Overview
overview
3Static
static
3You-Are-An...m1.vbs
windows7-x64
1You-Are-An...m1.vbs
windows10-2004-x64
1You-Are-An...t.html
windows7-x64
3You-Are-An...t.html
windows10-2004-x64
3You-Are-An...er.vbs
windows7-x64
1You-Are-An...er.vbs
windows10-2004-x64
1You-Are-An...es.vbs
windows7-x64
1You-Are-An...es.vbs
windows10-2004-x64
1You-Are-An...t.html
windows7-x64
3You-Are-An...t.html
windows10-2004-x64
3You-Are-An...ib.dll
windows7-x64
1You-Are-An...ib.dll
windows10-2004-x64
1You-Are-An...ot.exe
windows7-x64
3You-Are-An...ot.exe
windows10-2004-x64
3Resubmissions
04/07/2025, 17:03
250704-vkm94sbm6v427/06/2025, 15:25
250627-stk51afp3s402/08/2024, 14:44
240802-r4hl7asgrd302/08/2024, 14:41
240802-r2tlnssgla3Analysis
- max time kernel
136s - max time network
130s - platform
windows7_x64 - resource
win7-20240708-en - resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system - submitted
02/08/2024, 14:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
You-Are-An-Idiot-main/YouAreAnIdiot/Form1.vbs
Resource
win7-20240729-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
You-Are-An-Idiot-main/YouAreAnIdiot/Form1.vbs
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
You-Are-An-Idiot-main/YouAreAnIdiot/Idiot.html
Resource
win7-20240708-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
You-Are-An-Idiot-main/YouAreAnIdiot/Idiot.html
Resource
win10v2004-20240730-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral5
Sample
You-Are-An-Idiot-main/YouAreAnIdiot/Properties/Resources.Designer.vbs
Resource
win7-20240729-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
You-Are-An-Idiot-main/YouAreAnIdiot/Properties/Resources.Designer.vbs
Resource
win10v2004-20240730-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
You-Are-An-Idiot-main/YouAreAnIdiot/Properties/Resources.vbs
Resource
win7-20240704-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
You-Are-An-Idiot-main/YouAreAnIdiot/Properties/Resources.vbs
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
You-Are-An-Idiot-main/YouAreAnIdiot/bin/Debug/Idiot.html
Resource
win7-20240708-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral10
Sample
You-Are-An-Idiot-main/YouAreAnIdiot/bin/Debug/Idiot.html
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral11
Sample
You-Are-An-Idiot-main/YouAreAnIdiot/bin/Debug/mscorlib.dll
Resource
win7-20240705-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
You-Are-An-Idiot-main/YouAreAnIdiot/bin/Debug/mscorlib.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
You-Are-An-Idiot-main/YouAreAnIdiot/obj/Release/YouAreAnIdiot.exe
Resource
win7-20240708-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral14
Sample
You-Are-An-Idiot-main/YouAreAnIdiot/obj/Release/YouAreAnIdiot.exe
Resource
win10v2004-20240730-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target You-Are-An-Idiot-main/YouAreAnIdiot/bin/Debug/Idiot.html
- Size 178B
- Sample240802-r4hl7asgrd
- SHA256 a58f42a785a7e8113f870470391e5f7898adfc85e9d95aaec7045b17d36fd782
- MD5 934a02d4710c7c4c60822dc2a0503696
- SHA1 9ba1a0c272b86b18cd397ca9f696a82f5e1cdeba
- SHA512 e5feb23374c7c50398d28de18377dd3a78c7cccb64f742d79c19b42da42cfa949aef32f1b21549c2e89e6fbe51f1f56a6be203fc8f41dd5cc165eeba8dab12ba
- MD5 SHA1 SHA512
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d04832a4eae4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CFBB5551-50DD-11EF-946E-F64010A3169C} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428771777" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000c39faeabe66cda9638312f54ae23a694259ee8587aa09198cf4706f9668e260e000000000e8000000002000020000000c56f339cb9af971fb3e5b0a7a5e5d35ebc42dfdd56320cd2d1b14f22971e4d1a200000002a38ce4784657ab02fc88fcd78cfc8b90742f9793401e259c2e3ac47c98e1efe40000000b9dde86666e0a2c09eb84700de759da0834dfb6731c6c66fe3ef322bd3022f523e59710ea9faddd743db1ff88af5e9fabcdc6442ca2ae3f6426c51f373e691e1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000d73fa9f48861dc447be22521d0e960eb449eff4513ad41245ce4e516e0ab1fc1000000000e800000000200002000000040151e5d05127b3992a16ec6b02abd5cbb0eb869a1a6878e8a87f327dc67617a900000004b9bb40c8446619f9738d88e9663aa88abd6508219ab57673d4fd6aeb2db450302603dd0d721647c44c6cc40dcae3d262c3c29bc83a8aba3955f8cdc5eebb5a174c10da3109eef69d2f8fdffae597d635b64c3acdff91bb75c4ec336e59a76afb2163a29e250846256a34d28c7d92bd65890f0a3aa78dd8c4dd4aac9c81fbc2c34fdbcaf57860096fbe37d2c2ead5f814000000020046a896717f75fe0d4c0926b14ba94dc1b10898f61b044a2e5d57d40309e74e70a29651f6ffbdf6cd9ea7584479e645c37690c05afde10960940b0feab3ea5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2024 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2024 iexplore.exe 2024 iexplore.exe 2540 IEXPLORE.EXE 2540 IEXPLORE.EXE 2540 IEXPLORE.EXE 2540 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2024 wrote to memory of 2540 2024 iexplore.exe 30 PID 2024 wrote to memory of 2540 2024 iexplore.exe 30 PID 2024 wrote to memory of 2540 2024 iexplore.exe 30 PID 2024 wrote to memory of 2540 2024 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\You-Are-An-Idiot-main\YouAreAnIdiot\bin\Debug\Idiot.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2024 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2540
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 23407794bde833861e73305e16920bc24b84bd8c6362f78009260d4bfca550c9
- MD5 15893a4ca8de550ec1cfe35dc9ee7cfb
- SHA1 2e3d3f83dc7d7e085a35e32cf08d72fb7c9e9ac1
- SHA512 7bed0d16fdd375803060b0013e8f3d261b35f738288d5a8dfedf575de5df8f93f05fa643fd33ee76cea9b5df5a6b36c5fdc1b4e906f670f81e403a2dd2ff31f6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 508f55ef10ab190b5351da62ecd94cf8ea0952304deb2f2210af7ea7850c72ef
- MD5 047b6be10649da1abcac8481737c8602
- SHA1 0e2fa913a629525479d6593478d23158a80cb00e
- SHA512 602f3473d3f7c9ca5b45e2f67f15a3997bf2ed0f8771f94731e46e6b84f3e28e05218811af96b53488f5a71f800268672724b029515c12fd494777a5550f7981
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 4f07a29ceb4ef9e425b992ac5db38fa51e8cb0730865fc2b9b6857efabe6f6b4
- MD5 c4b71264f4fd83161df1c4ddc285156a
- SHA1 413fc60a0131562a048ccddd4dba89f88b55d848
- SHA512 38ec581a15613770fc3a01c66920f804cc4205f25677e94905894969e9ac0cc4e3b15cc889dd34e378c403ba74baab0eda7a330d89d11753ba8d277469eba111
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 de65f2e99ea857fededbcb03e974ed8757159d5663ee7d7f0f7a2509a8b89591
- MD5 b580831ecde5fb81bab5aa08ec0c8d42
- SHA1 71ca5e54a894fc3488c6969265a71fe47584b343
- SHA512 6783ac9554d6a878a251c65b2af1e9941810d29e754774c746f0457ee2a4f0ffdfdfaa76620a337354eb03c2dae28b4254cf7e9b2a34b38045bfbfaee8502156
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 c0e4ac8c9fce54af5e3ff5627501a15440d97a7c9383882eee87e1ecc1ddab41
- MD5 8b2a3f43e9f47ca0eb2b7e3202b5a83a
- SHA1 4cbf9eabc3e0387a97cfd242e9e70497d9273862
- SHA512 89f674de330795572370c27d7d7e66e23754b784cef5303297412b1421d8a602ffdc4c3638ff366704eea61dc9e5b7943ff7d8eb2def4bfbc92f125e5c55c061
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 0c2ef2d5b514d4264070887cbc25fcb5a93ffda78709e833b564a41afa5fd415
- MD5 09055624f8db160b7616c023b567b8a4
- SHA1 a6b15822159f68715f57ce303403338a5837c882
- SHA512 0e68c12c5db73b614b05b2c7f2fcc00223936f062770284922dea4d5bd5895ccc00be2e475a8fca980534bcf148a30ebef4e080a56a4d280b73fd4915099866e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 67dd616bb1693cb63d0520fb78276d170955890caa1ea46382f825c6248178df
- MD5 428162b0d41dc4842b57b339b248f96e
- SHA1 92e593a3d1ec9e884989e9018086dc5889e9c5b6
- SHA512 0eeb75525b7580a62c506f85a3f7f929b7bb3d841c0a77bc2f64d44a15169bdeccc9bd635a2aa701adf6b174d4bab396fd93efaa4e9b557104a7624e1497e24e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 57ff0a427f0af5aea1f1b74a897918dea6d2da062269c06185062cc9661526ea
- MD5 0008e6fbf83b2aa8a5e48d87a6512833
- SHA1 83387257fdc979c60d73af03954b5d5feb973fe9
- SHA512 50379cf7f2f50e235c13e5b97218ff7f14aa6735cc73a333590179967a67ad8c132d5cfb220e3174c5e8dcbf9650718b4eac6a2b0ec51c605475744964871c20
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\CabF53B.tmp
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar288D.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP