Windows Analysis Report
SenPalia.exe

Overview

General Information

Sample name: SenPalia.exe
Analysis ID: 1431412
MD5: 3c327cbf1db1396f027a78d968db2e90
SHA1: 416f02955dbbb66ec4eae89f3088db92cdeb9572
SHA256: a18106059f5438c0cb46c20aefd36a3cd7cbf4762a3d4ff2daa7312f4cbc7b79
Infos:

Detection

Score: 48
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Drops large PE files
Monitors registry run keys for changes
Contains capabilities to detect virtual machines
Drops PE files
Enables security privileges
Found dropped PE file which has not been started or loaded
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Startup Folder File Write
Stores files to the Windows start menu directory
Uses 32bit PE files

Classification

Uses 32bit PE files
Source: SenPalia.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: C:\Users\user\Desktop\SenPalia.exe Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\88c1452e-94d1-56de-ad34-3a975ddef9d7
Source: C:\Users\user\Desktop\SenPalia.exe File created: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\LICENSE.electron.txt
Source: C:\Users\user\Desktop\SenPalia.exe File created: C:\Users\user\AppData\Local\Programs\SenPalia\LICENSE.electron.txt
Source: SenPalia.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: C:\Users\user\Desktop\SenPalia.exe File opened: C:\Users\user
Source: C:\Users\user\Desktop\SenPalia.exe File opened: C:\Users\user\AppData\Local\Programs
Source: C:\Users\user\Desktop\SenPalia.exe File opened: C:\Users\user\AppData\Local\Programs\SenPalia
Source: C:\Users\user\Desktop\SenPalia.exe File opened: C:\Users\user\AppData\Local\Programs\SenPalia\SenPalia.exe
Source: C:\Users\user\Desktop\SenPalia.exe File opened: C:\Users\user\AppData
Source: C:\Users\user\Desktop\SenPalia.exe File opened: C:\Users\user\AppData\Local

System Summary
barindex
Drops large PE files
Source: C:\Users\user\Desktop\SenPalia.exe File dump: SenPalia.exe.1.dr 160076800 Jump to dropped file
Enables security privileges
Source: C:\Users\user\Desktop\SenPalia.exe Process token adjusted: Security
Uses 32bit PE files
Source: SenPalia.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: classification engine Classification label: mal48.winEXE@5/79@0/0
Source: C:\Users\user\Desktop\SenPalia.exe File created: C:\Users\user\AppData\Local\Programs
Source: C:\Windows\System32\Taskmgr.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\TM.750ce7b0-e5fd-454f-9fad-2f66513dfa1b
Source: C:\Users\user\Desktop\SenPalia.exe Mutant created: \Sessions\1\BaseNamedObjects\88c1452e-94d1-56de-ad34-3a975ddef9d7
Source: C:\Users\user\Desktop\SenPalia.exe File created: C:\Users\user\AppData\Local\Temp\nslEBB9.tmp
Source: SenPalia.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\SenPalia.exe File read: C:\Users\desktop.ini
Source: C:\Users\user\Desktop\SenPalia.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
Source: C:\Users\user\Desktop\SenPalia.exe File read: C:\Users\user\Desktop\SenPalia.exe
Source: unknown Process created: C:\Users\user\Desktop\SenPalia.exe "C:\Users\user\Desktop\SenPalia.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Programs\SenPalia\SenPalia.exe "C:\Users\user\AppData\Local\Programs\SenPalia\SenPalia.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Programs\SenPalia\SenPalia.exe "C:\Users\user\AppData\Local\Programs\SenPalia\SenPalia.exe"
Source: unknown Process created: C:\Windows\System32\Taskmgr.exe "C:\Windows\system32\taskmgr.exe" /4
Source: unknown Process created: C:\Windows\System32\Taskmgr.exe "C:\Windows\system32\taskmgr.exe" /4
Source: C:\Users\user\Desktop\SenPalia.exe Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\SenPalia.exe Section loaded: userenv.dll
Source: C:\Users\user\Desktop\SenPalia.exe Section loaded: apphelp.dll
Source: C:\Users\user\Desktop\SenPalia.exe Section loaded: propsys.dll
Source: C:\Users\user\Desktop\SenPalia.exe Section loaded: dwmapi.dll
Source: C:\Users\user\Desktop\SenPalia.exe Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\SenPalia.exe Section loaded: oleacc.dll
Source: C:\Users\user\Desktop\SenPalia.exe Section loaded: ntmarta.dll
Source: C:\Users\user\Desktop\SenPalia.exe Section loaded: version.dll
Source: C:\Users\user\Desktop\SenPalia.exe Section loaded: shfolder.dll
Source: C:\Users\user\Desktop\SenPalia.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\SenPalia.exe Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\SenPalia.exe Section loaded: wldp.dll
Source: C:\Users\user\Desktop\SenPalia.exe Section loaded: profapi.dll
Source: C:\Users\user\Desktop\SenPalia.exe Section loaded: riched20.dll
Source: C:\Users\user\Desktop\SenPalia.exe Section loaded: usp10.dll
Source: C:\Users\user\Desktop\SenPalia.exe Section loaded: msls31.dll
Source: C:\Users\user\Desktop\SenPalia.exe Section loaded: textshaping.dll
Source: C:\Users\user\Desktop\SenPalia.exe Section loaded: textinputframework.dll
Source: C:\Users\user\Desktop\SenPalia.exe Section loaded: coreuicomponents.dll
Source: C:\Users\user\Desktop\SenPalia.exe Section loaded: coremessaging.dll
Source: C:\Users\user\Desktop\SenPalia.exe Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\SenPalia.exe Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\SenPalia.exe Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\SenPalia.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Desktop\SenPalia.exe Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\Desktop\SenPalia.exe Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\SenPalia.exe Section loaded: ntshrui.dll
Source: C:\Users\user\Desktop\SenPalia.exe Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\SenPalia.exe Section loaded: linkinfo.dll
Source: C:\Users\user\Desktop\SenPalia.exe Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\SenPalia.exe Section loaded: cscapi.dll
Source: C:\Users\user\Desktop\SenPalia.exe Section loaded: sxs.dll
Source: C:\Users\user\Desktop\SenPalia.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\Desktop\SenPalia.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\Desktop\SenPalia.exe Section loaded: msasn1.dll
Source: C:\Users\user\Desktop\SenPalia.exe Section loaded: netutils.dll
Source: C:\Users\user\Desktop\SenPalia.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32
Source: C:\Windows\System32\Taskmgr.exe Window found: window name: SysTabControl32
Source: C:\Users\user\Desktop\SenPalia.exe Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\88c1452e-94d1-56de-ad34-3a975ddef9d7
Source: SenPalia.exe Static file information: File size 82609817 > 1048576
Source: SenPalia.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Drops PE files
Source: C:\Users\user\Desktop\SenPalia.exe File created: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\vulkan-1.dll Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe File created: C:\Users\user\AppData\Local\Programs\SenPalia\SenPalia.exe Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe File created: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\resources\elevate.exe Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe File created: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\SpiderBanner.dll Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe File created: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\ffmpeg.dll Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe File created: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\libEGL.dll Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe File created: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\libGLESv2.dll Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe File created: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\StdUtils.dll Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe File created: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\nsis7z.dll Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe File created: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\d3dcompiler_47.dll Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe File created: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\vk_swiftshader.dll Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe File created: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\System.dll Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe File created: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\LICENSE.electron.txt
Source: C:\Users\user\Desktop\SenPalia.exe File created: C:\Users\user\AppData\Local\Programs\SenPalia\LICENSE.electron.txt

Boot Survival
barindex
Monitors registry run keys for changes
Source: C:\Windows\System32\Taskmgr.exe Registry key monitored: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: C:\Windows\System32\Taskmgr.exe Registry key monitored: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Source: C:\Windows\System32\Taskmgr.exe Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Stores files to the Windows start menu directory
Source: C:\Users\user\Desktop\SenPalia.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SenPalia.lnk
Source: C:\Users\user\Desktop\SenPalia.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SenPalia.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SenPalia.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SenPalia.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SenPalia.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SenPalia.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Contains capabilities to detect virtual machines
Source: C:\Windows\System32\Taskmgr.exe File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\SenPalia.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\vulkan-1.dll Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\resources\elevate.exe Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\SpiderBanner.dll Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\ffmpeg.dll Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\libEGL.dll Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\libGLESv2.dll Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\StdUtils.dll Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\nsis7z.dll Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\d3dcompiler_47.dll Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\vk_swiftshader.dll Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\System.dll Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\SenPalia.exe File opened: C:\Users\user
Source: C:\Users\user\Desktop\SenPalia.exe File opened: C:\Users\user\AppData\Local\Programs
Source: C:\Users\user\Desktop\SenPalia.exe File opened: C:\Users\user\AppData\Local\Programs\SenPalia
Source: C:\Users\user\Desktop\SenPalia.exe File opened: C:\Users\user\AppData\Local\Programs\SenPalia\SenPalia.exe
Source: C:\Users\user\Desktop\SenPalia.exe File opened: C:\Users\user\AppData
Source: C:\Users\user\Desktop\SenPalia.exe File opened: C:\Users\user\AppData\Local
Source: C:\Users\user\Desktop\SenPalia.exe Process information queried: ProcessInformation
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Windows\System32\Taskmgr.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\Taskmgr.exe Queries volume information: C:\ProgramData\Microsoft\User Account Pictures\user.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exe Queries volume information: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Assets\SmallLogo.scale-100.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exe Queries volume information: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\AppListIcon.scale-100.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exe Queries volume information: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.scale-100.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exe Queries volume information: C:\Windows\System32\RuntimeBroker.exe VolumeInformation
Source: C:\Windows\System32\Taskmgr.exe Queries volume information: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\AppListIcon.scale-100.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exe Queries volume information: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Assets\SmallLogo.scale-100.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exe Queries volume information: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Assets\SquareLogo44x44.scale-100.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exe Queries volume information: C:\Windows\ImmersiveControlPanel\images\logo.scale-100.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exe Queries volume information: C:\Windows\ImmersiveControlPanel\images\logo.scale-100.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exe Queries volume information: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Assets\SquareLogo44x44.scale-100.png VolumeInformation
windows-stand
⊘No contacted IP infos