Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    49s
  • max time network
    50s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    05/09/2024, 23:04

Errors

Reason
Machine shutdown

General

  • Target

    Sena.exe

  • Size

    1.0MB

  • MD5

    9872c633ef83d043cfca1609c7668719

  • SHA1

    116579be25c526f3fb21620263467717e52db237

  • SHA256

    553cfbf1aec44f3baf003f3a095e9638d4c3ec4aa387e07cf64ff69601353306

  • SHA512

    93bc495d230f8198e573275c037db8b3487ef8cf1ae7029a01998018f4694e2a793bc9bc73e776e171870f0ac1ebbaf3a917ec8da5be235586569989dd0be0e1

  • SSDEEP

    24576:/EoScovLgGCJv+gy4xwpdvGzk+kKufpF:/UcoDTCBtxCdeQ+

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 7 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Sena.exe
    "C:\Users\Admin\AppData\Local\Temp\Sena.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4820
    • C:\Users\Admin\AppData\Local\Sena\bin\amide.exe
      "C:\Users\Admin\AppData\Local\Sena\bin\amide.exe" /BS Y7U0MNY4XSY7
      2⤵
      • Executes dropped EXE
      PID:4204
    • C:\Users\Admin\AppData\Local\Sena\bin\amide.exe
      "C:\Users\Admin\AppData\Local\Sena\bin\amide.exe" /CS CE68MTQ8LNML
      2⤵
      • Executes dropped EXE
      PID:3260
    • C:\Users\Admin\AppData\Local\Sena\bin\amide.exe
      "C:\Users\Admin\AppData\Local\Sena\bin\amide.exe" /SS 2SJ22S2AKG7L
      2⤵
      • Executes dropped EXE
      PID:3452
    • C:\Users\Admin\AppData\Local\Sena\bin\amide.exe
      "C:\Users\Admin\AppData\Local\Sena\bin\amide.exe" /SU AUTO
      2⤵
      • Executes dropped EXE
      PID:3628
    • C:\Users\Admin\AppData\Local\Sena\bin\volumeid.exe
      "C:\Users\Admin\AppData\Local\Sena\bin\volumeid.exe" C: 86C7-FAB2
      2⤵
      • Executes dropped EXE
      PID:4372
    • C:\Users\Admin\AppData\Local\Sena\bin\volumeid.exe
      "C:\Users\Admin\AppData\Local\Sena\bin\volumeid.exe" D: 13A7-3CCB
      2⤵
      • Executes dropped EXE
      PID:1600
    • C:\Users\Admin\AppData\Local\Sena\bin\volumeid.exe
      "C:\Users\Admin\AppData\Local\Sena\bin\volumeid.exe" F: E92A-FD83
      2⤵
      • Executes dropped EXE
      PID:4608
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x0 /state0:0xa3aef855 /state1:0x41c64e6d
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:716

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Sena\bin\amide.exe

    Filesize

    453KB

    MD5

    7f118633f542014d65ee13eb8d4f702a

    SHA1

    a59117813003390187a45eec4116337d5b695b09

    SHA256

    e27be45f00bce92b6f3c12e37723295e5a5959ecb8185f06028f3cfb88de3bb6

    SHA512

    cf004560d6e3ce5cbb142a91445427dce58199dd3d1a254d2ae6d2e41df709c90844edfe9eff711c0a042f05338d72588da25591149edfd90860a76e2b0c9ff8

  • C:\Users\Admin\AppData\Local\Sena\bin\volumeid.exe

    Filesize

    165KB

    MD5

    81a45f1a91448313b76d2e6d5308aa7a

    SHA1

    0d615343d5de03da03bce52e11b233093b404083

    SHA256

    fb0d02ea26bb1e5df5a07147931caf1ae3d7d1d9b4d83f168b678e7f3a1c0ecd

    SHA512

    675662f84dfcbf33311f5830db70bff50b6e8a34a4a926de6369c446ea2b1cf8a63e9c94e5a5c2e1d226248f0361a1698448f82118ac4de5a92b64d8fdf8815d

  • memory/4820-8-0x0000000010110000-0x0000000010176000-memory.dmp

    Filesize

    408KB

  • memory/4820-11-0x00000000734CE000-0x00000000734CF000-memory.dmp

    Filesize

    4KB

  • memory/4820-4-0x00000000734C0000-0x0000000073BAE000-memory.dmp

    Filesize

    6.9MB

  • memory/4820-5-0x000000000F0B0000-0x000000000F0B8000-memory.dmp

    Filesize

    32KB

  • memory/4820-6-0x00000000734C0000-0x0000000073BAE000-memory.dmp

    Filesize

    6.9MB

  • memory/4820-7-0x000000000F230000-0x000000000F268000-memory.dmp

    Filesize

    224KB

  • memory/4820-0-0x00000000734CE000-0x00000000734CF000-memory.dmp

    Filesize

    4KB

  • memory/4820-3-0x00000000734C0000-0x0000000073BAE000-memory.dmp

    Filesize

    6.9MB

  • memory/4820-12-0x00000000734C0000-0x0000000073BAE000-memory.dmp

    Filesize

    6.9MB

  • memory/4820-13-0x00000000734C0000-0x0000000073BAE000-memory.dmp

    Filesize

    6.9MB

  • memory/4820-14-0x00000000734C0000-0x0000000073BAE000-memory.dmp

    Filesize

    6.9MB

  • memory/4820-2-0x0000000007700000-0x00000000078FA000-memory.dmp

    Filesize

    2.0MB

  • memory/4820-1-0x0000000000860000-0x000000000096A000-memory.dmp

    Filesize

    1.0MB

  • memory/4820-30-0x00000000734C0000-0x0000000073BAE000-memory.dmp

    Filesize

    6.9MB