hxxps://eprst251[.]boo/files/Asana[.]msix

Analysis

max time kernel
194s
max time network
128s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 19:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://eprst251.boo/files/Asana.msix

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420754807"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DA521311-07F3-11EF-A2CF-6EE901CCE9B5} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0bf12b1009cda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000009c11070d4f90c03f408bf555b3fa45b9f5dbdd731a00e0ea04fa2518593d0717000000000e80000000020000200000007cc0731a5b77a8c1067467cd7f8c87b20b24b501475d75fac020e858be0e7c3890000000c16955b7509dfafe0bd9e1998522d8cc4eb43170245e039e3d96ac9ccfd0c5d6d2cc9eaf8626e235925db15215fb872a0420992624fa1b4b0c1022f6befdbc7d3dca315a8ca43d29953b8bb84326e7d4f91545453b0ab0702c163a0b89d5b5bd055b3acf8f99f6a7a1db12521d6226184f887c2d243e103354e465daee06a062de5c83bd7014272318ad0b1907978273400000008fbd73766b8596c8b8cc706346a928721290c8e8a7c650cd3fd167e57852e6e9dd6182346825ae81dbb13e9d8d0e35c86caa05d12726cd9f2105fab5dbf60480	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000274977da282cb407a0e282e393832714b6d520a4086980096d2d40513a6c7422000000000e8000000002000020000000c9ae2fb36cdf057f0f77d59f2e988dfa08dc0ed4172456af3a4767bfa5e8e9732000000068308ee142cacf88701617ab5dd70dee36671e087a477d4cc9ff8c91690bdc5c40000000df45d35f762dbca54dd92b53d68624cbf262ed2c5a618b40c3ecd00b7e111fb4749d7576fea528044496697e1db04882a79e00409ab70291735c7c49e63e350c	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2404	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2404	iexplore.exe
2404	iexplore.exe
1028	IEXPLORE.EXE
1028	IEXPLORE.EXE
1028	IEXPLORE.EXE
1028	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 1028	2404	iexplore.exe	28
PID 2404 wrote to memory of 1028	2404	iexplore.exe	28
PID 2404 wrote to memory of 1028	2404	iexplore.exe	28
PID 2404 wrote to memory of 1028	2404	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://eprst251.boo/files/Asana.msix
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2404 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5036e949c8d07471b6c784fc282fa069

SHA1
6fa9f6b69f02039a1a6c36dd4e2e30998c87fde9

SHA256
050eabd1066cff4ac03332655534888689ada207548f2d668b4d49ee6c562602

SHA512
0b39a14c64fe793eb2e99a798f5b492591e06602ca86432e28299d6701b9140513559f148dafb28a4eec0dea46eb3700f89f165dad72e795ba8aeda4ca740eb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e512944e771c86b74d19dd35ebc8a575

SHA1
b3bc572f3d1a41a6ae1a050311674794fed74123

SHA256
7b6631d02fc5560524ebe644e735b7fcc3995d23299756a692e6076898f69f5a

SHA512
fa82cf09374d6bbbe711ad28a66082adbfa44c64dc154517c141981def4f56981c76133f79aef9aa83008af885f371da3106039c92f8ab5167f9da5774c09e59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09dc01d95156fc690ecf3497e5d9d79f

SHA1
db1d11327f1628792beea8811c82401f818db696

SHA256
663106a1ff50402609a553bd620405e54f98d95772861288913863de6dd74a4c

SHA512
b97e1f72aea8315e3ca965589a5a5ab5d3e0648d4e8e6e7d340d18cd44c2b1780cecfa52a29a58154196b6d7a1cd45f3f229a9004a72f4e1bb9ab6c6a0b7b1a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc02beb43a114ed30260350bbaef1918

SHA1
14a7e253dd83a9a8a5e33fab81caa57ec1a8a3fa

SHA256
582e04b0b0f937867ffb6e1a0fd3faef4ae277e64cb3adb55cad6dcc03dedd96

SHA512
b776df69111235110b1f1732ba0787192216dac39905e84c751d051ac54c4a05477cd4f0f4e858055842af5f9a98abadab2e5a5b82df2bafd90dc22590ab1b13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23f3bef5c5f27e732ae5e7ac7682dfe9

SHA1
b482c7d856e51501acd658299ba7c37fa7470830

SHA256
35558c6a87446de7ac0a0e3adfd0cc941cc42cfddefaed083df761b09ca04f31

SHA512
599c13344670b740c6295295aac51296f3bcde656d9df3b4f56ead5b4203eabceb8977afe257d5488384556ce0d0643234df5252533b11cfeacf81d3f6ab039a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a8e2b20fc2422a65ce7b7f4cc3a8e11

SHA1
71ad5efd92a099c8b31c0f4719f5b59a5ebc1e29

SHA256
6d6be9f5e7c2d2d6bb26f9660efdb79eb6b20bf627d0d358f7600c1b23f1f753

SHA512
7e310dcc5e382c1d25d0c6d99bdf6be2a1437f2bfbfb8fe9d43ad02e52d16859f8bbe9ed8b2f5f5b06e68d35fd9c91c7c480bb4c1658ff8e173bf93adba6780a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c3f532d97d60ed982dc43d36b2c9aee

SHA1
b2f68234d28f1918843b337025e5891cf8fc4284

SHA256
5fe4c791b134eab4ff711d78eeb63fee4e68a834608da24227c5f6902fc6e5af

SHA512
258c7769e4064326a36101190da960ef7ff2c36da0004cdc488ad46c5338dcb061b18e0a7f2bd375441e6a430d43421ffc9cce57b69f887b151053bcdb8eb6e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02b98bf010172b79000345fa3bf0b676

SHA1
9a2ea247cfbb70dc1788f88dda023eaa7bc49b08

SHA256
d510165c4a20508eb54c7493503a9fd72db447dc55bb9f3257015886c05a9989

SHA512
8ebb9e04c5e859172660ebe1b30cc75f09e9abdf0538736f634bfdf3532365383aaa29fc2cf7ddb1c0951aa81332a65e9fb35a8e41f7577347f85a10756d9c23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de2dfca028d1939ab9a3bed07b23a8b1

SHA1
35ebd1dc8642c260b3f8255bed75ef4ca51c26c7

SHA256
c8e52e07058dd874aeac89acaaf5995ce6312f477fb27d0ba2db26af38c20d1b

SHA512
02e6d59cb54a58a080e12dc5ece9299f7c0756f012b8e09e2b2ea18cd901b8f5a250b948a649651cfa528fb3e7b70306d00390440956101775eba9cbf7f5250f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d04c5440cb0713b9235bca8a7fcf01ad

SHA1
6a65a4b01a731e99f3a1694a77c0675ce52b6b89

SHA256
fae20ca386a6c0a81e60125d22bf665478fa205897f9c5197da6b1ab4b1b930e

SHA512
b30e81db844a94ab3a102dcd26a17957e5ac83e77848afcdc13c3d219a71035e4a7e5e6f090b2c10d2dd0b019aca5ac5b3ea1a4d7e928a4070d131674e0f97ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fccbb00bb15833daf8854a611476ef09

SHA1
23326792991f70e4941b7a5c3cba9b953d2ef2ac

SHA256
b81cc79e908d6e40f3745c77532df68a7bac53d9f1cbc30b074b40a058d6a172

SHA512
4245cd52d5aebfffd6e93809fe59ee764f7cb53c500e477f2dcd977d02d81b7d1753a16c4a84e87cc9b27a9e62eaef44981dc54861d15a5f980fd12ff5be4142

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1dcf76768f1b4d5296fb1753d3c267de

SHA1
7f76ce556efa1723e5c32b74caab4135861fee57

SHA256
8a84df024683595b43faa573e134ee00a1cf8141ee714caa5548132faa7e323f

SHA512
a6d1b5e1f0303bc60e4a1f36a5cb547c47ec946eb86f3eb2c2f20cf9cfa9590b9bace37e18af493aedea6971c6c62d7eeaa00bd9f8ff80576d5c09470c8565b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64818b92d1198a30b6f85787fffc3262

SHA1
0adadbeedb68bf3ccb1ff0ed9f4d99bb09509704

SHA256
6bbc9037699f4e5957d3984ee0cc751f614552e067b1515ae4c8c64fd2d53d4e

SHA512
b1731090312e65353bc003c3af64afe2de4d12b3c0dc2e50be56863bdf72983e9141c79dc28fecb05aebf4a8e822ada3700ba70f076f83164773130c4e8f96e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d658d4ee32713437e0f8b37da66ecad3

SHA1
731557ee7b43f2e031a5081f8b713b29d021634a

SHA256
a09682f215e1859d11cb96734e8d7e632a4d352443a590c993f71fc1523e5bec

SHA512
707592ad381607ff3b45b254838f54990b4c058174ee13e1a74b4f1c207985a843bbe526d439a3311123cd486bb140a71467a4e0c1ba70ab9ef9c488fec61562

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a05a98212990c663d9b993a563a5ca35

SHA1
56ad0bc02b2457c1da016748c7b5dd2b6999e164

SHA256
9112e12cba9ed13f3a7d148033d68bee41756427ae5961576fd818e3d4dbca95

SHA512
c3e9bb92e539d60ff33ca9653cf831aaa99a53e3f576d0ec6b19d6b32b5c6fe3e176b1efa95a3416d2b9ff63f17fb653c58173f8d001db2b6d315f93ca95428a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f50431034adb8718bc55c62aaac4a639

SHA1
5bade8a9a09bef5fa2e2b3b116636ce4f747384b

SHA256
5fcf926fcda59751ad4856dc786cd6ac033abfd2bf9afab1eb3afe599917c87c

SHA512
02f84f4b4f41018d531dc8be3a509aeb788a40fd2004adc50cd26dcf41f8687d60bf03f037787026a7c0836cfd6ff610b309d337616b9392737366379cd4deac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab34A8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar35DA.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit