Overview

overview

6

Static

static

3

asana.exe

windows10-1703-x64

6

asana.exe

windows10-2004-x64

6

asana.exe

windows11-21h2-x64

6

Analysis

  • max time kernel
    507s
  • max time network
    1169s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-05-2024 00:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    asana.exe

  • Size

    3.2MB

  • MD5

    2408793d1e1f472d8359f78ae912d591

  • SHA1

    1c8a7615e4f5a912d0b2d5fd6dc95cadc86d2d7b

  • SHA256

    31bb59e8e526d3f2ead73e4d240b20f5618699fadedadf50f6218e2c205dedbe

  • SHA512

    d531ccfd99813de8c9dc21473b9a8e189c539e87be0be428eb4884e69834486369269e979da8b27616ffdcacf479e4a65b6285eaaa024da0d1abf4187e5b22cc

  • SSDEEP

    49152:hI9+2qYtQ/Rg2ECNUg2I7wUpEroPeeegawQTCIyVM8OoJNW:mg21t0q2ECNURoPblawXIyXOoC

Score
6/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\asana.exe
    "C:\Users\Admin\AppData\Local\Temp\asana.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3120
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Suspicious use of AdjustPrivilegeToken
    PID:5004

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3120-0-0x00000000023B0000-0x00000000023B1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3120-1-0x0000000000400000-0x000000000073E000-memory.dmp
    Filesize

    3.2MB

    Download