b6a46908c96e8c6fb104c0f05f57e4d7ac193bef2b9d7a682ed49ec7607a9e4f

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 1.0MB
Sample261027-dbd7ea1tas
SHA256 b6a46908c96e8c6fb104c0f05f57e4d7ac193bef2b9d7a682ed49ec7607a9e4f
MD5 68342d49a6584b0ac6ebbcb36a0f9a4f
SHA1 4f9ba88806311c4095aa1c898073d54f8efe9cb3
SHA512 bb8690206f7b550c58426cb03a827936b19f710667666e1f6e97d9c8eb77e2e48675ec6cc8d782e1d3ddaa67eed384aa8e11cdc15f3545859de8021eb753290c
SSDEEP 24576:aG/n++MsJsATY9jti35ouaZlTMWmxon8lRYS3R9Ww6OyL26qj9u:au/MysATn3LIlTX4on8lv3Ry5L3qj9u
TLSH
T15635236468E682FBD84B147225359768832BD9BB5972CEC7AF43798D4867FD30D30A0C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
960	Setup.exe
960	Setup.exe
960	Setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	Setup.exe
File opened (read-only)	\??\A:	Setup.exe
File opened (read-only)	\??\B:	Setup.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Agni\CCLA1\xxxxxxxx.yyy	Setup.exe
File created	C:\Program Files (x86)\Agni\CCLA1\ccla.exe	Setup.exe
File created	C:\Program Files (x86)\Agni\CCLA1\uninstal.log	Setup.exe
File opened for modification	C:\Program Files (x86)\Agni\CCLA1\uninstal.log	Setup.exe
File created	C:\Program Files (x86)\Agni\CCLA1\xxxxxxxx.yyy	Setup.exe
File opened for modification	C:\Program Files (x86)\Agni\CCLA1\	Setup.exe
File opened for modification	C:\Program Files (x86)\Agni\	Setup.exe
File opened for modification	C:\Program Files (x86)\Agni\CCLA1\ccla.exe	Setup.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\unvise32.exe	Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0\0	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	Setup.exe

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2548

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ccla.exe

Path C:\Program Files (x86)\Agni\CCLA1\ccla.exe
Size 820KB
SHA256 074218ff5be8c91b0f20458fdd8b12ef1ba561dd046a9d186b27c39e17a6a736
MD5 00317f4f4b55cbd1ad295d254ee33c0d
SHA1 90ffa6713332ff0978ffffcd119841d5b1dab24e
SHA512 2acb1a154b453215f5e91886baee51358e933d7d282bc298bf53601215abaa0f46170193e6ec288dffb7b492b00d4fe57b0d7a6eafd84c192d31bf938cedfe6c
SSDEEP 24576:NyNNFysBpGAxe6NJyF1sBBCwwjMjjjjjjjpUqSsUs:NkLysBpGIe6rosBBCwwjMjjjjjjjKdsH
TLSH
T1BD05E022B3455321CC5621B10B1793DAAB15BC24FE77064335EDB34EEA72D9B843AB6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

English.vlg

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\English.vlg
Size 13KB
SHA256 75081f741b450b8049d3a0106121516745bba675681fb490e78b7978238258d5
MD5 707e3b6418526ed6729deb4a1307f1f2
SHA1 521a175e2e18ad316c8fbf25aa35c35dbf449668
SHA512 cbf15467cbd0797a8ec781ce8fcae416c9dd30db052e32c85aa717ec955e24f5592ab937c2f8b82e7cf862c09a4a5d767808b56000bf3942da58c457a3fbcc86
SSDEEP 192:juireshg6lzCsFxDV6E6iVe9SVcZTCnfuxoiWR8UC+TdvnNLfPmCTwmOuG:juiv7t6E6i44VnfJiWRRvnNLfPmCg
TLSH
T18C52A78E5B4683B62A9102DBE28F37C365D0C05F126E159141E6B07D73AA745C3EB2D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccla1.jpg

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\ccla1.jpg
Size 59KB
SHA256 eabe1f01ad8df285a15d3bd0ecd5d56616615e9af1ed96cf4a7b6d9dd17185c4
MD5 785c4442d90a7a23cd840ac47f9e0cd5
SHA1 beadb65ef4f3e40053447db80fd39688a5e87405
SHA512 88beee0b1b94365bfb510c336cd5f10b116670722c926a10b1564d3f09b24d3b7b8c830aa53c676a2071ff15313b192e736b6408cbfb9ce610c58b3a1c0cd9a3
SSDEEP 1536:SpAA9vx663HM5mz3XDM0vP3bxGsqyr8h/GZAfeDeF:Sv5663WgbxgydK
TLSH
T11F5302CA98BB7F1DB1D1233C6E1B814AA29D1A09561BC514F0EDFE72C89CD1D80B4E6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\jpeg.dll
Size 104KB
SHA256 c83e2f98b9182073002b24c731f9fe0512bc4a3b468181c677d20fc465218232
MD5 0da8449291b80aac6c6f7e356d14ba36
SHA1 421456596c690b69d262dcb5e96f474c3c92ab14
SHA512 4e99332b791a7629d8541fce0e3d56d3452168abbbe5e56e38d79edb440bf1e12ca2d73d2f79d78a5c2ba282ab3ff84103691153fe26da670e9a9a28f75713ac
SSDEEP 1536:+ouMgB/g8nm5mAifWSyUtdKTgopIZ/sh5iTjHoDVK:+ouMgBIe7hp/oi/HoDVK
TLSH
T148A3B03176A04071D0E70276165AAF2EDFBE23620AEE5ED3877869501F309B1FE37586
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rollback.log

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\rollback.log
Size 91B
SHA256 d5209cd88790b734d4f58043393791cf2ae0bf16cb64a9ad9425c5dbed249c1f
MD5 6b70b99c07157ef076161acd8cce1fc6
SHA1 f1ad35ad8555795e06157acc6e4ef0fde14983e0
SHA512 c99b101223b955e3c2f24bbdef825ed78f5fa55bf557e8910374a1120f6fec0a5bd46ae65b1b64ded3a8f77290a3351446e0412c8888d97b4a115f15778a8142
TLSH
T128B012008422C2C03103FB8933481D18921C8C0435670061A684CF1740C0D5830AC170
MD5 SHA1 SHA512 TLSH

Submit Download

rollback.log

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\rollback.log
Size 161B
SHA256 3653ff73096f3fd3d9b3156608e23814ebe57a06186c4ce08336f6e47c2f3284
MD5 b32e1ef4497e906f250138bb99dee285
SHA1 d75cfbfdb6e1e32d7581bc94f9dc753d6c787bea
SHA512 b00cae288abb8746283cacd8a648829a78da2fd5947eb95454c8c135849d26ab03689380a6133c42ed18612aa6266514ccb75129baf1e73392b771294fb01fef
TLSH
T1A9C04C169426C6D47697FA9933581D1CE61D9D48796710A6A688DF1B84C0D6C60EC1B0
MD5 SHA1 SHA512 TLSH

Submit Download

rollback.log

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\rollback.log
Size 370B
SHA256 f65499b045f29bd02f9e64f24e7ea625f1b2ac8e8808b4bd59188f94d605673d
MD5 cfde5247c8cde2c584b70fec2b4ca8b3
SHA1 2b431c72a3f3c23f1ca513b014beb0e0ef7071b2
SHA512 a1f063bfa84f13c15d1226d8d25a5612836ed78791d61c96b3c8e7683849a2360f28e7e25df066160e6cfc44d6062649f32931c0f2dd12a27b954ee8e92191f8
TLSH
T14FE09264D431D2C4B1A3758523496E0CC2CCD948799B16F391CCCB1FD88AE18B1FD1A2
MD5 SHA1 SHA512 TLSH

Submit Download

side.jpg

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\side.jpg
Size 15KB
SHA256 6d0d253ae5a5898e1ab5cdd8aec0db9c22f1d8ccbebc67d7a1f55fc46f3ce3a4
MD5 0628eead1cc860656cc645de759ab0f7
SHA1 47e4d7f66e42187809b1316d433e93ef58ba9158
SHA512 3b8e032f398d4529a32340f4181458f82f8ec34fb53c5cdd6b5dbab72e421cf7b09d3956b8e9be1c1eb7201dd87068a7d9071fa3882eecdfb4f4a4fb45508dc4
SSDEEP 384:0HYocJ0uBMEU570gXIeUmDHF1+JB0qJR9:0HtcCueh5nIJmh1WCqp
TLSH
T1D962D0D377CBA233A660CE62D57A29CF6635CD002B4199921D2D00C8F471D6716C876F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninst32.exe

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninst32.exe
Size 84KB
SHA256 f241f37d423dd5c192b22ca1d4655dbf9e9b861487a6ac0f958b190e975934dc
MD5 84b4f61f59a421bd85d97b35d194b42b
SHA1 d3f2bac1a72f82c42d551c066c8ec841f46adb60
SHA512 4bbbe843a56e5b3a554a23e16450ce33543c6a7a37e917908e7ab1c7a729700b3f04a83bccadd126017ab5fca73d57e9caef085d349112672c14328e05d66b88
SSDEEP 1536:Pche6hyD7/XwxVwSmIULfBTpgj8wJK92a+SoLJMA:PkzhyDLXiwoULJE8wJK4a+So9T
TLSH
T189836C127BD184B2F5B92632386D7F7ADA3FEE050131CA874360EF562D316C1E929396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstal.log

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
Size 362B
SHA256 95b79dd3a025b6ee041bde54ba17ae634b513123f3f35056c3db7ffd77254b4b
MD5 7b72ca6853a595c7bfaf25d0a1a6ca09
SHA1 9eaf3111e8bc1cb309e20242f9891f4418469ec9
SHA512 f3043839a1ae1ab6b66566c5d017961fbb332051219ada4aeb8622058e1c3c760a42fce7238c7841c764dd0e0fcd56af9f5559acec347df3fcc1b5a0df327d33
TLSH
T16AE0DF52D409C6D938C3BDC933992D9D528C8944A8A700EAF2CCCB4B98C0E3872ED0B1
MD5 SHA1 SHA512 TLSH

Submit Download

uninstal.log

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
Size 444B
SHA256 37ea562422bd0b206c811d9190bda5f88201633e341a538c55a879730360215c
MD5 b3b279afb1092386ecc50de5cde588ad
SHA1 45917678df21d3f5d2715dcf2828b8f4ed7c956d
SHA512 67d34292a1d73764722a6cae21ab9f69f7f5f54da4f082abab424c87841097458bc08202f074f75b5cbe58ede601fdacf8ce70bf223b704c90da7a57e3bb88b2
TLSH
T1CFF0A041D406D3D9749378C9374D1D5DA28CC949B99B04AAF1CCCB4B98C0E34B2BD0B1
MD5 SHA1 SHA512 TLSH

Submit Download

uninstal.log

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
Size 547B
SHA256 0497424b68b3dd0629723c5af92369c118ada87cb9115d6c6186414282b5c421
MD5 a62b9a90b743b27121419f93e5b9ffba
SHA1 204cb6a934086894a2d38766a955f4a7b64bb404
SHA512 bfd398b509b56090335a57b1aa985b1e4b9c4167b78caa41673205ad9d13b8c00b9e15448448313f701da0a262a810ef8d8727beff6ecb6e7312a8ac6be31b2c
TLSH
T10CF0F041D01693C6B0A37988374E1E0CA24CC949B99B49ABE0CCC71FE8C1F70B1BC0E2
MD5 SHA1 SHA512 TLSH

Submit Download

uninstal.log

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
Size 1KB
SHA256 58a79203d48a266863744984f5aa397bdc3adb3f17ee2351481e4a091179676b
MD5 e49900bd70436ae14462437d78ade2fd
SHA1 5186344857d1251122a38c792a444eaf0a742b0b
SHA512 1a4f28583806c985eb146c9187ac1cb477c3af8a049262ed50a2084c523218cb3dfa5b073665b3ea2b1f0e49d42415fd1b6790ae33e8d4d9f906c7b5799edf50
TLSH
T17331C154D22143C575E33186178E1ACA52C8C94B766F2AE3E0CDA11FA64BF1872BE0C2
MD5 SHA1 SHA512 TLSH

Submit Download

uninstal.log

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
Size 298B
SHA256 9b4dd959c2d5214f17fae9387099d0240835367ea1804d2102bc6d48c28061bd
MD5 7578b68925d152ad0cf276142a16dd1a
SHA1 7e3c885e92b2bff7d256a0a0c50875ee0d10f094
SHA512 8cc5be7c4df500a4c49813fc79a7a758f6b5603193645f2de91ff596138b8d8abd786835ff8c94024235868b16c3d886e8374d81742e17e31430bb76b95b3ee1
TLSH
T1F1E0C292D405D6D938C36DC93799199D518C8944A8A700A9F2CCCB8B98C0E3573AA4B2
MD5 SHA1 SHA512 TLSH

Submit Download

vise32ex.dll

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\vise32ex.dll
Size 496KB
SHA256 6d4209a51dedb0aedcdfd5cbed6fc80dbc34b51cd1dc176d788f07b5cdf06642
MD5 db798587868984eb838a71338f6ffe53
SHA1 c9fef0b8e6806137f29beb8c0eae04f1c5bb8c39
SHA512 1e6f4ce4156693f9f9a8f70b8b9ff5080a27ac903929ae7aefd277c455d088aaf6b19ddc1edc131eb552eada877462829473885804df7f9246d412754d098c58
SSDEEP 12288:Ibyt0WsROjuYUM7sSm4GVv/5er2jlOZNs+4:cyt0RdQo56WUZW+4
TLSH
T1C6B48D51AA56A8BDD15CF6B4309E7B352E3ACF44423A87C3D375DC366D21281AE3930E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/960-46-0x00000000029D0000-0x00000000029EB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads