba39108fc6fa93e
- SHA1 6b0e2ad5745a36cdf1aad833bd55937bac88faa9
- SHA512 7e3f81f8f8213430e9d7e337c4d005791f3c6a401a4f35d21ee38df9f49aa198459c33037f40514d01646d9a55956d995e930ffeb49d045dccb8e51004ae9a94
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 27a0035431a2fa4f033f3b246b25df3745637ed55653c45144ea3fe70c911244
- MD5 2721afed4877f96859ec1702e53f3c1a
- SHA1 e7ff4547928b574a273d514be7b3b4fb69cd2737
- SHA512 38fc291c8d6a2b60da265d6978942fde9efa5f004109503ced0f198a6c573f297aba9fa509c5fae9b9da47378fcfacdab4c90396f9f03fdec4215b099f6736d7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 491f3d86e49205ef9bcb8caddc3159fc8a68331c944ca5aca731a72bedbad65f
- MD5 2e9714ba825ef1da993463b3c9cafa00
- SHA1 9eb2dfe58c1a87a676de3777daab0711cefdca35
- SHA512 dd41fc4d354af1d9d12c799e11b1369f4ef2932c64f1733d569b7555e7b800b67b9663b2b168088496443d88a024c1876aa29d2f1788efaef16f98af2a0fafac
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 17d648876e2753eb8c79ba061cd9f9891ff3c407125289ba8b734ba362769f3d
- MD5 0454e3eb9676d6a6e98db2a7367a9b48
- SHA1 1e311adab8496f4897d772aca06935c9f3caf73c
- SHA512 f0cfe97d5c1720aa5ae88865856295812d7eb4ecd00fde69cafb3ebd9d18414ae2e0e3f5b8cf93d50aba545c6cddc3617ae3f7a3d95f02f5081f1666c53df1a1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 76e9f2d218c70caf5942de0079a4672ee5c22f86e5980b645c1a9fff233d1ae7
- MD5 8fd887a57802587383212249f9adec59
- SHA1 5e376df77872badfc681538238434969d9731f21
- SHA512 158021bc848223fe664cbd29568dad5dc93e309a65f40de3e90d2b2d124b20d2b4c71400bd5558d24fce9b3e7c1b1c122329c307eaf8f7ea14dcde0c46b91384
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 6d6a6ce286450179489a78d8f41c9772e63cdbbc11da87aa96040ba3bed3f513
- MD5 3e0c7158ab5e074e69cbe6d2b6d09594
- SHA1 9ae13e069d2161cd20cea2a753b63888b9c0fe6c
- SHA512 c8ffbb1dbd59c4ee6e76b85a46bee184ba7985533b8762c9354aad94c449a661261df18c085cca75d4910ae2bb78255c432bafd45c306b0144bbf8e6f776969c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 f767e2226042a4aacc65f7b43b37fb06b79135186eb2d303ad9b2c8ab1c35fe4
- MD5 ab5b1215c8b04ffa9e554f1966e1caa3
- SHA1 7dc6f5c2d08dbb028c50ae797fcda25ef455ad35
- SHA512 f618457bb5138a7d84bd3539953f4f2d8556e54395afe09b9a3f5e91c3fc8f147027b4146b0688027994657b66929fcbbb45c1c77575f5e4986b0eb74bcaf2a9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 70fc766ebdf1c51e6903cea5bdff04557fca9e16215a11b56dceb611c2550f00
- MD5 05317d8c064280ecbf5246fa59ab992d
- SHA1 ffd7401aaf6e10a91cb3a3574356c2291d4dbd28
- SHA512 df0f5cf461bb9f760ea16190bc39b155ea88d6b99be4e1155fb590005ad94f9ffbfc3f357822dabcdfa9f282f222e3c9cdf750737e31f415dcbd652a8b866208
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 84afc9188ea101cadfe927a2bc5cd106d705e8c08d867a295a09490a6d03d02d
- MD5 1cb8e89a29014fa3d83ef7547e5cfa00
- SHA1 e2be221756acdaa20cb13350293807876962b969
- SHA512 f267b8d9a8950cd64706bda65b4177db12be8406cbdca06f45808068f086639b79b333336039fe438d0529a8db757f031ca411136417ba13f7e6ed2b84f939c1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 336d59a47c64afd627b1ff158bc147eea52d606c135c3a4519e21127fdd752e7
- MD5 df3e098aa8e6a033c67b9d83a0225baf
- SHA1 e8d1820c6de063c9e1c4f320f946845dd1207a5b
- SHA512 86cc8869186b36bcdc2ef847b6ba5162ddbe328bb1b24b17303b6c04de7bf0a21398082d407c48edee3898da6e3d241882f327fca31857264bc7a9ff8f681251
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 ed532f405820455471a41670cb5965733ecbbf45f88e1b174535b85f7c6438c1
- MD5 dd50f2152dd8ce55fd3b30f0ba4c3e60
- SHA1 eefebfdb0b6407ec68b04058b4d99a1b6a70b9ee
- SHA512 ba6664bbb7a9356cfedcd90e970f4e882d9bc1358534041ad1d1c5d8d52a8ea7986ab16dfee8c41f44c49b6f6726e8c669a9a3b51d0bffc79ce4976f8df475f0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\CabA8B0.tmp
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\TarA97F.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP