0c34b8757b5d9a76966df933e2d9bfb5cb84e71593b1a6bb1bced0e607f1967a

Resubmissions

28/06/2026, 22:28

260628-2dm44agt3k

28/06/2026, 22:25

260628-2b2jpsft8t8

Analysis

user interaction
yes
max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/06/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a.smi.exe
Size 131.3MB
Sample260628-2b2jpsft8t
SHA256 0c34b8757b5d9a76966df933e2d9bfb5cb84e71593b1a6bb1bced0e607f1967a
MD5 f10dbef3554d4e91b78bd1937ac5bb69
SHA1 f469d736e98baa7cec963d99f12295163c9f54b6
SHA512 ae87708466a89db79a3217bb40b6300efcac7d193b2941ab3eef8f03b1c200a5acf6d607fbc50d06d46cf76ce362447ae98d3285c45da1ace4da3f76b60601f6
SSDEEP 3145728:zR7wSJF810C+YskC9O2jgCbCw4SVw83t12v9MxKKzQiga:zZjfbsskaOqgCbCw4T83+FGkda
TLSH
T10E6833E78133A13AF04513F4958796227F0D14663AE3998B47D6F2961FB326C49BE38C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\software\WOW6432Node\microsoft\Active Setup\Installed Components	spchapi.EXE
Key created	\REGISTRY\MACHINE\software\WOW6432Node\microsoft\Active Setup\Installed Components	tv_enua.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	start_virus.exe

Executes dropped EXE 5 IoCs

pid	Process
1788	MSAGENT.EXE
4560	tv_enua.exe
3452	spchapi.EXE
4748	spchcpl.exe
2596	start_virus.exe

Loads dropped DLL 6 IoCs

pid	Process
4748	spchcpl.exe
3452	spchapi.EXE
4560	tv_enua.exe
4172	regsvr32.exe
4172	regsvr32.exe
1400	regsvr32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a.smi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tv_enua = "RunDll32 advpack.dll,LaunchINFSection C:\\Windows\\INF\\tv_enua.inf, RemoveCabinet"	tv_enua.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	spchapi.EXE
File opened (read-only)	\??\E:	spchapi.EXE
File opened (read-only)	\??\A:	spchapi.EXE

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\SETCCA2.tmp	spchcpl.exe
File created	C:\Windows\SysWOW64\SETCCA2.tmp	spchcpl.exe
File opened for modification	C:\Windows\SysWOW64\speech.cpl	spchcpl.exe
File opened for modification	C:\Windows\SysWOW64\SETE1E4.tmp	tv_enua.exe
File created	C:\Windows\SysWOW64\SETE1E4.tmp	tv_enua.exe
File opened for modification	C:\Windows\SysWOW64\msvcp50.dll	tv_enua.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\help\spchcpl.hlp	spchcpl.exe
File opened for modification	C:\Windows\speech\SETD79F.tmp	spchapi.EXE
File opened for modification	C:\Windows\speech\vcmshl.dll	spchapi.EXE
File opened for modification	C:\Windows\INF\SETE1E3.tmp	tv_enua.exe
File opened for modification	C:\Windows\speech\SETD7B2.tmp	spchapi.EXE
File opened for modification	C:\Windows\speech\SETD823.tmp	spchapi.EXE
File opened for modification	C:\Windows\speech\Xcommand.dll	spchapi.EXE
File opened for modification	C:\Windows\speech\Vdict.dll	spchapi.EXE
File opened for modification	C:\Windows\INF\SETD888.tmp	spchapi.EXE
File opened for modification	C:\Windows\speech\SETD812.tmp	spchapi.EXE
File opened for modification	C:\Windows\speech\SETD7A0.tmp	spchapi.EXE
File created	C:\Windows\speech\SETD7A0.tmp	spchapi.EXE
File opened for modification	C:\Windows\fonts\SETE1D3.tmp	tv_enua.exe
File created	C:\Windows\speech\SETD812.tmp	spchapi.EXE
File opened for modification	C:\Windows\speech\SETD824.tmp	spchapi.EXE
File opened for modification	C:\Windows\speech\VText.dll	spchapi.EXE
File opened for modification	C:\Windows\lhsp\help\tv_enua.hlp	tv_enua.exe
File opened for modification	C:\Windows\help\SETCCB2.tmp	spchcpl.exe
File created	C:\Windows\help\SETCCB2.tmp	spchcpl.exe
File opened for modification	C:\Windows\speech\speech.cnt	spchapi.EXE
File opened for modification	C:\Windows\speech\SETD836.tmp	spchapi.EXE
File opened for modification	C:\Windows\speech\SETD837.tmp	spchapi.EXE
File opened for modification	C:\Windows\speech\vtxtauto.tlb	spchapi.EXE
File created	C:\Windows\speech\SETD822.tmp	spchapi.EXE
File opened for modification	C:\Windows\speech\speech.dll	spchapi.EXE
File created	C:\Windows\speech\SETD79F.tmp	spchapi.EXE
File opened for modification	C:\Windows\lhsp\tv\tvenuax.dll	tv_enua.exe
File opened for modification	C:\Windows\fonts\andmoipa.ttf	tv_enua.exe
File opened for modification	C:\Windows\speech\vcmd.exe	spchapi.EXE
File opened for modification	C:\Windows\speech\vcauto.tlb	spchapi.EXE
File created	C:\Windows\speech\SETD823.tmp	spchapi.EXE
File created	C:\Windows\speech\SETD824.tmp	spchapi.EXE
File opened for modification	C:\Windows\speech\XTel.Dll	spchapi.EXE
File opened for modification	C:\Windows\speech\SETD877.tmp	spchapi.EXE
File opened for modification	C:\Windows\lhsp\tv\SETE1D0.tmp	tv_enua.exe
File created	C:\Windows\lhsp\tv\SETE1D1.tmp	tv_enua.exe
File opened for modification	C:\Windows\speech\Xvoice.dll	spchapi.EXE
File opened for modification	C:\Windows\speech\SETD876.tmp	spchapi.EXE
File opened for modification	C:\Windows\lhsp\tv\tv_enua.dll	tv_enua.exe
File created	C:\Windows\INF\SETE1E3.tmp	tv_enua.exe
File opened for modification	C:\Windows\INF\tv_enua.inf	tv_enua.exe
File opened for modification	C:\Windows\speech\SETD78F.tmp	spchapi.EXE
File opened for modification	C:\Windows\speech\Xlisten.dll	spchapi.EXE
File created	C:\Windows\lhsp\help\SETE1D2.tmp	tv_enua.exe
File opened for modification	C:\Windows\speech\speech.hlp	spchapi.EXE
File opened for modification	C:\Windows\speech\SETD7A1.tmp	spchapi.EXE
File created	C:\Windows\speech\SETD835.tmp	spchapi.EXE
File created	C:\Windows\INF\SETD888.tmp	spchapi.EXE
File opened for modification	C:\Windows\INF\spchapi.inf	spchapi.EXE
File created	C:\Windows\speech\~TMP4352~.TMP	spchapi.EXE
File opened for modification	C:\Windows\speech\SETD835.tmp	spchapi.EXE
File created	C:\Windows\speech\SETD7A1.tmp	spchapi.EXE
File created	C:\Windows\lhsp\tv\SETE1D0.tmp	tv_enua.exe
File opened for modification	C:\Windows\lhsp\tv\SETE1D1.tmp	tv_enua.exe
File opened for modification	C:\Windows\speech\SETD801.tmp	spchapi.EXE
File created	C:\Windows\speech\SETD837.tmp	spchapi.EXE
File created	C:\Windows\fonts\SETE1D3.tmp	tv_enua.exe
File created	C:\Windows\speech\SETD7B2.tmp	spchapi.EXE
File created	C:\Windows\speech\SETD836.tmp	spchapi.EXE
File created	C:\Windows\speech\SETD876.tmp	spchapi.EXE
File created	C:\Windows\speech\SETD877.tmp	spchapi.EXE
File created	C:\Windows\speech\SETD801.tmp	spchapi.EXE
File opened for modification	C:\Windows\speech\SETD822.tmp	spchapi.EXE
File created	C:\Windows\speech\SETD78F.tmp	spchapi.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tv_enua.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spchapi.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSAGENT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spchcpl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	start_virus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a.smi.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F106BFA0-C743-11CD-80E5-00AA003E4B50}\ = "ISRGramNotifySinkW"	spchapi.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53961A07-459B-11d1-BE77-006008317CE8}\InprocServer32\ = "C:\\Windows\\speech\\spchtel.dll"	spchapi.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{60462311-3373-11D1-8C43-0060081841DE}\1.0\0\win32	spchapi.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{582C2191-4016-11D1-8C55-0060081841DE}\ = "VDict Class"	spchapi.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2398E32F-5C6E-11D1-8C65-0060081841DE}\MiscStatus\1	spchapi.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2C840E0-E092-11cd-A166-00AA004CD65C}\ProxyStubClsid32\ = "{C63A2B30-5543-11b9-C000-5611722E1D15}"	spchapi.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05EB6C65-DBAB-11CD-B3CA-00AA0047BA4F}\ProxyStubClsid32\ = "{B9BD3860-44DB-101B-90A8-00AA003E4B50}"	spchapi.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6D40D820-0BA7-11ce-A166-00AA004CD65C}	spchapi.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4023720-E4B9-11cf-8D56-00A0C9034A7E}\InprocServer32	spchapi.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A26D7621-6FA0-11ce-A166-00AA004CD65C}\1.0\409\win32	spchapi.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DAC54F60-604D-101B-9926-00AA003CFC2C}\ProxyStubClsid32	spchapi.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D981C420-6053-101B-9926-00AA003CFC2C}\ProxyStubClsid32	spchapi.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8BE9CC30-E095-11cd-A166-00AA004CD65C}\ = "IVMsgAttributesA"	spchapi.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4E3D9D1F-0C63-11D1-8BFB-0060081841DE}\Programmable\	spchapi.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4E3D9D11-0C63-11D1-8BFB-0060081841DE}\1.0\0	spchapi.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CB96B400-C743-11cd-80E5-00AA003E4B50}\ = "Audio Destination Object"	spchapi.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D24FE500-C743-11cd-80E5-00AA003E4B50}	spchapi.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B445330-E39F-11d1-BED7-006008317CE8}	spchapi.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{090CD9AE-DA1A-11CD-B3CA-00AA0047BA4F}\ProxyStubClsid32	spchapi.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{88AD7DC6-67D5-11cf-9B8B-08005AFC3A41}\ProxyStubClsid32	spchapi.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{70618F72-D1ED-11d0-8FAC-08002BE4E62A}\InprocServer32\ThreadingModel = "Apartment"	spchapi.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4623720-E4B9-11cf-8D56-00A0C9034A7E}\InprocServer32	spchapi.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{238004E1-F0C4-11d1-BED9-006008317CE8}\ = "IVDctText2W"	spchapi.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A02C2CA2-AE50-11cf-833A-00AA00A21A29}\ProxyStubClsid32	spchapi.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FC9E7401-6058-11D1-8C66-0060081841DE}\1.0\ = "Microsoft Telephony"	spchapi.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA141FD0-AC7F-11d1-97A3-0060082730FF}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E86F9540-DCA2-11CD-A166-00AA004CD65C}\ProxyStubClsid32\ = "{C63A2B30-5543-11b9-C000-5611722E1D15}"	spchapi.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FFF5DF80-5544-11b9-C000-5611722E1D15}\ = "IVCmdAttributesA"	spchapi.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{aad74c30-4b02-11d1-b792-0060979841b4}\ProxyStubClsid32\ = "{B9BD3860-44DB-101B-90A8-00AA003E4B50}"	spchapi.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{090CD9AF-DA1A-11CD-B3CA-00AA0047BA4F}\InprocServer32\	spchapi.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{92655FB1-ADF9-11d1-BEB9-006008317CE8}\ = "Lexicon Dialog"	spchapi.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D3CC0820-604D-101B-9926-00AA003CFC2C}\ProxyStubClsid32	spchapi.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2F26B9C2-DB31-11CD-B3CA-00AA0047BA4F}\ProxyStubClsid32	spchapi.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05EB6C64-DBAB-11CD-B3CA-00AA0047BA4F}\ProxyStubClsid32	spchapi.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{090CD9A6-DA1A-11CD-B3CA-00AA0047BA4F}\ = "ISRResMerge"	spchapi.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ACB08C00-C743-11cd-80E5-00AA003E4B50}	spchapi.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05EB6C6A-DBAB-11CD-B3CA-00AA0047BA4F}\ProxyStubClsid32	spchapi.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1287A280-4A47-101B-931A-00AA0047BA4F}\ProxyStubClsid32	spchapi.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05EB6C6B-DBAB-11CD-B3CA-00AA0047BA4F}	spchapi.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ACB08C00-C743-11cd-80E5-00AA003E4B50}\ProxyStubClsid32	spchapi.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4E3D9D11-0C63-11D1-8BFB-0060081841DE}\1.0	spchapi.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EEE78591-FE22-11D0-8BEF-0060081841DE}\MiscStatus\1	spchapi.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA141FD0-AC7F-11d1-97A3-0060082730FF}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{80B25CC0-5540-11b9-C000-5611722E1D15}\ProxyStubClsid32	spchapi.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D6469210-E095-11cd-A166-00AA004CD65C}\ProxyStubClsid32	spchapi.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{238004E2-F0C4-11d1-BED9-006008317CE8}\ = "IVDctText2A"	spchapi.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{582C2191-4016-11D1-8C55-0060081841DE}\MiscStatus	spchapi.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2F26B9C0-DB31-11CD-B3CA-00AA0047BA4F}\ProxyStubClsid32	spchapi.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{238004E1-F0C4-11d1-BED9-006008317CE8}	spchapi.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F1DC95A0-0BA7-11ce-A166-00AA004CD65C}\ = "Voice Text Manager"	spchapi.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{090CD9A8-DA1A-11CD-B3CA-00AA0047BA4F}\ = "ISRResCorrectionW"	spchapi.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	spchapi.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{88AD7DC3-67D5-11cf-9B8B-08005AFC3A41}	spchapi.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{090CD9AA-DA1A-11CD-B3CA-00AA0047BA4F}\ProxyStubClsid32\ = "{B9BD3860-44DB-101B-90A8-00AA003E4B50}"	spchapi.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05EB6C68-DBAB-11CD-B3CA-00AA0047BA4F}\ProxyStubClsid32	spchapi.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{582C2191-4016-11D1-8C55-0060081841DE}\ToolboxBitmap32	spchapi.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32C35401-D04F-11d0-99B3-00AA004CD65C}\ = "DirectSound Source Object"	spchapi.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{090CD9A8-DA1A-11CD-B3CA-00AA0047BA4F}	spchapi.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05EB6C6A-DBAB-11CD-B3CA-00AA0047BA4F}\ProxyStubClsid32\ = "{B9BD3860-44DB-101B-90A8-00AA003E4B50}"	spchapi.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05EB6C6F-DBAB-11CD-B3CA-00AA0047BA4F}\ProxyStubClsid32	spchapi.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{88AD7DC0-67D5-11cf-9B8B-08005AFC3A41}\ = "IVDctNotifySinkA"	spchapi.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05EB6C61-DBAB-11CD-B3CA-00AA0047BA4F}\ = "ISREnumA"	spchapi.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{90A84EA0-6E51-11D0-9BC2-08005AFC3A41}	spchapi.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FC9E740F-6058-11D1-8C66-0060081841DE}\MiscStatus\1\ = "131473"	spchapi.EXE

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 744	4544	a.smi.exe	97
PID 744 wrote to memory of 1788	744	wscript.exe	98
PID 744 wrote to memory of 4560	744	wscript.exe	99
PID 744 wrote to memory of 3452	744	wscript.exe	100
PID 744 wrote to memory of 4748	744	wscript.exe	101
PID 744 wrote to memory of 2596	744	wscript.exe	102
PID 2596 wrote to memory of 844	2596	start_virus.exe	104
PID 3452 wrote to memory of 3816	3452	spchapi.EXE	107
PID 4560 wrote to memory of 4172	4560	tv_enua.exe	109
PID 4560 wrote to memory of 1400	4560	tv_enua.exe	110
PID 4560 wrote to memory of 2796	4560	tv_enua.exe	111

C:\Users\Admin\AppData\Local\Temp\a.smi.exe
"C:\Users\Admin\AppData\Local\Temp\a.smi.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Windows\SysWOW64\wscript.exe
  wscript.exe launch.vbs
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:744
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MSAGENT.EXE
    "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MSAGENT.EXE"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1788
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tv_enua.exe
    "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tv_enua.exe"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4560
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s C:\Windows\lhsp\tv\tv_enua.dll
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:4172
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s C:\Windows\lhsp\tv\tvenuax.dll
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1400
  - - C:\Windows\SysWOW64\grpconv.exe
      grpconv.exe -o
      4⤵
      System Location Discovery: System Language Discovery
      PID:2796
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\spchapi.EXE
    "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\spchapi.EXE"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3452
  - - C:\Windows\SysWOW64\grpconv.exe
      grpconv.exe -o
      4⤵
      System Location Discovery: System Language Discovery
      PID:3816
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\spchcpl.exe
    "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\spchcpl.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4748
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\start_virus.exe
    "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\start_virus.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\B5BE.tmp\B5BF.tmp\B5C0.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\start_virus.exe"
      4⤵
      PID:844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B5C0.bat

Path C:\Users\Admin\AppData\Local\Temp\B5BE.tmp\B5BF.tmp\B5C0.bat
Size 129B
SHA256 cd2bc0cc00703f08b5e93f6bfdd75fa32b6b1e2c7dcca4286256849746c966ed
MD5 d44726f079692d8cd2768d8f2f65b8c3
SHA1 7d8471704c079d7ac7e15016406dc499d80015d3
SHA512 c0423ec2cda7ca8a36ff2c1589fb903b686c161faa9a84febda8666f9e62b13aa69d6f228ca3bece8513fb5af3d1de057b6f9cf952a53e91d89e01d1938556b6
TLSH
T15FB09B850CD51CD14F140F08744F0384A1D59181116DED552D321451F8481458D0B7ED
MD5 SHA1 SHA512 TLSH

Submit Download

Bonzi.acs

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Bonzi.acs
Size 5.0MB
SHA256 254b633ec6fc73cabd6540ea0282622d8c808bb1a8546e8f19b31bdde0febace
MD5 2198602806d40247507450325d04c02d
SHA1 a0b871d6a386f4ad56fb7eede647de247d36a0cf
SHA512 22693bee269906e9a8bfa272d0f25419538052473cdc184c2cc3313158365c81cb75e04f376828870be940808df130c5fe5857ff6d1aac6f35eef2837932c910
SSDEEP 98304:PdAMaWetTel1Q9ypfl1YrLdxUa751yGEFbnHEpAbY+/ERjW3lc6u7/jtzVL/7I:PdAMaWetTeAkL2rLdx751qFTkub//WSz
TLSH
T1E2361211FB82A840C420D6371D62E9D17632FF585F939B1E2F6BBA3C2632535E52B613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSAGENT.EXE

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MSAGENT.EXE
Size 391KB
SHA256 16ca09ad70561f413376ad72550ae5664c89c6a76c85c872ffe2cb1e7f49e2aa
MD5 66996a076065ebdcdac85ff9637ceae0
SHA1 4a25632b66a9d30239a1a77c7e7ba81bb3aee9ce
SHA512 e42050e799cbee5aa4f60d4e2f42aae656ff98af0548308c8d7f0d681474a9da3ad7e89694670449cdfde30ebe2c47006fbdc57cfb6b357c82731aeebc50901c
SSDEEP 6144:SFfDAEl3mNlHuHgUaJG6KPHdQM6FoVsmzY4fPLrKHo1Aa1PyhPpcgiMg7:qUNlOAUao6edbs9eY4H3KHo1AaNy9pL2
TLSH
T12284F12393E08237F1E61B301AF14A532B74BDA56FB5DB8F5290804D1A73AD89A35377
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launch.vbs

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\launch.vbs
Size 571B
SHA256 0375aa26f962a715442fe0a94b0c7df005ad097b6d540d05d19d4adbc2bc1ca8
MD5 4c38dc1f2b8985711edd439aa81debd3
SHA1 9a6ed1821b9fd64b61e2dc2a1e3d93d72ea7aa23
SHA512 8c831461b76873f005844beed1e051cc146f9e7191d1ff79d587cdab3acb12f53ee62c10ef7c6e7ca40165cd1a4e9f1d62b8d832007da1eeb273fd7032928c1f
TLSH
T12AF08108C53F912D18A6F38D793768778617BB76A114C8645350840ACBE5503E32B56A
MD5 SHA1 SHA512 TLSH

Submit Download

spchapi.EXE

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\spchapi.EXE
Size 827KB
SHA256 7b05a46c786c91492d154683259c229aa9456286f688da18d4016d91625bebcc
MD5 46878602caa5debb728c0f740aeb45d6
SHA1 63237b1c8b656712d00a1e60a062a738f376a95c
SHA512 4b20b82a543d19932a1b32629b7af3f1dd820211e2350d5fe1ef66e07007fc0717919ec509b5ff6e1495f0511433763198689df4c820e08c3df0029ab74218b9
SSDEEP 12288:THT72nlSwJL/1+DjTRjMGEGqv9BNvGnUQ0EJBfGiromFn:Tv2lSjjTl7qvlvWUEJZ0m5
TLSH
T1FF05230142E44E67E1F05BB51AF026432BBABCA41E79F75FC215E19D5C32BE4AC34B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spchcpl.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\spchcpl.exe
Size 927KB
SHA256 57858127f1a07233ccb4713bd29c860c9a7a201f2b8207ccfc91410478cce4b4
MD5 7506648bdb040a872901c74f7d057e90
SHA1 70bc6be71d2930a50bf0f92cd732531bb6bf5f8c
SHA512 80b92f6d463452b4e9816f27e5482fd18f144216de9f719ca71e5736aea9c6561cce178a5718d3a0e3ff33f7a179833099a154963ec89ec37bf81ce92eca8af4
SSDEEP 24576:D6ZYfzfV/7NVW/PuYiBXpIKlhR2SAIWTZX0k:VbfVn6UZIgX2EWTZ
TLSH
T15115231293D9467BF0B61BB514F81A0367B1FCA66FB4BB0F5392909D28726D08D70B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

start_virus.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\start_virus.exe
Size 87KB
SHA256 d3613d27e32de2e36a3e76277d97a78476f9bc03197b02e602327fb9630798e6
MD5 7a45ee5ce7016cc5f4bda92a783a2c84
SHA1 8b006350ea13deae48480f3cb1407cb97a27bb13
SHA512 306933f307274ad0b54d6b89c9a409afefa51295dfb11046b8631cc07255bb59a7bec0304aec61853e5bfa75c41d3b5810746ba18e0ba3b87c4609879cc3c3b1
SSDEEP 1536:D7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIfHxH:fq6+ouCpk2mpcWJ0r+QNTBfH1
TLSH
T194937D41F3D242F7EAF10A7100A6712FA73666249724E8DBC34C3D829953AD59A3C3F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tv_enua.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tv_enua.exe
Size 997KB
SHA256 709936902951fb684d0a03a561fb7fd41c5e6f81ecd60d326809db66eb659331
MD5 3f8f18c9c732151dcdd8e1d8fe655896
SHA1 222cc49201aa06313d4d35a62c5d494af49d1a56
SHA512 398a83f030824011f102dbcf9b25d3ff7527c489df149e9acdb492602941409cf551d16f6f03c01bc6f63a2e94645ed1f36610bdaffc7891299a8d9f89c511f7
SSDEEP 24576:+RuPGuSU5BiPic3l2iMVCKctDVq0HtPxZj+ihApGm7+MXnrejxAr:LH5Byd2PAd3q0HHZqJpFqMXn1
TLSH
T1B425236297EAC27BE1B277310EF641679A35BC962DF5E3DE4240901D0C22FA5187932F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ADVPACK.DLL

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ADVPACK.DLL
Size 73KB
SHA256 7d126ed85df9705ec4f38bd52a73b621cf64dd87a3e8f9429a569f3f82f74004
MD5 81e5c8596a7e4e98117f5c5143293020
SHA1 45b7fe0989e2df1b4dfd227f8f3b73b6b7df9081
SHA512 05b1e9eef13f7c140eb21f6dcb705ee3aaafabe94857aa86252afa4844de231815078a72e63d43725f6074aa5fefe765feb93a6b9cd510ee067291526bb95ec6
SSDEEP 1536:3TlRSuxQYyqUB9XzWqxGHVcIIX5ZDBZGscEvWlExtJl966CX6q0uE:FfUB9XamGHpw5ZDXXPOixtJz3CX6qQ
TLSH
T1F573F79267F54062E2F35BB469B9163943F9BC312D36D25EDB001A1E38B1AD7DA38703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SPCHCPL.HLP

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\SPCHCPL.HLP
Size 6KB
SHA256 e04674b406f2ac0acb4080ddf2aa131251cec70cbafbc9b4796d5ee180597a48
MD5 4add01eaf6d9fa8c21bc2ec6e473a878
SHA1 3b72793b1d34aa2292025fa94f59546fc030a8e9
SHA512 8304244576ead82539c3a0660dd66b8c3d0e5cb9a2a1c32a6a9df8e3c8e6b359d0ab5210c86813aee838ae26e3661d0f3e494b8ab45343c1f9a9141da7ca2b1e
SSDEEP 48:EoJSgdZEhNeAVGSA26lKBJT71KPQbFCV6ivX:Eo/A9AxilsQb8kiv
TLSH
T1FAE12E57BA40C267C5905731A89EBBC52264FC1A0F69D31336647B1C3CB738CEB278A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SPEECH.CPL

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\SPEECH.CPL
Size 48KB
SHA256 9f58d16004d0b59392908cacab9e41a638af4a05026af17127ed9792840390a2
MD5 5b6a9e6737531dfe95dcb29208d4b639
SHA1 cc812359c46383d4c489a76825af8c6d01964463
SHA512 84b82dcd51bb4db6b5b4bc907182350125ef1accf9b5167f133025ceed8ebddea563b17e749fa9105fe0b89765907ed297071a183f3e8b8ec31ef4a4672796cc
SSDEEP 768:rMBPdbMlHT6sg73K11BVKcCdpprzbmQdMoY/+ei6d:rMFNMlHT6sg7M1BVKcCzpruoa+N6d
TLSH
T114232B3136E9406BE35E463194762F2A5ABEBE510EF1844757F0BB9F9C39640E923B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SPEECH.INF

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\SPEECH.INF
Size 866B
SHA256 a8b41751f021ec02a909a7eef1d2a99a22bb583c525f4d2c91631f999faa5887
MD5 8275c5f0d81e4bdaecaff93426f37ee1
SHA1 8b96c3b0eb9fe86a2ef8c6bde9095c4af26f6c40
SHA512 53e8bca5dbe83551fd61d7f5819763bb013aca9b5952a7cfc8e5d5efe33ee6448749352e004616f2ba28c8383e3907663147208b2a1ff5d235cbb0f117646d2d
TLSH
T14A118C8B5B074B5EB3143A5078570787BC1177C047B0598974599840C1E9A6A43B59FE
MD5 SHA1 SHA512 TLSH

Submit Download

Msvcirt.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Msvcirt.dll
Size 76KB
SHA256 647f7534aaaedffa93534e4cb9b24bfcf91524828ff0364d88973be58139e255
MD5 e7cd26405293ee866fefdd715fc8b5e5
SHA1 6326412d0ea86add8355c76f09dfc5e7942f9c11
SHA512 1114c5f275ecebd5be330aa53ba24d2e7d38fc20bb3bdfa1b872288783ea87a7464d2ab032b542989dee6263499e4e93ca378f9a7d2260aebccbba7fe7f53999
SSDEEP 1536:4Nx5jQM0/rmlYjYYwnlF6QXHhAk/tFeH3hNfcub:k5Y/rc/zXBAk/t0H3hNfcub
TLSH
T160730923A9C75138E285D7350D1257273EFFB1BA8706AF4392E9E439061972B4C336A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W95INF32.DLL

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\W95INF32.DLL
Size 4KB
SHA256 e5e9f7c8dbd47134815e155ed1c7b261805eda6fddea6fa4ea78e0e4fb4f7fb5
MD5 4be7661c89897eaa9b28dae290c3922f
SHA1 4c9d25195093fea7c139167f0c5a40e13f3000f2
SHA512 2035b0d35a5b72f5ea5d5d0d959e8c36fc7ac37def40fa8653c45a49434cbe5e1c73aaf144cbfbefc5f832e362b63d00fc3157ca8a1627c3c1494c13a308fc7f
SSDEEP 48:6Z3Mi+h0U47yaE6akf1WbvgFfSBZW3IezfXNFk5WgF:VEyaVaVv+aPWJXNyWg
TLSH
T1D591F10363F42677E1E70B3005571B2AF17EF970D7759ACB0D9400262C3A9C16E71BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

andmoipa.ttf

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\andmoipa.ttf
Size 29KB
SHA256 38ae07eeb7909bda291d302848b8fe5f11849cf0d597f0e5b300bfed465aed4e
MD5 c3e8aeabd1b692a9a6c5246f8dcaa7c9
SHA1 4567ea5044a3cef9cb803210a70866d83535ed31
SHA512 f74218681bd9d526b68876331b22080f30507898b6a6ebdf173490ca84b696f06f4c97f894cb6052e926b1eee4b28264db1ead28f3bc9f627b4569c1ddcd2d3e
SSDEEP 768:xr+oVrM3Xz9CFnht6/zce4lA7DB8kmhI7oGH4w4EjKflHjbjC:xr+oVrMnz9CFht6/zce42RzmhI7oGYw9
TLSH
T178D24B4BF2A6CE4FF2D1E534DD246A3203F1F9BDCB3B457EBE881194E4924285814B96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tv_enua.hlp

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\tv_enua.hlp
Size 11KB
SHA256 382d745e10944b507a8d9c69ae2e4affd4acf045729a19ac143fa8d9613ccb42
MD5 80d09149ca264c93e7d810aac6411d1d
SHA1 96e8ddc1d257097991f9cc9aaf38c77add3d6118
SHA512 8813303cd6559e2cc726921838293377e84f9b5902603dac69d93e217ff3153b82b241d51d15808641b5c4fb99613b83912e9deda9d787b4c8ccfbd6afa56bc9
SSDEEP 192:j2yDmtRZ4W9iBq7zlILADoq+1g7rZZBc:jVKtRmkIsDoq+y
TLSH
T17542528637950B33C2570233928EEFE873619D9D2D9353A23488B71C2DB6F2957661EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tv_enua.inf

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\tv_enua.inf
Size 2KB
SHA256 85189df1c141ef5d86c93b1142e65bf03db126d12d24e18b93dd4cc9f3e438ae
MD5 0a250bb34cfa851e3dd1804251c93f25
SHA1 c10e47a593c37dbb7226f65ad490ff65d9c73a34
SHA512 8e056f4aa718221afab91c4307ff87db611faa51149310d990db296f979842d57c0653cb23d53fea54a69c99c4e5087a2eb37daa794ba62e6f08a8da41255795
TLSH
T1C25176A58D1255A6BA7D3701D80A05CB3F9865F632204924B897B1C458E37CFB2FE0FB
MD5 SHA1 SHA512 TLSH

Submit Download

msvcp50.dll

Path C:\Windows\SysWOW64\msvcp50.dll
Size 552KB
SHA256 91cd76f9fa3b25008decb12c005c194bdf66c8d6526a954de7051bec9aae462a
MD5 497fd4a8f5c4fcdaaac1f761a92a366a
SHA1 81617006e93f8a171b2c47581c1d67fac463dc93
SHA512 73d11a309d8f1a6624520a0bf56d539cb07adee6d46f2049a86919f5ce3556dc031437f797e3296311fe780a8a11a1a37b4a404de337d009e9ed961f75664a25
SSDEEP 12288:7l3kpKgpWFynTJ2VKBrCT8KJyyj61Jz7q3OocHkCq9:uKgpWFynTN9CIK01d7q3OocHkCq9
TLSH
T1D6C44B12734B41F2D64463F0668A53399B34ECA90711F7E3E2DBED562F272D4A233A61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tv_enua.dll

Path C:\Windows\lhsp\tv\tv_enua.dll
Size 1.2MB
SHA256 e0beb19c3536561f603474e3d5e3c3dff341745d317bc4d1463e2abf182bb18d
MD5 ed98e67fa8cc190aad0757cd620e6b77
SHA1 0317b10cdb8ac080ba2919e2c04058f1b6f2f94d
SHA512 ec9c3a71ca9324644d4a2d458e9ba86f90deb9137d0a35793e0932c2aa297877ed7f1ab75729fda96690914e047f1336f100b6809cbc7a33baa1391ed588d7f0
SSDEEP 24576:vPwLKE+aAeUqG7AFbbynL1AgIy6cOi3gy3YuvtTNl:gLKCW0yL1AvuZZvt
TLSH
T1BA45BF2360CA185CD918127855673B728D3CF9929B5EF8D5FF08ACE2587F2237662783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tvenuax.dll

Path C:\Windows\lhsp\tv\tvenuax.dll
Size 40KB
SHA256 c9106198ecbd3a9cab8c2feff07f16d6bb1adfa19550148fc96076f0f28a37b0
MD5 1587bf2e99abeeae856f33bf98d3512e
SHA1 aa0f2a25fa5fc9edb4124e9aa906a52eb787bea9
SHA512 43161c65f2838aa0e8a9be5f3f73d4a6c78ad8605a6503aae16147a73f63fe985b17c17aedc3a4d0010d5216e04800d749b2625182acc84b905c344f0409765a
SSDEEP 384:OWygeD+eKczRKfZsjdeGcOzOf33iX9aeF+xpzy1B9ta7kxAG9BoWWgiJ9VQ:OWo7RKfZsjdeGjFXf+HyVhaGEgiK
TLSH
T16E033B1237D680F6E3DF12309F505B6DE7FBFF2456E4800A0F6205C63A72646DA3A24A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ADVPACK.DLL

Path F:\msdownld.tmp\IXP000.TMP\ADVPACK.DLL
Size 76KB
SHA256 3113d2c0a87fc75f3ca11646e3c429a8c15f1556f6b7a6104dbbdaa85ff6ec34
MD5 533a380c0ca00e0c3a0dc9b038a8b912
SHA1 f647bd665f329403ec87d50fbd8fed6c6f0e1e93
SHA512 416812009e333c46cd8ee11cc979ef5aafb039084d7bf0da468f40116197b3abd4a3d31e75bac3d3b7e3468643341a1aae2657e17e31cc6bd9716a823bd9eeb6
SSDEEP 1536:0ql1iWItsn2bWDMJ60BUqKagdt7dRiBIXKNO1sYxNJSeDXzq0uY77jAP:Rn2bWDMJ6eUqK5tB0yKNOnxNJSeDXzqp
TLSH
T1E373FA927BF05027E6F21F78E9B5172486FBBD315936D24EDB00094E29B1AD1DA39703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VText.dll

Path F:\msdownld.tmp\IXP000.TMP\VText.dll
Size 169KB
SHA256 b7a0114e8bd9875e98fa6c98215d3b4582e0d1eae9b799b912145e88095ee815
MD5 c0a7306a302dd35145a37286dcfe6e04
SHA1 beba434997c5f60e988bd98928c13273996cb516
SHA512 ada43188cbf3d877ed055fc4a7395482a7a0adff6268880685b450f2f79c081aa8499f4770cd70c70c146002ac7fd516421202e275a71568872b879d0696d80a
SSDEEP 3072:0uZTA300EytZyGuoOraDUb3gtCgDmHxrc0xU/aVR/G4aJeYgJRZYyBDzzb:T92hsaQr6TDmHNc0I0mJebhXb
TLSH
T14F047C5277C2C873E562423509E677BEFB7C9602561387476B54EB9F1C32282EA3D30A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Vdict.dll

Path F:\msdownld.tmp\IXP000.TMP\Vdict.dll
Size 175KB
SHA256 08b35a07bf0dd5b231f7b25aa48476a7f78c9fca7a76c047103025d1a95952fd
MD5 6dc843c473b68ea93202a32b6445c765
SHA1 3616292d1b84b9273471af195927d422d7fb9394
SHA512 77623c61303b1f5fafb5d5af3e1d409af37ed3bd8c8c8bdf83206f2b5ba248553758696cf16835299f2267265689ce0fcb8564cf6823074257ce6964ac0bd517
SSDEEP 3072:sZ9P4ROQmUJoMNuyTavM+tu34N0L1YJeMgnDTfX6jPVR:sw/gyTotC4N0LGJe3ffKjtR
TLSH
T199043BC273D2C973C1A351716D76677AF3BC96041D258F072784A78E6F3138AAB1A21E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W95INF16.DLL

Path F:\msdownld.tmp\IXP000.TMP\W95INF16.DLL
Size 2KB
SHA256 337d2fb5252fc532b7bf67476b5979d158ca2ac589e49c6810e2e1afebe296af
MD5 7210d5407a2d2f52e851604666403024
SHA1 242fde2a7c6a3eff245f06813a2e1bdcaa9f16d9
SHA512 1755a26fa018429aea00ebcc786bb41b0d6c4d26d56cd3b88d886b0c0773d863094797334e72d770635ed29b98d4c8c7f0ec717a23a22adef705a1ccf46b3f68
TLSH
T12041A3630638E8C6C01C03328A57CBC631B4D310538F4F0B0A69A57B3A92BCD877912A
MD5 SHA1 SHA512 TLSH

Submit Download

WrapSAPI.dll

Path F:\msdownld.tmp\IXP000.TMP\WrapSAPI.dll
Size 52KB
SHA256 8e0a80b885a73c8b62e87ab7f2a4b06a556b4db37a1fba9b37db2629f4c36a49
MD5 8ccb0967e7371d64933fca913065789f
SHA1 63173da8984611aca496a253dba336af23aeb558
SHA512 9064f27f70b7a4e48dd9fac1954060fbdb5d5b35355f7be5c8a1221cc931ef20df7e4543b28e4416f86ed0c56b6a2a204d78db4c70e298bd29db5ccab2349d3a
SSDEEP 768:E7wrftRH2vymhojWHnkvEHv83yXj5Ejozd9GgqydETqDsJeSc/BuN4myv87:d73H2voOn6y1GqwHJet/BoT
TLSH
T136333A0233F1C0B3D3A613349B74AF7A6AFEAF1065E447471F12364E1D72A9BD629216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XTel.Dll

Path F:\msdownld.tmp\IXP000.TMP\XTel.Dll
Size 199KB
SHA256 c32846fab920f5da84005aa169ff259c54a3b9504faabc52f2f53d240ed2418e
MD5 69c2b85b9db59f7ad8d04e6dbfbde511
SHA1 4547a87c80b3ff9e2a148f7c0822c2495240aa5c
SHA512 e677a28a20b4b481d87cd2007dfc3d6f8b88dcd0cdf25df988a43b8480458a37c145ecb8a9ff48ae41586fb571230e79208ba7baf74dd27b78d93412fbe1ea11
SSDEEP 3072:D/iO4aLKodNcfK0jOEFE1oF1smD4MntPuo/8JsmZ5GtijJezgYyLFniu:Lbnc5E+F1ssjtLkJsm3Je3A
TLSH
T1B6144C8373D2F87AD19311B24E963B39E3BC8F415B1B4B471384AA4E5D72A865F2D305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Xcommand.dll

Path F:\msdownld.tmp\IXP000.TMP\Xcommand.dll
Size 125KB
SHA256 0bd009b376f9ee2c2cea181adc0014c6c9ba91a4eaf7a3b98441a1696d302e89
MD5 198c46362e9e7742f7efafd936624bed
SHA1 87b628c2a14a1c5897fd0281a682e9bdcb32bfcc
SHA512 8c747cb697294df0daf092c8f139ffd18c92a098b1b709359739644029b5523d6b5d9ac80d11e1a4fe885ad13fe8a810222d6d609997b722ae0908421f9168a5
SSDEEP 3072:7+oiovZ30EEyGF70oXiyvbmhjfteE5BpfCpk/Hs+JeDgr3AXYS:Coiovydsyvbmhj1l5BpapkfJesAY
TLSH
T160C36C5173C2C472D1A202B44DB53BBEF7BCDE010A6287475774F25E6E732A5FA2A10A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Xlisten.dll

Path F:\msdownld.tmp\IXP000.TMP\Xlisten.dll
Size 204KB
SHA256 287fec5f90f973a5aa4100bdbca1c9cbb0e242f908d218b975b9623ea25f9393
MD5 ce7367a398dd2d0f77041316906114fb
SHA1 128bbde9b589b94f88ae9799043b3c05fdc73990
SHA512 a5151b5ff83ed72288e76e9f7637ea83746e61a2d9b13476cec6ddbb072c36b4c5929c40dd0c39a600338a9d8c4a5bebad304b0d29d9f4050a67ec2e894b8519
SSDEEP 6144:xMBRIsU6AiHvFsS0SuR5QCJeDa9JGQcs:xMby6rs5SuR5Qsem9JGQc
TLSH
T1C4144C4277C1CCB7D197117049E77B7AD779A2001F1ACB039358E7AF5E73286AA1A30A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Xvoice.dll

Path F:\msdownld.tmp\IXP000.TMP\Xvoice.dll
Size 191KB
SHA256 2bb50939fa7068791eea58c1fe6b112bcf5bb423ca55b9698411957a6f82d1b8
MD5 06201e3ce75755e5eb4138a0a3e1925b
SHA1 05296f4e2774b9c3270365bf19304bf28e13fd51
SHA512 0bdd01a7f42a3b6de0ca094d55d79437897e2f329751735097d2b7c4ed07792ba81c07544ec9a1f8c89a9472b57b3067dc204bd773721ab8398637949ae74d77
SSDEEP 3072:CUjcrjsN352i+sljehcbbao3fJqNavuVt2NetXUACI09857BL6h63UDpJeYgYBAs:fYXot7nZqos+eaAz0qNyJeM+s
TLSH
T1E9147C42BBC2C8B3D16711314DA67B7AEB789A000B1687475724E74F5C333E2BA1E25B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcrt.dll

Path F:\msdownld.tmp\IXP000.TMP\msvcrt.dll
Size 260KB
SHA256 d4287ab5e4988dfe99bd54243d50dbe8744094f11fe5f9809a1a6fb9728c2124
MD5 63da4613383ec70e047b4cd5c48f0b05
SHA1 578dd3ee844678c24c0831b6cc61a7dfae410bdc
SHA512 0fe7226cba7984f22367d03dafe568e8c0e44956a831fda93d4bd8ad9cbc9ee87dc03e4a56696c0bb0e5f8ec27a304c06cdb56c52d87263362359523f0a220a6
SSDEEP 6144:sQ70n5legBB8h6GyoXwI7kohyRAeFMWiFaNF7R5LYrdKuOpO:sQ7k5lpBBi6e7kog/5Bbu3
TLSH
T1D044BE613AD0CC7AD2E641780D973F3B8BBEA9504132DD83DBE45ED02F20A92975B257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spchapi.inf

Path F:\msdownld.tmp\IXP000.TMP\spchapi.inf
Size 57KB
SHA256 91eab6288811f82b83da589a776242200faaa60d2d1f1b65e7de70a7659ca678
MD5 2caa50c3fd03dfb8003262b5d49b6e8b
SHA1 866c4b8db7e5d4dba1164ab403da3a9826add561
SHA512 4cc2293eaf8e8d4f128e42e0329efebb78343c0014ac30b4dd64c2cab227d23d2f2292e5ddc1ee789ae86eeec64624194bef7087d8f792b069010d75ee591caa
SSDEEP 768:4brIEmF6xzp1ivU2ORe4AEhBBNe6T/JvZP1:4brVmF6/1BRe4bv7DP1
TLSH
T16E435119A74A52E69CCA114340B37D78EECED6A35583C55F0DA8800A86FFDFDA105ECB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spchtel.dll

Path F:\msdownld.tmp\IXP000.TMP\spchtel.dll
Size 243KB
SHA256 ea6b0454ac40794ce46a6fd8fd244179cfe76293b18cdb52f02b372dc0f64d1d
MD5 c546b50be180b4f7810fd78c7fe8433f
SHA1 d7b071eaff8d0498724c1e779731db51e41c900c
SHA512 34ef3830a489510b42dbe0b084d3e688f7558ad2f806e344b760d5e25744763792ca52a664c312a47417cf629a74ddec302f47eed813e76316ae2e5aaaf6612d
SSDEEP 6144:M/SGDRBay6HR4MvtrNvtTdf9bdf9TNPtLNPtz9fSrgpW3BFqjoGOvsViDwR2vkd2:M/SHyEVvtrNvtTdf9bdf9TNPtLNPtz98
TLSH
T17034304373FA4415F5F36A70EDB565709B3E7D46AC38CA8E0294891D0EF2A80D8267E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

speech.cnt

Path F:\msdownld.tmp\IXP000.TMP\speech.cnt
Size 207B
SHA256 51d0efea836528cb137914a6dd77f049cf0457245fdfd608c3936605adb11c57
MD5 4653630ff6f8405f6d26000802e638ac
SHA1 3e6978815d5e0465c7ec557a2da4c253fe89427d
SHA512 961db65e440dd831f2b490d4c80f306047e65cc0ef6f1c921a732b89a11b289b84e8556d4711ab9af0821cb01f4cb84f8ceccd51865448f93a28f5a02678805d
TLSH
T1CBD02317FF016553C34118467DE004812C24D004CFD45F733C7530C931D0919C07B860
MD5 SHA1 SHA512 TLSH

Submit Download

speech.dll

Path F:\msdownld.tmp\IXP000.TMP\speech.dll
Size 549KB
SHA256 171d545ca7d10188875fcf103b664be2195996bbed2bd4dacfa8cfe827f1a441
MD5 898fc91bf6424f629e933273b6e46ffd
SHA1 2c777a8cb7f6e9a469f6d6486c98e70414949acd
SHA512 de7815a04cbddcff2c2ebef4c6d441936314924f6bdce3b3fb4a8bd4b62b761c7dbb3b99a12deb45b23b186f42a431d67b43fb9950f3d447ee9f721bf6cf6ffc
SSDEEP 6144:+X04JQ6j+i1ykquRkkUkRZpdIPevDbugIqt/SmxLGMQ+OPJn8iDcuvhgJm:+Tdj+iLtlPbpdI8Xtti
TLSH
T1F8C4827322946019E1FF267459B127A25663FD255A3886BF45B2FF3D0AB0B018F2172F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

speech.hlp

Path F:\msdownld.tmp\IXP000.TMP\speech.hlp
Size 13KB
SHA256 56dbafcfa4a628fcd20e49bf169115bafe596104f8dd51d2aac8d7cabb452c3a
MD5 a7db03e26dd567b3ec5804d5064c738c
SHA1 37abaf849e1cbc0eacd545c19e7ad81d947c113a
SHA512 d7f033695ac098a07f6d7cd00f0bee86bd581d3ab9b8f4b5073337fcb1277b5a49a99ea7d65819587ce2d807e0652c7ea0d98524f1cc934be64776c25d2daee5
SSDEEP 192:6d1gT5MJM6NObk1vxWLkr3L6vefEn6AvDW5F3O0bx4lekPYH+MsTd:6daGJM6ELkrOkE6AvDW51Oq4ljTMsR
TLSH
T1F3526D843D892DB7C5DD847A895A5FDC52A1FC42ADD49303303E765C7CB3592AE05B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcauto.tlb

Path F:\msdownld.tmp\IXP000.TMP\vcauto.tlb
Size 7KB
SHA256 0e74c1dcbcb38daeb9d505b94f74b32ad8d37e8a26ef4022d46999eb3727720d
MD5 695b08aa62b0dd9031fafcc1bb2a16d6
SHA1 1b151114b4f1fff8b3ddac92f4e8b3de2cc02ff3
SHA512 f0a816783fe19a740c50cef76f5747ba19f86fbb41ee95d53c234f0bdb1e28e7d9badf55fef6e7e8e1b9d1d656ef5c4f5d59baa418fe6968e42a083963b3f128
SSDEEP 96:BE1PWfbYMWDtEWfbYMWDN6KlqHDYPXCYSFcOKCcDpd9T:6WfFWDGWfFWDNCyX2aO5
TLSH
T10DE10F06F7E5C623E59646310C2B87D6A9B9FC209F29A71F3391335E2D31380BA52763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcmd.exe

Path F:\msdownld.tmp\IXP000.TMP\vcmd.exe
Size 372KB
SHA256 6b2c21142bbb3050101606f05956a60dbe04f971bd8034d918731f8e9450cd35
MD5 367351856db877b6c659dc42dbc89df0
SHA1 6725fba6e42487929f75c59fddf44c8d090a50e5
SHA512 2c5ea481d64203751fa059bbf54e17a826df8a89d73d923dc4c5a68a0c25687cc3d74e511cd740eb801c6210c18a51bf268d3dfb9648a83eed137bd384640634
SSDEEP 6144:n14GormBCpwvK7HcNv/wPu/243O65z/N6i3i0ZW1xS:1lBCplHcNHwG/d6+
TLSH
T1E4844B2373D24632D0A32331A7743756BBB9B511BDE5C99E07D64D3C2EB0902973A35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcmshl.dll

Path F:\msdownld.tmp\IXP000.TMP\vcmshl.dll
Size 152KB
SHA256 437ae2139661f2fb5fd97b34ee751521db477ee8c3454c920c5480020aaf94f8
MD5 2f8c18e8e067f6b84bf8c6c482862a70
SHA1 1c350c5a4674115cb8ba5620ec61fbebcd8fe974
SHA512 1a5a4d6064cfa35106c865661249d1023ab777b1c216c34dc0e86df435338cf1f8d8589fb567d34956e71a607db4aa8ce43039f42d5fa3ddd0c68506064588e5
SSDEEP 3072:YBxS+o38s9yvksUSQpwpjbNKUSx6mIgWP4QcKr4C:ya38sQcJSQpwpjbNyrC
TLSH
T199E37B31994406B1E6F2477B7C963A38AADDEBCB9720B1CF933C9D4D6A810D1B87520D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtxtauto.tlb

Path F:\msdownld.tmp\IXP000.TMP\vtxtauto.tlb
Size 6KB
SHA256 544b33cf240a425cccc910269c68b99b411b2374571ab8af51a490f9cc277f77
MD5 283c7d582752fc0c025421fca7b7e1d0
SHA1 ee6149b8023ec61b18b098ec3e37648c610c51a3
SHA512 844a6689000afc5fa724e1e1fbd4e4efc6ba6f67a4c5d2ef88c0c963feb5f9cbc62779affc11c318bef4b049a77d6818b0b2f8fd0c85cd14e6ae7414885b482f
SSDEEP 96:uExPWfbYMWxMEWfbYMWxxX/djaiWBvZ/lguM0HjkycdPS:pWfFWx9WfFWxPjcBvTguzQyf
TLSH
T15AD1EE47BBE5C377E4964A315C3B86D26AB5FC216E15A74B3244339D3C32781AB10763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads