Analysis

  • max time kernel
    146s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/02/2024, 18:44

General

  • Target

    YNAB 4_4.3.857_Setup.exe

  • Size

    20.2MB

  • MD5

    a25c0a73350a99559f1e30c2f86ad0b9

  • SHA1

    e537d5658b67739724e5ee38f9075b453052f1cf

  • SHA256

    f3021e45c82d72bd139d86f6a68c96af201bedf53a373f183dca037003b9cdc6

  • SHA512

    7c5fc8e35fb0bb009c01fd9f4784bb2902b3298cd644fa8664c2fcfd44f2ad0dc0c20990f2d02408a1a3fdc9b8afcf80f433b8e23b9e988f5358266cf80a0de3

  • SSDEEP

    393216:GMBVYD1nCAMtsTDzoFYJ3wERZRdW/r7wPLSSkkUYkNMYlC7Ele8lW4a4oUJmGx9P:GMvYpAtsT3oiVfK/APLS/+u87we8UbU9

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 26 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 56 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\YNAB 4_4.3.857_Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\YNAB 4_4.3.857_Setup.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2188
    • C:\Users\Admin\AppData\Local\Temp\is-MR719.tmp\YNAB 4_4.3.857_Setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-MR719.tmp\YNAB 4_4.3.857_Setup.tmp" /SL5="$6006A,20782605,219136,C:\Users\Admin\AppData\Local\Temp\YNAB 4_4.3.857_Setup.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Modifies registry class
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2288
      • C:\Program Files (x86)\YNAB 4\YNAB 4.exe
        "C:\Program Files (x86)\YNAB 4\YNAB 4.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Suspicious use of SetWindowsHookEx
        PID:2416
  • C:\Program Files (x86)\YNAB 4\YNAB 4.exe
    "C:\Program Files (x86)\YNAB 4\YNAB 4.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks processor information in registry
    PID:4776
    • C:\WINDOWS\SysWOW64\hostname.exe
      "C:\WINDOWS\system32\hostname.exe"
      2⤵
        PID:2736
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x33c 0x4bc
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3040
    • C:\Program Files (x86)\YNAB 4\YNAB 4.exe
      "C:\Program Files (x86)\YNAB 4\YNAB 4.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks processor information in registry
      • Suspicious use of SetWindowsHookEx
      PID:4252

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\YNAB 4\Adobe AIR\Versions\1.0\Adobe AIR.dll

            Filesize

            832KB

            MD5

            d30499473f649f35a9196f7a7c55ab96

            SHA1

            6f2997bf5679d427733a7c57b23a53f755a47e41

            SHA256

            be5fb81ee431cc99f0af8caaac5ebee7000808bccc7a7ea1238f8ef12632d334

            SHA512

            03715da6c38d3281ead876d0f0eb6a6c9a9d940f4c5c924fc1ae680cabca7146f63231d8a3eec20f8b19bf7eb895141e7375e3fbce4e7555fecd491dc881b262

          • C:\Program Files (x86)\YNAB 4\Adobe AIR\Versions\1.0\Adobe AIR.dll

            Filesize

            384KB

            MD5

            712206a7d184dc40d36d7752bc572950

            SHA1

            17ea95e114a5f047f7697d080b213c68437bba84

            SHA256

            1bb20a972c535a197268a7c9e75a7754cb6ab741f1ed9f8db5faa470c5d584cc

            SHA512

            150283e0831afdda05438c25cd02f5c039d6a8bfea2bc687368a7668e9b88a291bd4317cf95fe067986c452419714e87bed3a1b819ed0cc19cc2c157e5679472

          • C:\Program Files (x86)\YNAB 4\Adobe AIR\Versions\1.0\Adobe AIR.dll

            Filesize

            13.9MB

            MD5

            556f36c4681a5991dd00a894a418c8f5

            SHA1

            87198ce222fec384e7a5d8c2f30a9732a96b6ec3

            SHA256

            3025ef1da177649b2bd4f6a632d03f3391490f58ad35a5dd9e88440f7b898c25

            SHA512

            13cbd117503addcbfbff96f64c82f024e92a4790d4f4e184cad5f585a7a1b59228c9654226d77b39868d78758bbe43e9a56041f71130513ab29dcc5d7b6d580a

          • C:\Program Files (x86)\YNAB 4\Adobe AIR\Versions\1.0\Adobe AIR.dll

            Filesize

            15.4MB

            MD5

            e35e24dcfe02348c8691098a6d90f5d2

            SHA1

            3d63d11798940b82a3b7259230b83495eedd830f

            SHA256

            9fadb97b12990ed707a50ad11a7e57a5ab9eae7a7be08abca9d87828959d98c0

            SHA512

            673867d835c145dc49004325d8385d7f668339a12aee3c6e88805d9e297829f823f88e081f967d54dfc0570eede372e52f26ad88909bb82c95da10c11e0ddb04

          • C:\Program Files (x86)\YNAB 4\META-INF\AIR\application.xml

            Filesize

            2KB

            MD5

            8f7487c76b681fba22a05c595f39b8bf

            SHA1

            87e7b04dde3a8fa5dbfa57c6b8b8f1bb8a64989d

            SHA256

            ebdf4f7eaded6a910cc811b77fd89653baee2402dbdeb282358dc208471ce255

            SHA512

            5b4c9d195e91e27f4d2bb3a215a1099c31e25f0576b55b7233fbf5a4b27bdcad0e7e1dffc3acb0fd7424c7dc8c0b8ad5a9cbbaeb2dc1db1584e32ad4aa5afc2e

          • C:\Program Files (x86)\YNAB 4\YNAB 4.exe

            Filesize

            211KB

            MD5

            8498b21d1c4582162ae4e100822babe5

            SHA1

            7f4e05fe9eacbbb8a4fca9baf2fb0a5b732fd03e

            SHA256

            160256d4687b59be6202de349e777aaeac5e93c037c41304f24d34883f2d5327

            SHA512

            0b5e7afeb082a4cc76bd0284203ee635fc17f2a4163655b19bba7c8cb7642cfa61ec16b8b5be87557d051d89400a8b7fcd77e48b7618263221303401c6db2db1

          • C:\Users\Admin\AppData\Local\Temp\is-MR719.tmp\YNAB 4_4.3.857_Setup.tmp

            Filesize

            1.2MB

            MD5

            29f9be62944155dbb6b0b4f07138ea96

            SHA1

            5095375e40047d1b0daa4527c5de271ab23cd2f0

            SHA256

            168e5bbfcc47229ae0375ece11b7c9dabeb0a6bc820058fc2c86f4682cd0388f

            SHA512

            fe9bf378c278986118a7e17d326c795796c6ff20e3c6770ceeffc5d3f948d552147e41d3364cb1e55919d1c54974d135e28fc0753fc555c56a6dd839e4b264fd

          • memory/2188-115-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

          • memory/2188-12-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

          • memory/2188-2-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

          • memory/2188-0-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

          • memory/2288-16-0x0000000002520000-0x0000000002521000-memory.dmp

            Filesize

            4KB

          • memory/2288-38-0x0000000000400000-0x0000000000539000-memory.dmp

            Filesize

            1.2MB

          • memory/2288-13-0x0000000000400000-0x0000000000539000-memory.dmp

            Filesize

            1.2MB

          • memory/2288-7-0x0000000002520000-0x0000000002521000-memory.dmp

            Filesize

            4KB

          • memory/2288-111-0x0000000000400000-0x0000000000539000-memory.dmp

            Filesize

            1.2MB

          • memory/2416-129-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-126-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-112-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-110-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-113-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-114-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-108-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-116-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-105-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-117-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-118-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-119-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-121-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-120-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-122-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-123-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-124-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-125-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-127-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-128-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-103-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-130-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-132-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-131-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-104-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-135-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-136-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-109-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-138-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-139-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-140-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-141-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-142-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-137-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-143-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-144-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-145-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-148-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-149-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-102-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-150-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-146-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-151-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-152-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-153-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-154-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-155-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-157-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-159-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-161-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-166-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-80-0x0000000002530000-0x0000000002531000-memory.dmp

            Filesize

            4KB

          • memory/2416-213-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/2416-172-0x0000000004140000-0x0000000004340000-memory.dmp

            Filesize

            2.0MB

          • memory/4252-214-0x0000000003AD0000-0x0000000003CD0000-memory.dmp

            Filesize

            2.0MB

          • memory/4252-168-0x0000000002730000-0x0000000002731000-memory.dmp

            Filesize

            4KB