Edit tour

Windows Analysis Report
SenPalia.exe

Overview

General Information

Sample name:	SenPalia.exe
Analysis ID:	1431412
MD5:	3c327cbf1db1396f027a78d968db2e90
SHA1:	416f02955dbbb66ec4eae89f3088db92cdeb9572
SHA256:	a18106059f5438c0cb46c20aefd36a3cd7cbf4762a3d4ff2daa7312f4cbc7b79
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Drops large PE files

Monitors registry run keys for changes

Contains capabilities to detect virtual machines

Drops PE files

Enables security privileges

Found dropped PE file which has not been started or loaded

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Startup Folder File Write

Stores files to the Windows start menu directory

Uses 32bit PE files

Classification

Process Tree

System is w10x64_ra

SenPalia.exe (PID: 6504 cmdline: "C:\Users\user\Desktop\SenPalia.exe" MD5: 3C327CBF1DB1396F027A78D968DB2E90)

SenPalia.exe (PID: 5960 cmdline: "C:\Users\user\AppData\Local\Programs\SenPalia\SenPalia.exe" MD5: 021569D2490415EF5C3003ACD35CF809)

SenPalia.exe (PID: 1732 cmdline: "C:\Users\user\AppData\Local\Programs\SenPalia\SenPalia.exe" MD5: 021569D2490415EF5C3003ACD35CF809)

Taskmgr.exe (PID: 7080 cmdline: "C:\Windows\system32\taskmgr.exe" /4 MD5: 58D5BC7895F7F32EE308E34F06F25DD5)

Taskmgr.exe (PID: 3940 cmdline: "C:\Windows\system32\taskmgr.exe" /4 MD5: 58D5BC7895F7F32EE308E34F06F25DD5)

cleanup

Sigma Signatures

System Summary

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\SenPalia.exe, ProcessId: 6504, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SenPalia.lnk

Source: C:\Users\user\Desktop\SenPalia.exe	File created: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\LICENSE.electron.txt
Source: C:\Users\user\Desktop\SenPalia.exe	File created: C:\Users\user\AppData\Local\Programs\SenPalia\LICENSE.electron.txt

Source: C:\Users\user\Desktop\SenPalia.exe	File opened: C:\Users\user
Source: C:\Users\user\Desktop\SenPalia.exe	File opened: C:\Users\user\AppData\Local\Programs
Source: C:\Users\user\Desktop\SenPalia.exe	File opened: C:\Users\user\AppData\Local\Programs\SenPalia
Source: C:\Users\user\Desktop\SenPalia.exe	File opened: C:\Users\user\AppData\Local\Programs\SenPalia\SenPalia.exe
Source: C:\Users\user\Desktop\SenPalia.exe	File opened: C:\Users\user\AppData
Source: C:\Users\user\Desktop\SenPalia.exe	File opened: C:\Users\user\AppData\Local

Source: C:\Windows\System32\Taskmgr.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\TM.750ce7b0-e5fd-454f-9fad-2f66513dfa1b
Source: C:\Users\user\Desktop\SenPalia.exe	Mutant created: \Sessions\1\BaseNamedObjects\88c1452e-94d1-56de-ad34-3a975ddef9d7

Source: unknown	Process created: C:\Users\user\Desktop\SenPalia.exe "C:\Users\user\Desktop\SenPalia.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Programs\SenPalia\SenPalia.exe "C:\Users\user\AppData\Local\Programs\SenPalia\SenPalia.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Programs\SenPalia\SenPalia.exe "C:\Users\user\AppData\Local\Programs\SenPalia\SenPalia.exe"
Source: unknown	Process created: C:\Windows\System32\Taskmgr.exe "C:\Windows\system32\taskmgr.exe" /4
Source: unknown	Process created: C:\Windows\System32\Taskmgr.exe "C:\Windows\system32\taskmgr.exe" /4

Source: C:\Users\user\Desktop\SenPalia.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\SenPalia.exe	Section loaded: userenv.dll
Source: C:\Users\user\Desktop\SenPalia.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Desktop\SenPalia.exe	Section loaded: propsys.dll
Source: C:\Users\user\Desktop\SenPalia.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\Desktop\SenPalia.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\SenPalia.exe	Section loaded: oleacc.dll
Source: C:\Users\user\Desktop\SenPalia.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Desktop\SenPalia.exe	Section loaded: version.dll
Source: C:\Users\user\Desktop\SenPalia.exe	Section loaded: shfolder.dll
Source: C:\Users\user\Desktop\SenPalia.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\SenPalia.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\SenPalia.exe	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\SenPalia.exe	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\SenPalia.exe	Section loaded: riched20.dll
Source: C:\Users\user\Desktop\SenPalia.exe	Section loaded: usp10.dll
Source: C:\Users\user\Desktop\SenPalia.exe	Section loaded: msls31.dll
Source: C:\Users\user\Desktop\SenPalia.exe	Section loaded: textshaping.dll
Source: C:\Users\user\Desktop\SenPalia.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\Desktop\SenPalia.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Desktop\SenPalia.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Desktop\SenPalia.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\SenPalia.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\SenPalia.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\SenPalia.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Desktop\SenPalia.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\Desktop\SenPalia.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\SenPalia.exe	Section loaded: ntshrui.dll
Source: C:\Users\user\Desktop\SenPalia.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\SenPalia.exe	Section loaded: linkinfo.dll
Source: C:\Users\user\Desktop\SenPalia.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\SenPalia.exe	Section loaded: cscapi.dll
Source: C:\Users\user\Desktop\SenPalia.exe	Section loaded: sxs.dll
Source: C:\Users\user\Desktop\SenPalia.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\Desktop\SenPalia.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\Desktop\SenPalia.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Desktop\SenPalia.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\SenPalia.exe	File created: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe	File created: C:\Users\user\AppData\Local\Programs\SenPalia\SenPalia.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe	File created: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\resources\elevate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe	File created: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\SpiderBanner.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe	File created: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\ffmpeg.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe	File created: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\libEGL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe	File created: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe	File created: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\StdUtils.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe	File created: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\nsis7z.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe	File created: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe	File created: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe	File created: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\System.dll	Jump to dropped file

Source: C:\Windows\System32\Taskmgr.exe	Registry key monitored: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: C:\Windows\System32\Taskmgr.exe	Registry key monitored: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Source: C:\Windows\System32\Taskmgr.exe	Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Source: C:\Users\user\Desktop\SenPalia.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SenPalia.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SenPalia.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SenPalia.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SenPalia.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SenPalia.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\SenPalia.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\resources\elevate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\SpiderBanner.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\ffmpeg.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\libEGL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\StdUtils.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\nsis7z.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SenPalia.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\System.dll	Jump to dropped file

Source: C:\Windows\System32\Taskmgr.exe	Queries volume information: C:\ProgramData\Microsoft\User Account Pictures\user.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exe	Queries volume information: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Assets\SmallLogo.scale-100.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exe	Queries volume information: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\AppListIcon.scale-100.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exe	Queries volume information: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.scale-100.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exe	Queries volume information: C:\Windows\System32\RuntimeBroker.exe VolumeInformation
Source: C:\Windows\System32\Taskmgr.exe	Queries volume information: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\AppListIcon.scale-100.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exe	Queries volume information: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Assets\SmallLogo.scale-100.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exe	Queries volume information: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Assets\SquareLogo44x44.scale-100.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exe	Queries volume information: C:\Windows\ImmersiveControlPanel\images\logo.scale-100.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exe	Queries volume information: C:\Windows\ImmersiveControlPanel\images\logo.scale-100.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exe	Queries volume information: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Assets\SquareLogo44x44.scale-100.png VolumeInformation

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Windows Service	1 Windows Service	1 Masquerading	OS Credential Dumping	1 Query Registry	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Process Injection	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	1 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	22 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\d3dcompiler_47.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\d3dcompiler_47.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\ffmpeg.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\ffmpeg.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\libEGL.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\libEGL.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\libGLESv2.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\libGLESv2.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\resources\elevate.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\resources\elevate.exe	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\SpiderBanner.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\SpiderBanner.dll	1%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\StdUtils.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\StdUtils.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\System.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\nsis7z.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\nsis7z.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Programs\SenPalia\SenPalia.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SenPalia\SenPalia.exe	1%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\vk_swiftshader.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\vk_swiftshader.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\vulkan-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\vulkan-1.dll	0%	Virustotal	Browse

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431412
Start date and time:	2024-04-25 02:38:26 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	EGA enabled
Analysis Mode:	stream
Sample name:	SenPalia.exe
Detection:	MAL
Classification:	mal48.winEXE@5/79@0/0
Cookbook Comments:	Found application associated with file extension: .exe

Process:	C:\Windows\System32\Taskmgr.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:
MD5:	F49655F856ACB8884CC0ACE29216F511
SHA1:	CB0F1F87EC0455EC349AAA950C600475AC7B7B6B
SHA-256:	7852FCE59C67DDF1D6B8B997EAA1ADFAC004A9F3A91C37295DE9223674011FBA
SHA-512:	599E93D25B174524495ED29653052B3590133096404873318F05FD68F4C9A5C9A3B30574551141FBB73D7329D6BE342699A17F3AE84554BAB784776DFDA2D5F8
Malicious:	false
Reputation:	unknown
Preview:	EERF

Process:	C:\Users\user\Desktop\SenPalia.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	160076800
Entropy (8bit):	6.743926324302017
Encrypted:	false
SSDEEP:
MD5:	021569D2490415EF5C3003ACD35CF809
SHA1:	780B132C2472298E8FC6F2DC2A67B460D8447515
SHA-256:	E5FC14829988EFB8A9E360D3484DC7E12263B81D479D21FA7CED4C3F482CD6E1
SHA-512:	B474877291EBA3C8A3512681D719E5DA6C97FDEA132A706B8FB548EF8E91C756F1FD6B3E27F1591DC08D3D2562CC65DB9F8BAD3AB88CA62E333CDFF07866B72F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........."......0...4.......F.........@..........................................`...........................................+.. ..0"..h............Pt.._@..........0.......!.......................!.(... Q..@...........@8......`.*......................text...:/.......0.................. ..`.rdata..h.n..@....n..4..............@..@.data....TB...1.......1.............@....pdata..._@..Pt..`@...9.............@..@.00cfg..0.............z.............@..@.gxfg...pA.......B....z.............@..@.retplne.............Dz..................rodata...... .......Fz............. ..`.tls.........@.......Xz.............@...CPADinfo8....P.......\z.............@...LZMADEC......`.......^z............. ..`_RDATA..\............pz.............@..@malloc_h+............rz............. ..`.rsrc................xz.............@..@.reloc......0........{.............@..B................

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.99998046750478
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SenPalia.exe
File size:	82'609'817 bytes
MD5:	3c327cbf1db1396f027a78d968db2e90
SHA1:	416f02955dbbb66ec4eae89f3088db92cdeb9572
SHA256:	a18106059f5438c0cb46c20aefd36a3cd7cbf4762a3d4ff2daa7312f4cbc7b79
SHA512:	62a03e4ec802165a1ebaf54263b8034cf9dc851587313b8452d92f96265d7d93f1e84e03256f5a3294e55ac3b77a83489c3bef26add12fcee60cf442f16284ed
SSDEEP:	1572864:bK6LBYIm4dmYQxwJqZHBFdNYZvpXm6IKEX:bBu/pRxmqzFC3IKE
TLSH:	74083337064A3619F06A33FA7A7D3EFFE93CC54017A525F36C8656828C918E3685C46E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L......\.................h...8...@.

Entrypoint:	0x40338f
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5C157F86 [Sat Dec 15 22:26:14 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b34f154ec913d2d2c435cbd644e91687

Signature Valid:	false
Signature Issuer:	CN=Microsoft Code Signing PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	12/05/2022 22:45:59 11/05/2023 22:45:59
Subject Chain	CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Version:	3
Thumbprint MD5:	EAF99B1CDFF361CB066EC1CDB5FD68ED
Thumbprint SHA-1:	F372C27F6E052A6BE8BAB3112B465C692196CD6F
Thumbprint SHA-256:	6DFB94C073BA075667FCC19AB327AE679D84F2A2BCF76CC21ABFC9B93FEE61A5
Serial:	33000002CBB77539FB027142360000000002CB

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8610	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x19f000	0x5950	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x4ec5ee1	0x27b8
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6627	0x6800	7618d4c0cd8bb67ea9595b4266b3a91f	False	0.6646259014423077	data	6.450282348506287	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x14a2	0x1600	eecac1fed9cc6b447d50940d178404d8	False	0.4405184659090909	data	5.025178929113415	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x70ff8	0x600	db8f31a08a2242d80c29e1f9500c6527	False	0.5182291666666666	data	4.037117731448378	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x7b000	0x124000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x19f000	0x5950	0x5a00	614f0031e4aea066f42c764eeb7171d8	False	0.4947048611111111	data	5.4481428907191125	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SenPalia.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

Compliance

Spreading

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Created / dropped Files

C:\Users\user\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

C:\Users\user\AppData\Local\Programs\SenPalia\SenPalia.exe

C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\LICENSE.electron.txt

C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\LICENSES.chromium.html

C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\chrome_100_percent.pak

C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\chrome_200_percent.pak

C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\d3dcompiler_47.dll

C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\ffmpeg.dll

C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\icudtl.dat

C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\libEGL.dll

C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\libGLESv2.dll

C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\af.pak

C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\am.pak

C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\ar.pak

C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\bg.pak

C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\bn.pak

C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\ca.pak

C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\cs.pak

C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\da.pak

C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\de.pak

C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\el.pak

C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\en-GB.pak

C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\en-US.pak

C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\es-419.pak

C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\es.pak

C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\et.pak

C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\fa.pak

C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\fi.pak

C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\fil.pak

C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\fr.pak

C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\gu.pak

C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\he.pak

C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\hi.pak

C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\hr.pak

C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\hu.pak

C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\id.pak

C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\it.pak

C:\Users\user\AppData\Local\Temp\nsgECD3.tmp\7z-out\locales\ja.pak

Windows Analysis Report
SenPalia.exe

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x19f5c8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.7213883677298312
RT_ICON	0x1a0670	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688, 256 important colors	English	United States	0.6751066098081023
RT_ICON	0x1a1518	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152, 256 important colors	English	United States	0.7851985559566786
RT_ICON	0x1a1dc0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320, 256 important colors	English	United States	0.6560693641618497
RT_ICON	0x1a2328	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.8031914893617021
RT_ICON	0x1a2790	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.3118279569892473
RT_ICON	0x1a2a78	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.36824324324324326
RT_DIALOG	0x1a2ba0	0x202	data	English	United States	0.4085603112840467
RT_DIALOG	0x1a2da8	0xf8	data	English	United States	0.6290322580645161
RT_DIALOG	0x1a2ea0	0xee	data	English	United States	0.6260504201680672
RT_DIALOG	0x1a2f90	0x1fa	data	English	United States	0.40118577075098816
RT_DIALOG	0x1a3190	0xf0	data	English	United States	0.6666666666666666
RT_DIALOG	0x1a3280	0xe6	data	English	United States	0.6565217391304348
RT_DIALOG	0x1a3368	0x1ee	data	English	United States	0.38866396761133604
RT_DIALOG	0x1a3558	0xe4	data	English	United States	0.6447368421052632
RT_DIALOG	0x1a3640	0xda	data	English	United States	0.6422018348623854
RT_DIALOG	0x1a3720	0x1ee	data	English	United States	0.3866396761133603
RT_DIALOG	0x1a3910	0xe4	data	English	United States	0.6359649122807017
RT_DIALOG	0x1a39f8	0xda	data	English	United States	0.6376146788990825
RT_DIALOG	0x1a3ad8	0x1f2	data	English	United States	0.39759036144578314
RT_DIALOG	0x1a3cd0	0xe8	data	English	United States	0.6508620689655172
RT_DIALOG	0x1a3db8	0xde	data	English	United States	0.6486486486486487
RT_DIALOG	0x1a3e98	0x202	data	English	United States	0.42217898832684825
RT_DIALOG	0x1a40a0	0xf8	data	English	United States	0.6653225806451613
RT_DIALOG	0x1a4198	0xee	data	English	United States	0.6512605042016807
RT_GROUP_ICON	0x1a4288	0x68	data	English	United States	0.6634615384615384
RT_VERSION	0x1a42f0	0x234	data	English	United States	0.4787234042553192
RT_MANIFEST	0x1a4528	0x423	XML 1.0 document, ASCII text, with very long lines (1059), with no line terminators	English	United States	0.5127478753541076

DLL	Import
KERNEL32.dll	SetEnvironmentVariableW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, SetCurrentDirectoryW, GetFileAttributesW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, ExitProcess, GetShortPathNameW, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalLock, GlobalUnlock, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre