Overview

overview

3

Static

static

1

YouAreAnIdiot.hta

windows10-ltsc_2021-x64

3

Analysis

  • max time kernel
    43s
  • max time network
    146s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260911-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    07/11/2026, 13:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    YouAreAnIdiot.hta
  • Size 3.0MB
  • Sample261107-qaqv2ab18t
  • SHA256 295dd6c5a81bf4c0d18f095d253d6bbcd50b8b0d42b54546863de518c546016f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
adwarediscoverypersistenceransomwarespyware

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies registry class 37 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\SysWOW64\mshta.exe
    C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\YouAreAnIdiot.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    PID:4268
  • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
    "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2508
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer Phishing Filter
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2376
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:3808
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:17414 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1384
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:82946 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1196
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:17426 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:4104
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:82948 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2536
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:17438 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:3492
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:82950 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:688
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:82954 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:3456
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:17460 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:4716
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:82956 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2092
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:82964 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:532
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:17496 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:780
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:214022 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      PID:1792
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:17514 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1864
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:82986 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      PID:1240
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:17516 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      PID:876
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:82994 /prefetch:2
      2⤵
        PID:2680
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:83000 /prefetch:2
        2⤵
          PID:4836
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:83004 /prefetch:2
          2⤵
            PID:2460
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:83014 /prefetch:2
            2⤵
              PID:4492
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:17570 /prefetch:2
              2⤵
                PID:4840
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:83024 /prefetch:2
                2⤵
                  PID:2336
                • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:148488 /prefetch:2
                  2⤵
                    PID:5272
                  • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:83062 /prefetch:2
                    2⤵
                      PID:5508
                    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:17582 /prefetch:2
                      2⤵
                        PID:5604
                      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:83092 /prefetch:2
                        2⤵
                          PID:5800
                      • C:\Windows\SysWOW64\mshta.exe
                        C:\Windows\SysWOW64\mshta.exe -Embedding
                        1⤵
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        PID:1388
                      • C:\Windows\SysWOW64\mshta.exe
                        C:\Windows\SysWOW64\mshta.exe -Embedding
                        1⤵
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        PID:2324
                      • C:\Windows\SysWOW64\mshta.exe
                        C:\Windows\SysWOW64\mshta.exe -Embedding
                        1⤵
                        • System Location Discovery: System Language Discovery
                        PID:2732

                      Network

                            MITRE ATT&CK Enterprise v16

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
                            • Size 471B
                            • SHA256 d138641fabab14c3b2dc747dd70aaf95f4b6104aac4009507743c0bbe2b0fab0
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
                            • Size 416B
                            • SHA256 1747e946a40e1c3e3beffac1a0bb607bab4845a7b4005b3069f2f3c957674cd9
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            suggestions[1].en-US
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZEOIHDW9\suggestions[1].en-US
                            • Size 17KB
                            • SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            ~DF4962EF1C0FA42024.TMP
                            • Path C:\Users\Admin\AppData\Local\Temp\~DF4962EF1C0FA42024.TMP
                            • Size 16KB
                            • SHA256 f09e735574dd1fc0d80c285abf94d67c8c68f65a8f65f484de7c19db1398dc69
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            f01b4d95cf55d32a.automaticDestinations-ms
                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
                            • Size 5KB
                            • SHA256 0ac18b836848630867ffec58272d9f5c144c3f89ba58dafa8c5c643c7c7d0bef
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            f01b4d95cf55d32a.automaticDestinations-ms
                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
                            • Size 5KB
                            • SHA256 7808c61cc07a4a277a8a64136d236ef72df68461788505f3a208c12578a4d005
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            28c8b86deab549a1.customDestinations-ms
                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\28c8b86deab549a1.customDestinations-ms
                            • Size 3KB
                            • SHA256 e9c78178dfcd6a56e2e46ec143d8a83dca5625afbfff9aafa7ab9684a55c6043
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            W1RS4GUY5E7CP4LR5IVB.temp
                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\W1RS4GUY5E7CP4LR5IVB.temp
                            • Size 3KB
                            • SHA256 3a04f86cf5ce918bb9b27cde45fdad54a90bf04c464c373fdd057271126b8a09
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            YouAreAnIdiot (1).hta
                            • Path C:\Users\Admin\Downloads\YouAreAnIdiot (1).hta
                            • Size 3.0MB
                            • SHA256 295dd6c5a81bf4c0d18f095d253d6bbcd50b8b0d42b54546863de518c546016f
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download