Analysis

  • max time kernel
    122s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    22/02/2024, 18:44

General

  • Target

    YNAB 4_4.3.857_Setup.exe

  • Size

    20.2MB

  • MD5

    a25c0a73350a99559f1e30c2f86ad0b9

  • SHA1

    e537d5658b67739724e5ee38f9075b453052f1cf

  • SHA256

    f3021e45c82d72bd139d86f6a68c96af201bedf53a373f183dca037003b9cdc6

  • SHA512

    7c5fc8e35fb0bb009c01fd9f4784bb2902b3298cd644fa8664c2fcfd44f2ad0dc0c20990f2d02408a1a3fdc9b8afcf80f433b8e23b9e988f5358266cf80a0de3

  • SSDEEP

    393216:GMBVYD1nCAMtsTDzoFYJ3wERZRdW/r7wPLSSkkUYkNMYlC7Ele8lW4a4oUJmGx9P:GMvYpAtsT3oiVfK/APLS/+u87we8UbU9

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 26 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 56 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\YNAB 4_4.3.857_Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\YNAB 4_4.3.857_Setup.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1640
    • C:\Users\Admin\AppData\Local\Temp\is-SUONG.tmp\YNAB 4_4.3.857_Setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-SUONG.tmp\YNAB 4_4.3.857_Setup.tmp" /SL5="$70124,20782605,219136,C:\Users\Admin\AppData\Local\Temp\YNAB 4_4.3.857_Setup.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Modifies registry class
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2264
      • C:\Program Files (x86)\YNAB 4\YNAB 4.exe
        "C:\Program Files (x86)\YNAB 4\YNAB 4.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Modifies system certificate store
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2444
        • C:\WINDOWS\SysWOW64\hostname.exe
          "C:\WINDOWS\system32\hostname.exe"
          4⤵
            PID:1864

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\YNAB 4\Adobe AIR\Versions\1.0\Adobe AIR.dll

            Filesize

            2.0MB

            MD5

            c083f8f26617d6adb86d2415a1bd42ff

            SHA1

            db6e31df956d3ba91f9e355a7b03de9f323b66b9

            SHA256

            39842ff576bca2d34a50ecfe8dcb04f3ff524aac0263cc456f9e7e872f7bb788

            SHA512

            7578012b40902dd63b57d265c13b71617327296908674f1daaa5f29c75b09075834386868776a26bc1fd8a944c899c9e8e3691c901e1d1c67e355dc176380e37

          • C:\Program Files (x86)\YNAB 4\META-INF\AIR\application.xml

            Filesize

            2KB

            MD5

            8f7487c76b681fba22a05c595f39b8bf

            SHA1

            87e7b04dde3a8fa5dbfa57c6b8b8f1bb8a64989d

            SHA256

            ebdf4f7eaded6a910cc811b77fd89653baee2402dbdeb282358dc208471ce255

            SHA512

            5b4c9d195e91e27f4d2bb3a215a1099c31e25f0576b55b7233fbf5a4b27bdcad0e7e1dffc3acb0fd7424c7dc8c0b8ad5a9cbbaeb2dc1db1584e32ad4aa5afc2e

          • C:\Program Files (x86)\YNAB 4\YNAB.swf

            Filesize

            2.0MB

            MD5

            8d8732d0f71ec7f42ed3a4c25e5df1f8

            SHA1

            577b068c905fc0d446466af506bbad11d3f46c38

            SHA256

            54d1285f133a9fa0e34a7fca7aeef572e14a98d784e296180c0ff30c971314d8

            SHA512

            330a477c4cdd024b22f3e64c2c4add5ace8511f2866fc810f61651e31bd6a95ab0dc66719bcf15eeab2784e960fb06b1b6e46b2044de7397c95ee77a60d12125

          • C:\Program Files (x86)\YNAB 4\styles.swf

            Filesize

            1.1MB

            MD5

            d8fa8b1d79c4fddd83b920382ea6b0db

            SHA1

            f7095bb39def83997ba9f340eb2aebe88af98976

            SHA256

            79ff741d4a04dd58e1db3735a676562a3d15a25697ceab4f876197bb885dda76

            SHA512

            948b812916f99f2d58f7fe24b034bed43c2bcc15ea5c45c7196052923190e66a3071bd20b252bf606598bbc2041f0155407e4e7ec5495cf8d48863e59d5125cb

          • C:\Users\Admin\AppData\Local\Temp\CabA1FC.tmp

            Filesize

            65KB

            MD5

            ac05d27423a85adc1622c714f2cb6184

            SHA1

            b0fe2b1abddb97837ea0195be70ab2ff14d43198

            SHA256

            c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

            SHA512

            6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

          • C:\Users\Admin\AppData\Local\Temp\TarA21E.tmp

            Filesize

            171KB

            MD5

            9c0c641c06238516f27941aa1166d427

            SHA1

            64cd549fb8cf014fcd9312aa7a5b023847b6c977

            SHA256

            4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

            SHA512

            936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

          • \Program Files (x86)\YNAB 4\Adobe AIR\Versions\1.0\Adobe AIR.dll

            Filesize

            12.4MB

            MD5

            241b62402135af6850d8060eea33b87f

            SHA1

            ef054b48ef6265c5d9e3880233710b5bfce82055

            SHA256

            b081e922ade2d47f8b3f4e632f6a4edcfd263086e36b86f9e2d3a90c7227eb61

            SHA512

            a7a7c03844d41d7a25bc20550f864b520e0f163c0ac6c60925f2315177471df99d3fe38efbaf56bc84e8bc6ddd62cd4a7f24c43eae91220bc3a36e599afce6d5

          • \Program Files (x86)\YNAB 4\YNAB 4.exe

            Filesize

            211KB

            MD5

            8498b21d1c4582162ae4e100822babe5

            SHA1

            7f4e05fe9eacbbb8a4fca9baf2fb0a5b732fd03e

            SHA256

            160256d4687b59be6202de349e777aaeac5e93c037c41304f24d34883f2d5327

            SHA512

            0b5e7afeb082a4cc76bd0284203ee635fc17f2a4163655b19bba7c8cb7642cfa61ec16b8b5be87557d051d89400a8b7fcd77e48b7618263221303401c6db2db1

          • \Users\Admin\AppData\Local\Temp\is-AJ2CE.tmp\_isetup\_shfoldr.dll

            Filesize

            22KB

            MD5

            92dc6ef532fbb4a5c3201469a5b5eb63

            SHA1

            3e89ff837147c16b4e41c30d6c796374e0b8e62c

            SHA256

            9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

            SHA512

            9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

          • \Users\Admin\AppData\Local\Temp\is-SUONG.tmp\YNAB 4_4.3.857_Setup.tmp

            Filesize

            1.2MB

            MD5

            29f9be62944155dbb6b0b4f07138ea96

            SHA1

            5095375e40047d1b0daa4527c5de271ab23cd2f0

            SHA256

            168e5bbfcc47229ae0375ece11b7c9dabeb0a6bc820058fc2c86f4682cd0388f

            SHA512

            fe9bf378c278986118a7e17d326c795796c6ff20e3c6770ceeffc5d3f948d552147e41d3364cb1e55919d1c54974d135e28fc0753fc555c56a6dd839e4b264fd

          • memory/1640-103-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

          • memory/1640-14-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

          • memory/1640-0-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

          • memory/2264-85-0x0000000000400000-0x0000000000539000-memory.dmp

            Filesize

            1.2MB

          • memory/2264-15-0x0000000000400000-0x0000000000539000-memory.dmp

            Filesize

            1.2MB

          • memory/2264-7-0x0000000000240000-0x0000000000241000-memory.dmp

            Filesize

            4KB

          • memory/2444-229-0x0000000003510000-0x0000000003710000-memory.dmp

            Filesize

            2.0MB

          • memory/2444-231-0x0000000003510000-0x0000000003710000-memory.dmp

            Filesize

            2.0MB

          • memory/2444-199-0x0000000003810000-0x0000000003830000-memory.dmp

            Filesize

            128KB

          • memory/2444-200-0x0000000003510000-0x0000000003710000-memory.dmp

            Filesize

            2.0MB

          • memory/2444-201-0x0000000003510000-0x0000000003710000-memory.dmp

            Filesize

            2.0MB

          • memory/2444-202-0x0000000003510000-0x0000000003710000-memory.dmp

            Filesize

            2.0MB

          • memory/2444-203-0x0000000003510000-0x0000000003710000-memory.dmp

            Filesize

            2.0MB

          • memory/2444-204-0x0000000003510000-0x0000000003710000-memory.dmp

            Filesize

            2.0MB

          • memory/2444-205-0x0000000003510000-0x0000000003710000-memory.dmp

            Filesize

            2.0MB

          • memory/2444-207-0x0000000003510000-0x0000000003710000-memory.dmp

            Filesize

            2.0MB

          • memory/2444-208-0x0000000003510000-0x0000000003710000-memory.dmp

            Filesize

            2.0MB

          • memory/2444-209-0x0000000003510000-0x0000000003710000-memory.dmp

            Filesize

            2.0MB

          • memory/2444-210-0x0000000003510000-0x0000000003710000-memory.dmp

            Filesize

            2.0MB

          • memory/2444-211-0x0000000003510000-0x0000000003710000-memory.dmp

            Filesize

            2.0MB

          • memory/2444-212-0x0000000003510000-0x0000000003710000-memory.dmp

            Filesize

            2.0MB

          • memory/2444-213-0x0000000003510000-0x0000000003710000-memory.dmp

            Filesize

            2.0MB

          • memory/2444-214-0x0000000003510000-0x0000000003710000-memory.dmp

            Filesize

            2.0MB

          • memory/2444-216-0x0000000003510000-0x0000000003710000-memory.dmp

            Filesize

            2.0MB

          • memory/2444-217-0x0000000003510000-0x0000000003710000-memory.dmp

            Filesize

            2.0MB

          • memory/2444-218-0x0000000003510000-0x0000000003710000-memory.dmp

            Filesize

            2.0MB

          • memory/2444-220-0x0000000003510000-0x0000000003710000-memory.dmp

            Filesize

            2.0MB

          • memory/2444-222-0x0000000003510000-0x0000000003710000-memory.dmp

            Filesize

            2.0MB

          • memory/2444-223-0x0000000003510000-0x0000000003710000-memory.dmp

            Filesize

            2.0MB

          • memory/2444-225-0x0000000003510000-0x0000000003710000-memory.dmp

            Filesize

            2.0MB

          • memory/2444-226-0x0000000003510000-0x0000000003710000-memory.dmp

            Filesize

            2.0MB

          • memory/2444-227-0x0000000003510000-0x0000000003710000-memory.dmp

            Filesize

            2.0MB

          • memory/2444-198-0x0000000003810000-0x0000000003830000-memory.dmp

            Filesize

            128KB

          • memory/2444-232-0x0000000003810000-0x0000000003830000-memory.dmp

            Filesize

            128KB

          • memory/2444-235-0x0000000003810000-0x0000000003830000-memory.dmp

            Filesize

            128KB

          • memory/2444-237-0x0000000003810000-0x0000000003830000-memory.dmp

            Filesize

            128KB

          • memory/2444-239-0x0000000003810000-0x0000000003830000-memory.dmp

            Filesize

            128KB

          • memory/2444-238-0x0000000003810000-0x0000000003830000-memory.dmp

            Filesize

            128KB

          • memory/2444-236-0x0000000003810000-0x0000000003830000-memory.dmp

            Filesize

            128KB

          • memory/2444-234-0x0000000003810000-0x0000000003830000-memory.dmp

            Filesize

            128KB

          • memory/2444-233-0x0000000003810000-0x0000000003830000-memory.dmp

            Filesize

            128KB

          • memory/2444-197-0x0000000003810000-0x0000000003830000-memory.dmp

            Filesize

            128KB

          • memory/2444-230-0x0000000003510000-0x0000000003710000-memory.dmp

            Filesize

            2.0MB

          • memory/2444-240-0x0000000003810000-0x0000000003830000-memory.dmp

            Filesize

            128KB

          • memory/2444-242-0x0000000003510000-0x0000000003710000-memory.dmp

            Filesize

            2.0MB

          • memory/2444-245-0x0000000003810000-0x0000000003830000-memory.dmp

            Filesize

            128KB

          • memory/2444-246-0x0000000003810000-0x0000000003830000-memory.dmp

            Filesize

            128KB

          • memory/2444-249-0x0000000003810000-0x0000000003830000-memory.dmp

            Filesize

            128KB

          • memory/2444-252-0x0000000003810000-0x0000000003830000-memory.dmp

            Filesize

            128KB

          • memory/2444-248-0x0000000003810000-0x0000000003830000-memory.dmp

            Filesize

            128KB

          • memory/2444-241-0x0000000003510000-0x0000000003710000-memory.dmp

            Filesize

            2.0MB

          • memory/2444-228-0x0000000003510000-0x0000000003710000-memory.dmp

            Filesize

            2.0MB

          • memory/2444-224-0x0000000003510000-0x0000000003710000-memory.dmp

            Filesize

            2.0MB

          • memory/2444-221-0x0000000003510000-0x0000000003710000-memory.dmp

            Filesize

            2.0MB

          • memory/2444-219-0x0000000003510000-0x0000000003710000-memory.dmp

            Filesize

            2.0MB

          • memory/2444-196-0x0000000003510000-0x0000000003710000-memory.dmp

            Filesize

            2.0MB

          • memory/2444-206-0x0000000003510000-0x0000000003710000-memory.dmp

            Filesize

            2.0MB

          • memory/2444-281-0x0000000003810000-0x0000000003830000-memory.dmp

            Filesize

            128KB

          • memory/2444-282-0x0000000003810000-0x0000000003830000-memory.dmp

            Filesize

            128KB

          • memory/2444-293-0x0000000003510000-0x0000000003710000-memory.dmp

            Filesize

            2.0MB

          • memory/2444-294-0x0000000003510000-0x0000000003710000-memory.dmp

            Filesize

            2.0MB

          • memory/2444-295-0x0000000003510000-0x0000000003710000-memory.dmp

            Filesize

            2.0MB

          • memory/2444-391-0x00000000021F0000-0x00000000021FA000-memory.dmp

            Filesize

            40KB

          • memory/2444-390-0x00000000021F0000-0x00000000021FA000-memory.dmp

            Filesize

            40KB

          • memory/2444-389-0x00000000021F0000-0x00000000021FA000-memory.dmp

            Filesize

            40KB

          • memory/2444-388-0x00000000021F0000-0x00000000021FA000-memory.dmp

            Filesize

            40KB

          • memory/2444-4072-0x00000000001D0000-0x00000000001D1000-memory.dmp

            Filesize

            4KB

          • memory/2444-7106-0x00000000021F0000-0x00000000021FA000-memory.dmp

            Filesize

            40KB

          • memory/2444-7108-0x00000000021F0000-0x00000000021FA000-memory.dmp

            Filesize

            40KB

          • memory/2444-7110-0x00000000021F0000-0x00000000021FA000-memory.dmp

            Filesize

            40KB

          • memory/2444-7111-0x00000000021F0000-0x00000000021FA000-memory.dmp

            Filesize

            40KB

          • memory/2444-7113-0x00000000021F0000-0x00000000021FA000-memory.dmp

            Filesize

            40KB

          • memory/2444-7115-0x00000000021F0000-0x00000000021FA000-memory.dmp

            Filesize

            40KB

          • memory/2444-195-0x0000000003510000-0x0000000003710000-memory.dmp

            Filesize

            2.0MB

          • memory/2444-194-0x0000000003510000-0x0000000003710000-memory.dmp

            Filesize

            2.0MB

          • memory/2444-78-0x00000000001D0000-0x00000000001D1000-memory.dmp

            Filesize

            4KB