URL:

youareanidiot.cc

Full analysis: https://app.any.run/tasks/52cbe038-8bba-47f9-adc4-a17f5e0c8124
Verdict: Malicious activity
Analysis date: October 08, 2023, 15:13:43
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

B61CEFAB0DE0BA4B513AA21AAA6C8E8F

SHA1:

A0C71C8E0611C7B035402B139B6DA8681BF78C63

SHA256:

89A069654BAE8BA9B1A372290062500CD89F3BF4C1C317DB24F1DC0D472E4BAC

SSDEEP:

3:7QEtpQGG:dW

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3640)

    • The process uses the downloaded file

      • FlashUtil32_32_0_0_453_ActiveX.exe (PID: 1228)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
3
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe flashutil32_32_0_0_453_activex.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1228C:\Windows\system32\Macromed\Flash\FlashUtil32_32_0_0_453_ActiveX.exe -EmbeddingC:\Windows\System32\Macromed\Flash\FlashUtil32_32_0_0_453_ActiveX.exe—svchost.exe
User:
admin
Company:
Adobe
Integrity Level:
MEDIUM
Description:
Adobe® Flash® Player Installer/Uninstaller 32.0 r0
Exit code:
0
Version:
32,0,0,453
Modules
Images
c:\windows\system32\macromed\flash\flashutil32_32_0_0_453_activex.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
3460"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3640 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3640"C:\Program Files\Internet Explorer\iexplore.exe" "youareanidiot.cc"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
29 648
Read events
29 433
Write events
215
Delete events
0

Modification events

(PID) Process:(3640) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(3640) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(3640) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(3640) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3640) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3640) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3640) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3640) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3640) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3640) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
104
Text files
153
Unknown types
0

Dropped files

PID
Process
Filename
Type
3460iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
3460iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:26C189D6335F0EC0726E6887506E8E12
SHA256:FD0A78CAF3227FAE84E2E0FE8951C6C04A1303BF6EA75C0FCBD5FA57113D43D5
3460iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:18DC329C63272C17B967FD14D8C7CCF2
SHA256:036478521F88C33AA94C1E969F8A59347861F794F898BD574BF9CAB2C09D942F
3640iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63binary
MD5:E4993D4F9DDB390FAFB99F05B9640070
SHA256:CF5A3674553D5C1A8C88F3C4D7E1CAD4C915A37AAE92DF3DEFFEC0CD5B3DA56B
3640iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\imagestore\f7ruq93\imagestore.datbinary
MD5:4C752A9F9F3F86523D07E96FB490F20F
SHA256:0D509CA2A44089A10C14A99938500B6E844A85D6866FBA38F634827F4CD786A7
3460iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:22156F7B43C820D25641215CCBBED8CC
SHA256:5DB1F7FEC737101BE328DE9CC5184FFF1CCF683D617F065B7BD7A820E39AE00A
3460iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\speakerm[1].pngimage
MD5:9BE1B245CFC2D321AFCCA0777EF1A232
SHA256:63AE0D905EABF626CF936D96EA646FBC726F2ABE98F3816C2C74E1D5B9927519
3460iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\you[1].jstext
MD5:C01D28B90726A4591702F393F81F27A0
SHA256:2A2C70A955EFE6FBDA7EE22CE3682EEAC4FB7D4459B1C2CBA4105F758A791CFB
3640iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\favicon[1].icoimage
MD5:0B6DCF9C1429088C7F079D7CC291BB66
SHA256:4B0358B16230208179720A09D205B99A3E9764E63815B09E9F1716A02FCCADCB
3460iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\styles[1].csstext
MD5:F93A11E508A8BBED3F6703C12B603620
SHA256:A80F2164ED78872E8DCD4EBA284496D8EFB75B74290EE835B9DE43EE00AE8835
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
67
DNS requests
20
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3460
iexplore.exe
GET
301
172.67.143.125:80
http://youareanidiot.cc/
US
—
—
unknown
3460
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?295900b6d86635cb
GB
compressed
4.66 Kb
unknown
3460
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
binary
1.47 Kb
unknown
3640
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
unknown
3460
iexplore.exe
POST
200
192.229.221.95:80
http://ocsp.digicert.com/
US
binary
471 b
unknown
3460
iexplore.exe
POST
200
192.229.221.95:80
http://ocsp.digicert.com/
US
binary
471 b
unknown
3460
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
US
binary
471 b
unknown
3460
iexplore.exe
POST
200
192.229.221.95:80
http://ocsp.digicert.com/
US
binary
471 b
unknown
3460
iexplore.exe
POST
200
192.229.221.95:80
http://ocsp.digicert.com/
US
binary
471 b
unknown
3460
iexplore.exe
POST
200
192.229.221.95:80
http://ocsp.digicert.com/
US
binary
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
3460
iexplore.exe
172.67.143.125:80
youareanidiot.cc
CLOUDFLARENET
US
unknown
3460
iexplore.exe
172.67.143.125:443
youareanidiot.cc
CLOUDFLARENET
US
unknown
3460
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
3460
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3640
iexplore.exe
172.67.143.125:443
youareanidiot.cc
CLOUDFLARENET
US
unknown
2656
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3640
iexplore.exe
104.126.37.163:443
www.bing.com
Akamai International B.V.
DE
unknown
3640
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
youareanidiot.cc
  • 172.67.143.125
  • 104.21.95.69
malicious
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 104.126.37.163
  • 104.126.37.170
  • 104.126.37.155
  • 104.126.37.145
  • 104.126.37.162
  • 104.126.37.131
  • 104.126.37.139
  • 104.126.37.154
  • 104.126.37.136
  • 2.23.209.149
  • 2.23.209.133
  • 2.23.209.187
  • 2.23.209.130
  • 2.23.209.182
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
r.bing.com
  • 104.126.37.145
  • 104.126.37.153
  • 104.126.37.131
  • 104.126.37.136
  • 104.126.37.155
  • 104.126.37.137
  • 104.126.37.144
  • 104.126.37.154
  • 104.126.37.160
whitelisted
th.bing.com
  • 104.126.37.170
  • 104.126.37.123
  • 104.126.37.130
  • 104.126.37.129
  • 104.126.37.176
  • 104.126.37.171
  • 104.126.37.162
  • 104.126.37.163
  • 104.126.37.128
whitelisted
login.microsoftonline.com
  • 40.126.31.71
  • 40.126.31.73
  • 20.190.159.68
  • 20.190.159.2
  • 20.190.159.64
  • 20.190.159.71
  • 20.190.159.23
  • 40.126.31.69
whitelisted

Threats

PID
Process
Class
Message
1088
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
youareanidiot.cc