e5d04853d987aaf6e91c6b9cf448d26ba87320896075929e2fb3c6fa84f07c45

Analysis

max time kernel
105s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
15-09-2022 06:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SmiEngine.dll
Size

838KB
MD5

69ed55c744a56399f484d9839e0d32ec
SHA1

26f406046c1aa053c7e8722b393552e8fec2ad3a
SHA256

a4198ebdd59f7289878db4022914b6fc6c240d416b6f72028a8b6ee7e6be224a
SHA512

2f8ab7daeead979fe8abe085d92ced4d7f878c567a414e9a27fccce5d10d719dfdbe031a72831e1571a431325b69875100865caa864b849a0ec8873a3b15a810
SSDEEP

24576:qRru/5pzpV1VJJgDMMTEE37a111vjkAzJ85VK:XHvJQR3m9YAzK5VK

Score

8^/10

persistence

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9F7D7BB5-20B3-11DA-81A5-0030F1642E3C}\InprocServer32	regsvr32.exe

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{90A45ABD-2C77-11D9-BDF0-000874CD1BAE}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{90A45ABD-2C77-11D9-BDF0-000874CD1BAE}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9F7D7BB5-20B3-11DA-81A5-0030F1642E3C}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9F7D7BB5-20B3-11DA-81A5-0030F1642E3C}\ProgId	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wcm.SettingsEngine\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wcm.SettingsEngine\ = "SMI Settings Engine"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{90A45ABD-2C77-11D9-BDF0-000874CD1BAE}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SmiEngine.dll\\1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{90A45ABD-2C77-11D9-BDF0-000874CD1BAE}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SmiEngine.dll\\"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9F7D7BB5-20B3-11DA-81A5-0030F1642E3C}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wcm.SettingsEngine	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wcm.SettingsEngine\CLSID\ = "{9F7D7BB5-20B3-11DA-81A5-0030F1642E3C}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{90A45ABD-2C77-11D9-BDF0-000874CD1BAE}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9F7D7BB5-20B3-11DA-81A5-0030F1642E3C}\InprocHandler32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{90A45ABD-2C77-11D9-BDF0-000874CD1BAE}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{90A45ABD-2C77-11D9-BDF0-000874CD1BAE}\1.0\ = "Settings Management Infrastructure Library for Private Use"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{90A45ABD-2C77-11D9-BDF0-000874CD1BAE}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{90A45ABD-2C77-11D9-BDF0-000874CD1BAE}\1.0\0\win64	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{90A45ABD-2C77-11D9-BDF0-000874CD1BAE}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\SmiEngine.dll
1⤵
- Registers COM server for autorun
- Modifies registry class
PID:2264

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads