Overview

overview

8

Static

static

3

a.smi.exe

windows10-2004-x64

8

a.smi.exe

windows11-ltsc_2024-x64

8

Resubmissions

28/06/2026, 22:28

260628-2dm44agt3k

28/06/2026, 22:25

260628-2b2jpsft8t8

Analysis

  • user interaction
    yes
  • max time kernel
    70s
  • max time network
    43s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/06/2026, 22:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    a.smi.exe
  • Size 131.3MB
  • Sample260628-2b2jpsft8t
  • SHA256 0c34b8757b5d9a76966df933e2d9bfb5cb84e71593b1a6bb1bced0e607f1967a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 6 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 64 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a.smi.exe
    "C:\Users\Admin\AppData\Local\Temp\a.smi.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5512
    • C:\Windows\SysWOW64\wscript.exe
      wscript.exe launch.vbs
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5896
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MSAGENT.EXE
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MSAGENT.EXE"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:6032
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tv_enua.exe
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tv_enua.exe"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4448
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32 /s C:\Windows\lhsp\tv\tv_enua.dll
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:3392
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32 /s C:\Windows\lhsp\tv\tvenuax.dll
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:2572
        • C:\Windows\SysWOW64\grpconv.exe
          grpconv.exe -o
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4992
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\spchapi.EXE
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\spchapi.EXE"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:4280
        • C:\Windows\SysWOW64\grpconv.exe
          grpconv.exe -o
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2944
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\spchcpl.exe
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\spchcpl.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:3164
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\start_virus.exe
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\start_virus.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5960
        • C:\Windows\system32\cmd.exe
          "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\B5CE.tmp\B5DF.tmp\B5E0.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\start_virus.exe"
          4⤵
            PID:5268

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          B5E0.bat
          • Path C:\Users\Admin\AppData\Local\Temp\B5CE.tmp\B5DF.tmp\B5E0.bat
          • Size 129B
          • SHA256 cd2bc0cc00703f08b5e93f6bfdd75fa32b6b1e2c7dcca4286256849746c966ed
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Bonzi.acs
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Bonzi.acs
          • Size 5.0MB
          • SHA256 254b633ec6fc73cabd6540ea0282622d8c808bb1a8546e8f19b31bdde0febace
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSAGENT.EXE
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MSAGENT.EXE
          • Size 391KB
          • SHA256 16ca09ad70561f413376ad72550ae5664c89c6a76c85c872ffe2cb1e7f49e2aa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          launch.vbs
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\launch.vbs
          • Size 571B
          • SHA256 0375aa26f962a715442fe0a94b0c7df005ad097b6d540d05d19d4adbc2bc1ca8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          spchapi.EXE
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\spchapi.EXE
          • Size 827KB
          • SHA256 7b05a46c786c91492d154683259c229aa9456286f688da18d4016d91625bebcc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spchcpl.exe
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\spchcpl.exe
          • Size 927KB
          • SHA256 57858127f1a07233ccb4713bd29c860c9a7a201f2b8207ccfc91410478cce4b4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          start_virus.exe
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\start_virus.exe
          • Size 87KB
          • SHA256 d3613d27e32de2e36a3e76277d97a78476f9bc03197b02e602327fb9630798e6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tv_enua.exe
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tv_enua.exe
          • Size 997KB
          • SHA256 709936902951fb684d0a03a561fb7fd41c5e6f81ecd60d326809db66eb659331
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ADVPACK.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ADVPACK.DLL
          • Size 76KB
          • SHA256 3113d2c0a87fc75f3ca11646e3c429a8c15f1556f6b7a6104dbbdaa85ff6ec34
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ADVPACK.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ADVPACK.DLL
          • Size 73KB
          • SHA256 7d126ed85df9705ec4f38bd52a73b621cf64dd87a3e8f9429a569f3f82f74004
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Msvcirt.dll
          • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Msvcirt.dll
          • Size 76KB
          • SHA256 647f7534aaaedffa93534e4cb9b24bfcf91524828ff0364d88973be58139e255
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Msvcp50.dll
          • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Msvcp50.dll
          • Size 552KB
          • SHA256 91cd76f9fa3b25008decb12c005c194bdf66c8d6526a954de7051bec9aae462a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SPCHCPL.HLP
          • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\SPCHCPL.HLP
          • Size 6KB
          • SHA256 e04674b406f2ac0acb4080ddf2aa131251cec70cbafbc9b4796d5ee180597a48
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SPEECH.CPL
          • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\SPEECH.CPL
          • Size 48KB
          • SHA256 9f58d16004d0b59392908cacab9e41a638af4a05026af17127ed9792840390a2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SPEECH.INF
          • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\SPEECH.INF
          • Size 866B
          • SHA256 a8b41751f021ec02a909a7eef1d2a99a22bb583c525f4d2c91631f999faa5887
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          VText.dll
          • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\VText.dll
          • Size 169KB
          • SHA256 b7a0114e8bd9875e98fa6c98215d3b4582e0d1eae9b799b912145e88095ee815
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Vdict.dll
          • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Vdict.dll
          • Size 175KB
          • SHA256 08b35a07bf0dd5b231f7b25aa48476a7f78c9fca7a76c047103025d1a95952fd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          W95INF32.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\W95INF32.DLL
          • Size 4KB
          • SHA256 e5e9f7c8dbd47134815e155ed1c7b261805eda6fddea6fa4ea78e0e4fb4f7fb5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WrapSAPI.dll
          • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\WrapSAPI.dll
          • Size 52KB
          • SHA256 8e0a80b885a73c8b62e87ab7f2a4b06a556b4db37a1fba9b37db2629f4c36a49
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          XTel.Dll
          • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\XTel.Dll
          • Size 199KB
          • SHA256 c32846fab920f5da84005aa169ff259c54a3b9504faabc52f2f53d240ed2418e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Xcommand.dll
          • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Xcommand.dll
          • Size 125KB
          • SHA256 0bd009b376f9ee2c2cea181adc0014c6c9ba91a4eaf7a3b98441a1696d302e89
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Xlisten.dll
          • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Xlisten.dll
          • Size 204KB
          • SHA256 287fec5f90f973a5aa4100bdbca1c9cbb0e242f908d218b975b9623ea25f9393
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Xvoice.dll
          • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Xvoice.dll
          • Size 191KB
          • SHA256 2bb50939fa7068791eea58c1fe6b112bcf5bb423ca55b9698411957a6f82d1b8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          andmoipa.ttf
          • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\andmoipa.ttf
          • Size 29KB
          • SHA256 38ae07eeb7909bda291d302848b8fe5f11849cf0d597f0e5b300bfed465aed4e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msvcrt.dll
          • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\msvcrt.dll
          • Size 260KB
          • SHA256 d4287ab5e4988dfe99bd54243d50dbe8744094f11fe5f9809a1a6fb9728c2124
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spchapi.inf
          • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\spchapi.inf
          • Size 57KB
          • SHA256 91eab6288811f82b83da589a776242200faaa60d2d1f1b65e7de70a7659ca678
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spchtel.dll
          • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\spchtel.dll
          • Size 243KB
          • SHA256 ea6b0454ac40794ce46a6fd8fd244179cfe76293b18cdb52f02b372dc0f64d1d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          speech.cnt
          • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\speech.cnt
          • Size 207B
          • SHA256 51d0efea836528cb137914a6dd77f049cf0457245fdfd608c3936605adb11c57
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          speech.dll
          • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\speech.dll
          • Size 549KB
          • SHA256 171d545ca7d10188875fcf103b664be2195996bbed2bd4dacfa8cfe827f1a441
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          speech.hlp
          • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\speech.hlp
          • Size 13KB
          • SHA256 56dbafcfa4a628fcd20e49bf169115bafe596104f8dd51d2aac8d7cabb452c3a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tv_enua.dll
          • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tv_enua.dll
          • Size 1.2MB
          • SHA256 e0beb19c3536561f603474e3d5e3c3dff341745d317bc4d1463e2abf182bb18d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tv_enua.hlp
          • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tv_enua.hlp
          • Size 11KB
          • SHA256 382d745e10944b507a8d9c69ae2e4affd4acf045729a19ac143fa8d9613ccb42
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tv_enua.inf
          • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tv_enua.inf
          • Size 2KB
          • SHA256 85189df1c141ef5d86c93b1142e65bf03db126d12d24e18b93dd4cc9f3e438ae
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          tvenuax.dll
          • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tvenuax.dll
          • Size 40KB
          • SHA256 c9106198ecbd3a9cab8c2feff07f16d6bb1adfa19550148fc96076f0f28a37b0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcauto.tlb
          • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vcauto.tlb
          • Size 7KB
          • SHA256 0e74c1dcbcb38daeb9d505b94f74b32ad8d37e8a26ef4022d46999eb3727720d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcmd.exe
          • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vcmd.exe
          • Size 372KB
          • SHA256 6b2c21142bbb3050101606f05956a60dbe04f971bd8034d918731f8e9450cd35
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcmshl.dll
          • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vcmshl.dll
          • Size 152KB
          • SHA256 437ae2139661f2fb5fd97b34ee751521db477ee8c3454c920c5480020aaf94f8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vtxtauto.tlb
          • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vtxtauto.tlb
          • Size 6KB
          • SHA256 544b33cf240a425cccc910269c68b99b411b2374571ab8af51a490f9cc277f77
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AGT20.INF
          • Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\AGT20.INF
          • Size 2KB
          • SHA256 49e6b848f5a708d161f795157333d7e1c7103455a2f47f50895683ef6a1abe4d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          W95INF16.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\W95INF16.DLL
          • Size 2KB
          • SHA256 337d2fb5252fc532b7bf67476b5979d158ca2ac589e49c6810e2e1afebe296af
          • MD5 SHA1 SHA512 TLSH
          Submit Download