Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/07/2026, 23:27

General

  • Target
    AULA F75 Setup v2.0 20240520.exe
  • Size 2.3MB
  • Sample260718-3ffy8sfs4m
  • SHA256 e075b8bebb19649538256381df5b958ea42b4be0cddc886ef97f3406c39df1a2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AULA F75 Setup v2.0 20240520.exe
    "C:\Users\Admin\AppData\Local\Temp\AULA F75 Setup v2.0 20240520.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3452
    • C:\Users\Admin\AppData\Local\Temp\is-MNJA2.tmp\AULA F75 Setup v2.0 20240520.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-MNJA2.tmp\AULA F75 Setup v2.0 20240520.tmp" /SL5="$400A0,2024987,281088,C:\Users\Admin\AppData\Local\Temp\AULA F75 Setup v2.0 20240520.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4256
      • C:\Program Files (x86)\AULA\F75\OemDrv.exe
        "C:\Program Files (x86)\AULA\F75\OemDrv.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:3168

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Cfg.ini

        • Path C:\Program Files (x86)\AULA\F75\Cfg.ini
        • Size 1KB
        • SHA256 9c76f4c11f1ba3fae1a81b263e766a143b22a4dcbe3f353b780a44323fda1b07
        • MD5 SHA1 SHA512 TLSH

        KB.ini

        • Path C:\Program Files (x86)\AULA\F75\Dev\kb\1\KB.ini
        • Size 5KB
        • SHA256 bde7c62053f16ff57f01b486074a7106a72e293e359c57183e1c4aa534049fdd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        KB.ini

        • Path C:\Program Files (x86)\AULA\F75\Dev\kb\F75KR\KB.ini
        • Size 5KB
        • SHA256 4322384d510885e7f80b1280cbfdf47f00997684a4681ad12ccb3e3bfef9d3f0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        KB.ini

        • Path C:\Program Files (x86)\AULA\F75\Dev\kb\wired\KB.ini
        • Size 5KB
        • SHA256 57d22c2af54946717fbb1059a28db0c63cb2937afcfc54a4101d96e34bd931db
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-55RDS.tmp

        • Path C:\Program Files (x86)\AULA\F75\Dev\kb\wired\is-55RDS.tmp
        • Size 249KB
        • SHA256 166f1e311c5414eb5f3f6ed032c101f6128a14a69cf6cc62494afaeea7e8e7da
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OemDrv.exe

        • Path C:\Program Files (x86)\AULA\F75\OemDrv.exe
        • Size 2.5MB
        • SHA256 169d827903e9bc29acf3d10adebb35c79d98bd93128a711790baf3fa8e45e34e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appico.ico

        • Path C:\Program Files (x86)\AULA\F75\appico.ico
        • Size 141KB
        • SHA256 b43a53dc95f2564fa6512f99674794fc3b1cd07954d6e0552b08dc505f49218f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bracket_left.png

        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\bracket_left.png
        • Size 2KB
        • SHA256 5e3b18226e17fc720e8db66a34433a66b3d362a0bde7cb92d6ec00625445db35
        • MD5 SHA1 SHA512 TLSH

        bracket_right.png

        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\bracket_right.png
        • Size 2KB
        • SHA256 d0e21db4947092913a6184aba4c2f1b2e762ef0718b23f5d91497fd38d1332bb
        • MD5 SHA1 SHA512 TLSH

        copy_nr.png

        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\copy_nr.png
        • Size 2KB
        • SHA256 62235019cc93768e6fe3824f36f1ff8cb52509dbfa95f533638a83a8ffa217f0
        • MD5 SHA1 SHA512 TLSH

        copy_ov.png

        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\copy_ov.png
        • Size 2KB
        • SHA256 32ba93b200f1761b298fead53c4746a2c11d2115be9d9746763498ac57eeb7c8
        • MD5 SHA1 SHA512 TLSH

        del_nr.png

        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\del_nr.png
        • Size 3KB
        • SHA256 415e271d0dfa4511ee42e917ee1a08df56b2c8cfa4d954a06dd611ea35e4d6a9
        • MD5 SHA1 SHA512 TLSH

        del_ov.png

        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\del_ov.png
        • Size 3KB
        • SHA256 282985f6b17440706e8098fb1d86a88132aaddd2ddbb63f78b7be56028a9a418
        • MD5 SHA1 SHA512 TLSH

        dir_close.png

        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\dir_close.png
        • Size 2KB
        • SHA256 20dc6600daf41e597a4c68615113d26bae42cf54e7a9abc6173f61afcc918812
        • MD5 SHA1 SHA512 TLSH

        dir_open.png

        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\dir_open.png
        • Size 2KB
        • SHA256 88d08ca4121d98a2a6264d3802a55bbb8e2a76812b8e4f8d23dc0ec4964f7555
        • MD5 SHA1 SHA512 TLSH

        edit_nr.png

        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\edit_nr.png
        • Size 2KB
        • SHA256 5c44d49fb33be475b47414f8845e29f9cc88c6c963e8e685b02f08fc1c7be003
        • MD5 SHA1 SHA512 TLSH

        exit_nr.png

        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\exit_nr.png
        • Size 2KB
        • SHA256 0a6c490ac75f40c3d23351845521ff4d4614b347cea8d5b591cb99b33c9840aa
        • MD5 SHA1 SHA512 TLSH

        exit_ov.png

        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\exit_ov.png
        • Size 2KB
        • SHA256 3aac676de969011ae40f9ff7da88273aef99d0e4f76c0ac5f81e0013cc9c5eb9
        • MD5 SHA1 SHA512 TLSH

        export_nr.png

        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\export_nr.png
        • Size 2KB
        • SHA256 87268064b8dc53a36b52a4f4747c094442e4746582df171b92fbe4bcd5abb26b
        • MD5 SHA1 SHA512 TLSH

        export_ov.png

        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\export_ov.png
        • Size 2KB
        • SHA256 a6908ac6ca974ef0842cdd88595676a2163d7fd0070e9d643225f573ef10e290
        • MD5 SHA1 SHA512 TLSH

        import_nr.png

        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\import_nr.png
        • Size 2KB
        • SHA256 a2ddea92ffecce474d3cdab259f27f15d2ef6faf9c9a10743544e4a710515c79
        • MD5 SHA1 SHA512 TLSH

        import_ov.png

        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\import_ov.png
        • Size 2KB
        • SHA256 feb2017120ca9ba60d198c31ea5a98ffa099a2eb489773af3f1916b9fff3a386
        • MD5 SHA1 SHA512 TLSH

        min_nr.png

        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\min_nr.png
        • Size 2KB
        • SHA256 fc07072782f24efd01f584b05a9f11cba840119d1ff40aadf58befbad2d8adc1
        • MD5 SHA1 SHA512 TLSH

        min_ov.png

        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\min_ov.png
        • Size 2KB
        • SHA256 4e5580ff509d58f35d5d0b84c0b6f6fcaac7d6ef12c55feaea3ebc8ea6f08a9e
        • MD5 SHA1 SHA512 TLSH

        new_nr.png

        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\new_nr.png
        • Size 2KB
        • SHA256 dc407e41619893c1965c95de61627222720ada6f32d619fd0d3c9d86768fa66a
        • MD5 SHA1 SHA512 TLSH

        new_ov.png

        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\new_ov.png
        • Size 2KB
        • SHA256 97b1bf78bb214cb820b43f0e99c852c6bbf25793cee7e4cf1bb55408ace274a4
        • MD5 SHA1 SHA512 TLSH

        rename_nr.png

        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\rename_nr.png
        • Size 2KB
        • SHA256 3c46c296c283516bd5a9ed6c7057ca04b9384bfce5cc62ccc84c2d191a1b5333
        • MD5 SHA1 SHA512 TLSH

        rename_ov.png

        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\rename_ov.png
        • Size 2KB
        • SHA256 32980085c49826ec1b089abca7a2c85ba40b33fcf1bc75014dcba0c6111be388
        • MD5 SHA1 SHA512 TLSH

        save_nr.png

        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\save_nr.png
        • Size 386B
        • SHA256 107306efe5338845dcde65f47c0ab7b68d3c0e6b82fb77ef0cb0eba28d3f595c
        • MD5 SHA1 SHA512 TLSH

        save_ov.png

        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\save_ov.png
        • Size 351B
        • SHA256 8b456b81101539ede010288efaedd170109485be92c5fa5b422156a1599b63e4
        • MD5 SHA1 SHA512 TLSH

        share_nr.png

        • Path C:\Program Files (x86)\AULA\F75\skins\icon18x18\share_nr.png
        • Size 3KB
        • SHA256 f596a82c21ab2dcb62da6ddd5fa7a17a2375cc0aabaa9c465aa2b6e06bb49f93
        • MD5 SHA1 SHA512 TLSH

        main_nr.png

        • Path C:\Program Files (x86)\AULA\F75\skins\main_nr.png
        • Size 28KB
        • SHA256 d11793fbef0ed675c70109f16fdefca39be54cb323c90ecc956b5d579ac7c8e2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mak.skn

        • Path C:\Program Files (x86)\AULA\F75\skins\mak.skn
        • Size 520B
        • SHA256 147c687edec5a9a97d566353a77007308238bf8767e7f855e5c3cd46ac02b696
        • MD5 SHA1 SHA512 TLSH

        icon_kb_dn.png

        • Path C:\Program Files (x86)\AULA\F75\skins\other\icon_kb_dn.png
        • Size 601B
        • SHA256 1895de1d82178c3fca5de6413b67ff31c1ff960293943d039d4308fb01c27981
        • MD5 SHA1 SHA512 TLSH

        icon_ms_dn.png

        • Path C:\Program Files (x86)\AULA\F75\skins\other\icon_ms_dn.png
        • Size 761B
        • SHA256 4640cbd5cf8897d1e78616c7a1ef587e65bc22f68f30c138d1d7e5900ea9e51d
        • MD5 SHA1 SHA512 TLSH

        icon_ms_nr.png

        • Path C:\Program Files (x86)\AULA\F75\skins\other\icon_ms_nr.png
        • Size 552B
        • SHA256 8d88850136dc982ad4de34055a437980b8a8dc85805126de8a1b7a80d4e78554
        • MD5 SHA1 SHA512 TLSH

        kbico.png

        • Path C:\Program Files (x86)\AULA\F75\skins\other\kbico.png
        • Size 332B
        • SHA256 4da8f28652b1ae2d3e10df0dbf6271782ce239db6bd4f61f280b1146e5b9a7a1
        • MD5 SHA1 SHA512 TLSH

        mac_keydn.png

        • Path C:\Program Files (x86)\AULA\F75\skins\other\mac_keydn.png
        • Size 251B
        • SHA256 7eb7cf847568052d93ea8a693618a9e2a1bfefb82fc5219e0a989af333308af0
        • MD5 SHA1 SHA512 TLSH

        mac_keyup.png

        • Path C:\Program Files (x86)\AULA\F75\skins\other\mac_keyup.png
        • Size 258B
        • SHA256 bad3d998aeed2b8eb8d57e5b2e71249011d3058208ed2a9914ddebc3133d2254
        • MD5 SHA1 SHA512 TLSH

        macico.png

        • Path C:\Program Files (x86)\AULA\F75\skins\other\macico.png
        • Size 318B
        • SHA256 cbc4fecc558b53d40e28f63e040b27f6a12eed625d6aa8f47fddfd8ce448d655
        • MD5 SHA1 SHA512 TLSH

        msico.png

        • Path C:\Program Files (x86)\AULA\F75\skins\other\msico.png
        • Size 466B
        • SHA256 b1beaf9333a398761fc1fbbefc643b5301177d5b31ad15232d647eea550383f7
        • MD5 SHA1 SHA512 TLSH

        time.png

        • Path C:\Program Files (x86)\AULA\F75\skins\other\time.png
        • Size 331B
        • SHA256 5aa3df6debcb777e25969e410ca2ec5544f05febd13c8c2f0aad3362fe051964
        • MD5 SHA1 SHA512 TLSH

        user.png

        • Path C:\Program Files (x86)\AULA\F75\skins\user.png
        • Size 3KB
        • SHA256 b59eb21419b7f1cefea9361d649f0a692e6c122213b228022baa62d56465e84e
        • MD5 SHA1 SHA512 TLSH

        welcome.png

        • Path C:\Program Files (x86)\AULA\F75\skins\welcome.png
        • Size 411KB
        • SHA256 d052e86b982c2a0a356317d11bbb643fd124e15fd4889af7ce44d37491b8fca0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        text.xml

        • Path C:\Program Files (x86)\AULA\F75\text\en\text.xml
        • Size 23KB
        • SHA256 82fc5bf5f51765ba375efe654fa5493bccab80894a575e0d4556348fa4a56618
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lang.ini

        • Path C:\Users\Admin\AppData\Local\BYCOMBO4\lang.ini
        • Size 20B
        • SHA256 2c5451afc3ee4f44c5dbf63d07377485ecfa52a024ac869f0ee113c9c1cf59f0
        • MD5 SHA1 SHA512

        InitSetup.dll

        • Path C:\Users\Admin\AppData\Local\Temp\is-2KKG5.tmp\InitSetup.dll
        • Size 55KB
        • SHA256 72f5cfe575253eaff31e27ce8f70b4caaa079d2c42a4130515eecf7f0967115d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AULA F75 Setup v2.0 20240520.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\is-MNJA2.tmp\AULA F75 Setup v2.0 20240520.tmp
        • Size 1.2MB
        • SHA256 02eec62b7139a7cfc747d5f897ccedcf76ea154ec63ede231436a0f89e317387
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/3452-380-0x0000000000400000-0x0000000000451000-memory.dmp

        memory/3452-2-0x000000000041E000-0x000000000041F000-memory.dmp

        memory/3452-16-0x0000000000400000-0x0000000000451000-memory.dmp

        memory/3452-0-0x0000000000400000-0x0000000000451000-memory.dmp

        memory/4256-379-0x0000000000400000-0x0000000000558000-memory.dmp

        memory/4256-8-0x0000000000400000-0x0000000000558000-memory.dmp

        memory/4256-9-0x0000000000400000-0x0000000000558000-memory.dmp

        memory/4256-10-0x0000000000400000-0x0000000000558000-memory.dmp

        memory/4256-18-0x0000000000400000-0x0000000000558000-memory.dmp

        memory/4256-20-0x0000000000400000-0x0000000000558000-memory.dmp

        memory/4256-22-0x0000000000400000-0x0000000000558000-memory.dmp

        memory/4256-373-0x0000000000400000-0x0000000000558000-memory.dmp