b6a46908c96e8c6fb104c0f05f57e4d7ac193bef2b9d7a682ed49ec7607a9e4f

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 1.0MB
Sample261027-dbd7ea1tas
SHA256 b6a46908c96e8c6fb104c0f05f57e4d7ac193bef2b9d7a682ed49ec7607a9e4f
MD5 68342d49a6584b0ac6ebbcb36a0f9a4f
SHA1 4f9ba88806311c4095aa1c898073d54f8efe9cb3
SHA512 bb8690206f7b550c58426cb03a827936b19f710667666e1f6e97d9c8eb77e2e48675ec6cc8d782e1d3ddaa67eed384aa8e11cdc15f3545859de8021eb753290c
SSDEEP 24576:aG/n++MsJsATY9jti35ouaZlTMWmxon8lRYS3R9Ww6OyL26qj9u:au/MysATn3LIlTX4on8lv3Ry5L3qj9u
TLSH
T15635236468E682FBD84B147225359768832BD9BB5972CEC7AF43798D4867FD30D30A0C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2616	Setup.exe
2616	Setup.exe
2616	Setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	Setup.exe
File opened (read-only)	\??\A:	Setup.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Agni\CCLA1\xxxxxxxx.yyy	Setup.exe
File opened for modification	C:\Program Files (x86)\Agni\CCLA1\	Setup.exe
File created	C:\Program Files (x86)\Agni\CCLA1\ccla.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\Agni\CCLA1\uninstal.log	Setup.exe
File created	C:\Program Files (x86)\Agni\CCLA1\xxxxxxxx.yyy	Setup.exe
File opened for modification	C:\Program Files (x86)\Agni\	Setup.exe
File opened for modification	C:\Program Files (x86)\Agni\CCLA1\ccla.exe	Setup.exe
File created	C:\Program Files (x86)\Agni\CCLA1\uninstal.log	Setup.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\unvise32.exe	Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Setup.exe

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2616

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ccla.exe

Path C:\Program Files (x86)\Agni\CCLA1\ccla.exe
Size 820KB
SHA256 074218ff5be8c91b0f20458fdd8b12ef1ba561dd046a9d186b27c39e17a6a736
MD5 00317f4f4b55cbd1ad295d254ee33c0d
SHA1 90ffa6713332ff0978ffffcd119841d5b1dab24e
SHA512 2acb1a154b453215f5e91886baee51358e933d7d282bc298bf53601215abaa0f46170193e6ec288dffb7b492b00d4fe57b0d7a6eafd84c192d31bf938cedfe6c
SSDEEP 24576:NyNNFysBpGAxe6NJyF1sBBCwwjMjjjjjjjpUqSsUs:NkLysBpGIe6rosBBCwwjMjjjjjjjKdsH
TLSH
T1BD05E022B3455321CC5621B10B1793DAAB15BC24FE77064335EDB34EEA72D9B843AB6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

English.vlg

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\English.vlg
Size 13KB
SHA256 75081f741b450b8049d3a0106121516745bba675681fb490e78b7978238258d5
MD5 707e3b6418526ed6729deb4a1307f1f2
SHA1 521a175e2e18ad316c8fbf25aa35c35dbf449668
SHA512 cbf15467cbd0797a8ec781ce8fcae416c9dd30db052e32c85aa717ec955e24f5592ab937c2f8b82e7cf862c09a4a5d767808b56000bf3942da58c457a3fbcc86
SSDEEP 192:juireshg6lzCsFxDV6E6iVe9SVcZTCnfuxoiWR8UC+TdvnNLfPmCTwmOuG:juiv7t6E6i44VnfJiWRRvnNLfPmCg
TLSH
T18C52A78E5B4683B62A9102DBE28F37C365D0C05F126E159141E6B07D73AA745C3EB2D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccla1.jpg

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\ccla1.jpg
Size 59KB
SHA256 eabe1f01ad8df285a15d3bd0ecd5d56616615e9af1ed96cf4a7b6d9dd17185c4
MD5 785c4442d90a7a23cd840ac47f9e0cd5
SHA1 beadb65ef4f3e40053447db80fd39688a5e87405
SHA512 88beee0b1b94365bfb510c336cd5f10b116670722c926a10b1564d3f09b24d3b7b8c830aa53c676a2071ff15313b192e736b6408cbfb9ce610c58b3a1c0cd9a3
SSDEEP 1536:SpAA9vx663HM5mz3XDM0vP3bxGsqyr8h/GZAfeDeF:Sv5663WgbxgydK
TLSH
T11F5302CA98BB7F1DB1D1233C6E1B814AA29D1A09561BC514F0EDFE72C89CD1D80B4E6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\jpeg.dll
Size 104KB
SHA256 c83e2f98b9182073002b24c731f9fe0512bc4a3b468181c677d20fc465218232
MD5 0da8449291b80aac6c6f7e356d14ba36
SHA1 421456596c690b69d262dcb5e96f474c3c92ab14
SHA512 4e99332b791a7629d8541fce0e3d56d3452168abbbe5e56e38d79edb440bf1e12ca2d73d2f79d78a5c2ba282ab3ff84103691153fe26da670e9a9a28f75713ac
SSDEEP 1536:+ouMgB/g8nm5mAifWSyUtdKTgopIZ/sh5iTjHoDVK:+ouMgBIe7hp/oi/HoDVK
TLSH
T148A3B03176A04071D0E70276165AAF2EDFBE23620AEE5ED3877869501F309B1FE37586
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rollback.log

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\rollback.log
Size 91B
SHA256 d5209cd88790b734d4f58043393791cf2ae0bf16cb64a9ad9425c5dbed249c1f
MD5 6b70b99c07157ef076161acd8cce1fc6
SHA1 f1ad35ad8555795e06157acc6e4ef0fde14983e0
SHA512 c99b101223b955e3c2f24bbdef825ed78f5fa55bf557e8910374a1120f6fec0a5bd46ae65b1b64ded3a8f77290a3351446e0412c8888d97b4a115f15778a8142
TLSH
T128B012008422C2C03103FB8933481D18921C8C0435670061A684CF1740C0D5830AC170
MD5 SHA1 SHA512 TLSH

Submit Download

rollback.log

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\rollback.log
Size 500B
SHA256 4a006dbd0662b52da0e6315903d8fdeb0c631614002046860c51fb238600fa70
MD5 022a609185017f23ed0fc3083ed4e182
SHA1 8e2b3eb0034f8628feceb8b745df6de02046e93f
SHA512 4e23fbf10c883a1fd31f349be48e839d0cbf0bca06cf0f1aff338447131e75d11e41ca4c8e1ae95b838f487374cdc30d47bba81e217d47c2a84c4587917141a4
TLSH
T122F0B4A4D425D684B5A37581234AAD0CC1CCD945B99B1AF3D0CC871FE84AE19B1F9193
MD5 SHA1 SHA512 TLSH

Submit Download

side.jpg

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\side.jpg
Size 15KB
SHA256 6d0d253ae5a5898e1ab5cdd8aec0db9c22f1d8ccbebc67d7a1f55fc46f3ce3a4
MD5 0628eead1cc860656cc645de759ab0f7
SHA1 47e4d7f66e42187809b1316d433e93ef58ba9158
SHA512 3b8e032f398d4529a32340f4181458f82f8ec34fb53c5cdd6b5dbab72e421cf7b09d3956b8e9be1c1eb7201dd87068a7d9071fa3882eecdfb4f4a4fb45508dc4
SSDEEP 384:0HYocJ0uBMEU570gXIeUmDHF1+JB0qJR9:0HtcCueh5nIJmh1WCqp
TLSH
T1D962D0D377CBA233A660CE62D57A29CF6635CD002B4199921D2D00C8F471D6716C876F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstal.log

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
Size 298B
SHA256 9b4dd959c2d5214f17fae9387099d0240835367ea1804d2102bc6d48c28061bd
MD5 7578b68925d152ad0cf276142a16dd1a
SHA1 7e3c885e92b2bff7d256a0a0c50875ee0d10f094
SHA512 8cc5be7c4df500a4c49813fc79a7a758f6b5603193645f2de91ff596138b8d8abd786835ff8c94024235868b16c3d886e8374d81742e17e31430bb76b95b3ee1
TLSH
T1F1E0C292D405D6D938C36DC93799199D518C8944A8A700A9F2CCCB8B98C0E3573AA4B2
MD5 SHA1 SHA512 TLSH

Submit Download

uninstal.log

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
Size 491B
SHA256 ae467eb48efa9f4147d4bbefada0a8d37834f9a9a94d170220846e2e7c7adec3
MD5 15e45728deba145678bfb23d46d105a2
SHA1 da97678cb257aca62413c058e6c1c43ed7c363a9
SHA512 a593761b105de6e78f0cc2ba8b0b533276c68f92dc2685e576833c6eacbaf39970c3fdc79d705d5b26f8cf38d65533fce7fe4c5b6578f289ea598abbf0252aff
TLSH
T1B6F0BE41D41693D574A37889375D5D4DA24CC949B99B49AAE1CCCB0B98C0E34B2BC0B2
MD5 SHA1 SHA512 TLSH

Submit Download

uninstal.log

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
Size 633B
SHA256 82919f5dd6dc05fcfbde680bdbeeb04b59bc50c1c3a0b58265f6271e3a2d4590
MD5 273894723ae1ea9eeb180094b90b06da
SHA1 c8922dec3bd200ddcdb449cfddba688e661e4ef9
SHA512 81b43c24f5ae324a1edb618f1380a60b1d53aa47cdc382cc709890ffdd067c383240ba7bdb0416b08e694e2affeeb7405afcbd98dae036db1e18b132b0c695e9
TLSH
T1A3F0D640C01593C6B0A33988274E5E0C928CC945B99B4ABBE0CC975FE885F65B1BD0E2
MD5 SHA1 SHA512 TLSH

Submit Download

uninstal.log

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
Size 1KB
SHA256 58a79203d48a266863744984f5aa397bdc3adb3f17ee2351481e4a091179676b
MD5 e49900bd70436ae14462437d78ade2fd
SHA1 5186344857d1251122a38c792a444eaf0a742b0b
SHA512 1a4f28583806c985eb146c9187ac1cb477c3af8a049262ed50a2084c523218cb3dfa5b073665b3ea2b1f0e49d42415fd1b6790ae33e8d4d9f906c7b5799edf50
TLSH
T17331C154D22143C575E33186178E1ACA52C8C94B766F2AE3E0CDA11FA64BF1872BE0C2
MD5 SHA1 SHA512 TLSH

Submit Download

uninstal.log

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
Size 261B
SHA256 cdf31c9a40240173269f01539233825e43eed3dd4693c8c5f3caf3b58719df62
MD5 2665a6e50104a259864afb093d907de4
SHA1 daf95cf3ce5a49ad666caa3b3261c5a141f463d7
SHA512 96eb0fffcaeeccc1022cdb55c08cfc332db4f465dc1deef724c399064112b4bd7c0e8dfd28c807a9bb93a89daecd1214c6b6d0f2fce84ed804a609631fa8a3b2
TLSH
T16CD02B92D401924934C22CC833451A89018C4540A49700A8F1CCC34B98C4D3533AA0B2
MD5 SHA1 SHA512 TLSH

Submit Download

vise32ex.dll

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\vise32ex.dll
Size 496KB
SHA256 6d4209a51dedb0aedcdfd5cbed6fc80dbc34b51cd1dc176d788f07b5cdf06642
MD5 db798587868984eb838a71338f6ffe53
SHA1 c9fef0b8e6806137f29beb8c0eae04f1c5bb8c39
SHA512 1e6f4ce4156693f9f9a8f70b8b9ff5080a27ac903929ae7aefd277c455d088aaf6b19ddc1edc131eb552eada877462829473885804df7f9246d412754d098c58
SSDEEP 12288:Ibyt0WsROjuYUM7sSm4GVv/5er2jlOZNs+4:cyt0RdQo56WUZW+4
TLSH
T1C6B48D51AA56A8BDD15CF6B4309E7B352E3ACF44423A87C3D375DC366D21281AE3930E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unvise32.exe

Path C:\Windows\unvise32.exe
Size 84KB
SHA256 f241f37d423dd5c192b22ca1d4655dbf9e9b861487a6ac0f958b190e975934dc
MD5 84b4f61f59a421bd85d97b35d194b42b
SHA1 d3f2bac1a72f82c42d551c066c8ec841f46adb60
SHA512 4bbbe843a56e5b3a554a23e16450ce33543c6a7a37e917908e7ab1c7a729700b3f04a83bccadd126017ab5fca73d57e9caef085d349112672c14328e05d66b88
SSDEEP 1536:Pche6hyD7/XwxVwSmIULfBTpgj8wJK92a+SoLJMA:PkzhyDLXiwoULJE8wJK4a+So9T
TLSH
T189836C127BD184B2F5B92632386D7F7ADA3FEE050131CA874360EF562D316C1E929396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2616-46-0x00000000035E0000-0x00000000035FB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads