553cfbf1aec44f3baf003f3a095e9638d4c3ec4aa387e07cf64ff69601353306

Analysis

max time kernel
49s
max time network
50s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
05/09/2024, 23:04

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Sena.exe
Size

1.0MB
MD5

9872c633ef83d043cfca1609c7668719
SHA1

116579be25c526f3fb21620263467717e52db237
SHA256

553cfbf1aec44f3baf003f3a095e9638d4c3ec4aa387e07cf64ff69601353306
SHA512

93bc495d230f8198e573275c037db8b3487ef8cf1ae7029a01998018f4694e2a793bc9bc73e776e171870f0ac1ebbaf3a917ec8da5be235586569989dd0be0e1
SSDEEP

24576:/EoScovLgGCJv+gy4xwpdvGzk+kKufpF:/UcoDTCBtxCdeQ+

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 7 IoCs

pid	Process
4204	amide.exe
3260	amide.exe
3452	amide.exe
3628	amide.exe
4372	volumeid.exe
1600	volumeid.exe
4608	volumeid.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sena.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1"	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe
4820	Sena.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
624	Process not Found
624	Process not Found
624	Process not Found
624	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4820	Sena.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
716	LogonUI.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 4204	4820	Sena.exe	75
PID 4820 wrote to memory of 4204	4820	Sena.exe	75
PID 4820 wrote to memory of 3260	4820	Sena.exe	77
PID 4820 wrote to memory of 3260	4820	Sena.exe	77
PID 4820 wrote to memory of 3452	4820	Sena.exe	79
PID 4820 wrote to memory of 3452	4820	Sena.exe	79
PID 4820 wrote to memory of 3628	4820	Sena.exe	81
PID 4820 wrote to memory of 3628	4820	Sena.exe	81
PID 4820 wrote to memory of 4372	4820	Sena.exe	83
PID 4820 wrote to memory of 4372	4820	Sena.exe	83
PID 4820 wrote to memory of 1600	4820	Sena.exe	85
PID 4820 wrote to memory of 1600	4820	Sena.exe	85
PID 4820 wrote to memory of 4608	4820	Sena.exe	87
PID 4820 wrote to memory of 4608	4820	Sena.exe	87

C:\Users\Admin\AppData\Local\Temp\Sena.exe
"C:\Users\Admin\AppData\Local\Temp\Sena.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Users\Admin\AppData\Local\Sena\bin\amide.exe
  "C:\Users\Admin\AppData\Local\Sena\bin\amide.exe" /BS Y7U0MNY4XSY7
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Users\Admin\AppData\Local\Sena\bin\amide.exe
  "C:\Users\Admin\AppData\Local\Sena\bin\amide.exe" /CS CE68MTQ8LNML
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Users\Admin\AppData\Local\Sena\bin\amide.exe
  "C:\Users\Admin\AppData\Local\Sena\bin\amide.exe" /SS 2SJ22S2AKG7L
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Users\Admin\AppData\Local\Sena\bin\amide.exe
  "C:\Users\Admin\AppData\Local\Sena\bin\amide.exe" /SU AUTO
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Users\Admin\AppData\Local\Sena\bin\volumeid.exe
  "C:\Users\Admin\AppData\Local\Sena\bin\volumeid.exe" C: 86C7-FAB2
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Users\Admin\AppData\Local\Sena\bin\volumeid.exe
  "C:\Users\Admin\AppData\Local\Sena\bin\volumeid.exe" D: 13A7-3CCB
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Users\Admin\AppData\Local\Sena\bin\volumeid.exe
  "C:\Users\Admin\AppData\Local\Sena\bin\volumeid.exe" F: E92A-FD83
  2⤵
  - Executes dropped EXE
  PID:4608

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3aef855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Sena\bin\amide.exe

Filesize
453KB

MD5
7f118633f542014d65ee13eb8d4f702a

SHA1
a59117813003390187a45eec4116337d5b695b09

SHA256
e27be45f00bce92b6f3c12e37723295e5a5959ecb8185f06028f3cfb88de3bb6

SHA512
cf004560d6e3ce5cbb142a91445427dce58199dd3d1a254d2ae6d2e41df709c90844edfe9eff711c0a042f05338d72588da25591149edfd90860a76e2b0c9ff8

Download Submit
C:\Users\Admin\AppData\Local\Sena\bin\volumeid.exe

Filesize
165KB

MD5
81a45f1a91448313b76d2e6d5308aa7a

SHA1
0d615343d5de03da03bce52e11b233093b404083

SHA256
fb0d02ea26bb1e5df5a07147931caf1ae3d7d1d9b4d83f168b678e7f3a1c0ecd

SHA512
675662f84dfcbf33311f5830db70bff50b6e8a34a4a926de6369c446ea2b1cf8a63e9c94e5a5c2e1d226248f0361a1698448f82118ac4de5a92b64d8fdf8815d

Download Submit
memory/4820-8-0x0000000010110000-0x0000000010176000-memory.dmp

Filesize
408KB

Download
memory/4820-11-0x00000000734CE000-0x00000000734CF000-memory.dmp

Filesize
4KB

Download
memory/4820-4-0x00000000734C0000-0x0000000073BAE000-memory.dmp

Filesize
6.9MB

Download
memory/4820-5-0x000000000F0B0000-0x000000000F0B8000-memory.dmp

Filesize
32KB

Download
memory/4820-6-0x00000000734C0000-0x0000000073BAE000-memory.dmp

Filesize
6.9MB

Download
memory/4820-7-0x000000000F230000-0x000000000F268000-memory.dmp

Filesize
224KB

Download
memory/4820-0-0x00000000734CE000-0x00000000734CF000-memory.dmp

Filesize
4KB

Download
memory/4820-3-0x00000000734C0000-0x0000000073BAE000-memory.dmp

Filesize
6.9MB

Download
memory/4820-12-0x00000000734C0000-0x0000000073BAE000-memory.dmp

Filesize
6.9MB

Download
memory/4820-13-0x00000000734C0000-0x0000000073BAE000-memory.dmp

Filesize
6.9MB

Download
memory/4820-14-0x00000000734C0000-0x0000000073BAE000-memory.dmp

Filesize
6.9MB

Download
memory/4820-2-0x0000000007700000-0x00000000078FA000-memory.dmp

Filesize
2.0MB

Download
memory/4820-1-0x0000000000860000-0x000000000096A000-memory.dmp

Filesize
1.0MB

Download
memory/4820-30-0x00000000734C0000-0x0000000073BAE000-memory.dmp

Filesize
6.9MB

Download