57d2dc96bedd504680c1526b354bd925b2fa2ba0ce7ce9f4b0157081776dd6f2

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 893KB
Sample261027-dbe4psaz5p
SHA256 57d2dc96bedd504680c1526b354bd925b2fa2ba0ce7ce9f4b0157081776dd6f2
MD5 793e2325b692dc349b4616496ddac434
SHA1 e8a9856ddc95242871e9142f184dfe854a498ebe
SHA512 7b3d030ace1a8dc5bb1387cd3c7bdd6a728c0fc2c2ed39d7dadbd28d3f9b944141b1c2e457d8b3a11988e16e06a2ab3ee25cd83d12eb2be2b48d2ac1c12d0811
SSDEEP 24576:aGin++MsJsATY9jti3pouf8HqiWmxon8lRYS3R9Bn:ar/MysATn37Uqp4on8lv3Rn
TLSH
T10415232829E281FBD44B15B2157597AC871BDCBB4672CACBAB43788D9C77BD24D3420C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
4540	Setup.exe
4540	Setup.exe
4540	Setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	Setup.exe
File opened (read-only)	\??\B:	Setup.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Agni\CCLA2\xxxxxxxx.yyy	Setup.exe
File opened for modification	C:\Program Files (x86)\Agni\CCLA2\ccla2.exe	Setup.exe
File created	C:\Program Files (x86)\Agni\CCLA2\uninstal.log	Setup.exe
File opened for modification	C:\Program Files (x86)\Agni\CCLA2\uninstal.log	Setup.exe
File created	C:\Program Files (x86)\Agni\CCLA2\xxxxxxxx.yyy	Setup.exe
File opened for modification	C:\Program Files (x86)\Agni\CCLA2\	Setup.exe
File opened for modification	C:\Program Files (x86)\Agni\	Setup.exe
File created	C:\Program Files (x86)\Agni\CCLA2\ccla2.exe	Setup.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\unvise32.exe	Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	Setup.exe

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4540

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ccla2.exe

Path C:\Program Files (x86)\Agni\CCLA2\ccla2.exe
Size 505KB
SHA256 27e3b8557d8ad679893963eb022c20d26b5c519494aca5d23d4234ee613fb5a5
MD5 cde633cda19980035c5259aa1d59cb4b
SHA1 e47da882afb6fac832179e01aceca41a59c8244e
SHA512 75474a2917dfdce24b9023ff753f613880d480e4b32dcbda148c2fb89c817ae9be29ae50f89be12ff60bfcc75d939d8d30c0bba638f141c3885f6700861677d4
SSDEEP 12288:NyTZNF+Q2ryN/MapeK7+AxaqpgeLNJqsSv81XNs:NyNNFysBpGAxe6NJdSv4Ns
TLSH
T13BB4DF21BB4D6350C49601B11F1383C55F24BC18BAEA4A9F359EB20FEA72B39953DB0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

English.vlg

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\English.vlg
Size 13KB
SHA256 75081f741b450b8049d3a0106121516745bba675681fb490e78b7978238258d5
MD5 707e3b6418526ed6729deb4a1307f1f2
SHA1 521a175e2e18ad316c8fbf25aa35c35dbf449668
SHA512 cbf15467cbd0797a8ec781ce8fcae416c9dd30db052e32c85aa717ec955e24f5592ab937c2f8b82e7cf862c09a4a5d767808b56000bf3942da58c457a3fbcc86
SSDEEP 192:juireshg6lzCsFxDV6E6iVe9SVcZTCnfuxoiWR8UC+TdvnNLfPmCTwmOuG:juiv7t6E6i44VnfJiWRRvnNLfPmCg
TLSH
T18C52A78E5B4683B62A9102DBE28F37C365D0C05F126E159141E6B07D73AA745C3EB2D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccla2.jpg

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\ccla2.jpg
Size 61KB
SHA256 7c0404c0947cbb90c71333ad4d4e9f4165f0af4011ca57bb907e7cfdb200708c
MD5 b011d8836302b4dbee8807ca06c6f3d4
SHA1 dbe82b93ed796260769778484371b29f75750db5
SHA512 9d3445b7fd71d6892527f8384266373838f895bff5b8d6600c2a4c07f14444beab4030f3dbb6006b0d9c899912701877cbffd0c088ebb994fe05788b36962ef4
SSDEEP 1536:qyuOgguCvcmnJBSeXGczF2NtpeE4KBzTwE//TXz4nUk2rezjIJ:IguleXGgctsY/782kjI
TLSH
T11053F1F2C2DF25F3EB5B7311768B5A44D94A36E619518C0BF09FB3F1C605A28938532A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.bmp

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\default.bmp
Size 18KB
SHA256 d9d5e28eb445e7986bdef4d409868af205d525f2f0729427dfe3e33a7251b15d
MD5 f372b11ff99bffed4cd279c0155adede
SHA1 89cbf60925076e9a14fd48b13790422b43a5b989
SHA512 e902f0d7ff0e2af64ce3e8ae6d704ec21b04b35ac3f25a9acd53938b3b66fbaa02b25e816202f165e2d7339b62d2cd6fe9f764d64eefd5b24d1a108cb4b2679f
SSDEEP 48:gqPrH9b8On073Nbk4HvZ/vzjv6UqZf48jYrwtPE4aODu1jqngAz7l3jdK:gqDHeR3uYh/vmfVjY2PEXg7l3xK
TLSH
T1F382681B2149361926ED6A225629AFECC411DE4B017C99FDD43BF73742B096ACE3740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\jpeg.dll
Size 104KB
SHA256 c83e2f98b9182073002b24c731f9fe0512bc4a3b468181c677d20fc465218232
MD5 0da8449291b80aac6c6f7e356d14ba36
SHA1 421456596c690b69d262dcb5e96f474c3c92ab14
SHA512 4e99332b791a7629d8541fce0e3d56d3452168abbbe5e56e38d79edb440bf1e12ca2d73d2f79d78a5c2ba282ab3ff84103691153fe26da670e9a9a28f75713ac
SSDEEP 1536:+ouMgB/g8nm5mAifWSyUtdKTgopIZ/sh5iTjHoDVK:+ouMgBIe7hp/oi/HoDVK
TLSH
T148A3B03176A04071D0E70276165AAF2EDFBE23620AEE5ED3877869501F309B1FE37586
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rollback.log

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\rollback.log
Size 91B
SHA256 7f9e0769f1f2ca27c1254ad2c0ea7e9f1a819be5044db24843b8d124ced42cb6
MD5 e8935370a5aad90966543dd35a3b709e
SHA1 dc5491ac189793a22ff741bba313c96ff2810f7a
SHA512 a56cfbadf6e89e365a7df496faa7e804f12aab1e7db43495c75c3ef4cbfe071c6ca73d838afc4cc8cb2fa269b790e27b82549433b4e1da14f4441b781d8ab5f2
TLSH
T158B012109422C2C03103FA8933481D18921C8C0435670061A684CB1740C0D5870AC170
MD5 SHA1 SHA512 TLSH

Submit Download

rollback.log

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\rollback.log
Size 501B
SHA256 97b5a30b258e3afd6ca757a506cfa42e4a05ab177261faa0163ef529f1c19b22
MD5 7c8d297b6adfc44960b63780e9924417
SHA1 51e1a75bd4f48e54031ca6714141d1ea5d8fc4af
SHA512 c4e0c2923d9c1f8ae7b02dee1a1980fb6fea8ac1175f1cffda551ceacb97bd272a10c9c9f783434267ee3ed3c5247ebe3cc022bec471789a69c80cec4be0499c
TLSH
T1E6F09034D424D680B1A37482234AAD0C81C8D94579DA4AF2D4CCC21FE84AE09B0F9193
MD5 SHA1 SHA512 TLSH

Submit Download

side.jpg

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\side.jpg
Size 15KB
SHA256 6d0d253ae5a5898e1ab5cdd8aec0db9c22f1d8ccbebc67d7a1f55fc46f3ce3a4
MD5 0628eead1cc860656cc645de759ab0f7
SHA1 47e4d7f66e42187809b1316d433e93ef58ba9158
SHA512 3b8e032f398d4529a32340f4181458f82f8ec34fb53c5cdd6b5dbab72e421cf7b09d3956b8e9be1c1eb7201dd87068a7d9071fa3882eecdfb4f4a4fb45508dc4
SSDEEP 384:0HYocJ0uBMEU570gXIeUmDHF1+JB0qJR9:0HtcCueh5nIJmh1WCqp
TLSH
T1D962D0D377CBA233A660CE62D57A29CF6635CD002B4199921D2D00C8F471D6716C876F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstal.log

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
Size 298B
SHA256 a43ed09ecd74c5d158c0e059fdb26add13f2eb4e744bac22df3789bad27eaa76
MD5 4b7a66d6f26b29096a62aed263a6599c
SHA1 07d188f7a268e5fd8f05c9a9038334b7d1f34665
SHA512 f6e14291f8553507d049647fcd468acbfe668ee3d6c881ee02b0e7f728ce4ebe9503685ef29b86ed1e8c0f6a51dcd60f5c5ba1cc090772fb238e11d24dcff571
TLSH
T14BE0C212D405C69638C36CC9379D199C518C894468E600A9F6CCC78B98C0E3572AA4B3
MD5 SHA1 SHA512 TLSH

Submit Download

uninstal.log

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
Size 363B
SHA256 19edd3b87700b3e3eb14e1f810b102ef93dfd79b2aa1fff3428725c3a8f78cdb
MD5 ad41954f5701a4ce72116673e6910396
SHA1 bf965f717ff1f72353c807ce747b09cdbc959652
SHA512 c031089ea5be432171cdb250000cdb430d0ea72ae7022c97d42224edf918772e05f1154e0baaf557d467be309ad0f8d9d850cc56b693841066fa794037de97d7
TLSH
T1ABE0DF22E405C6A53883BCC933991D9C528C890469AB00AAF6CCCB4B98C0E34B2E94F3
MD5 SHA1 SHA512 TLSH

Submit Download

uninstal.log

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
Size 492B
SHA256 f4135a6727277d66f550cf35809c6ee5f4e22307bb62f0f11321509fea2f06b2
MD5 5883b754136b17c1ae1f7cddb5657163
SHA1 8aba5b4b4ed59258bcc5b698d77234186803f7e1
SHA512 f5a1d1a2f40ec3a64b256b176df4f5b8d6b26fa93d837f0c867f1c86bc84cd572c3d34c6d0e0251ddb86460a9fd940b90e0280f3b2e9e8a906d27a2dc2581456
TLSH
T164F0BE11D416939274A378C9375D5D4CA288C9497A9A59AAE5CCC70BA8C0E30B1BC0E2
MD5 SHA1 SHA512 TLSH

Submit Download

uninstal.log

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
Size 634B
SHA256 b2203b3bdcc80258b59733ef78903727a3a61d3d82cb70e44f0e4eac1d70b417
MD5 0289567a211fdba5675449895dfa89fb
SHA1 2533248a5530d15ab988ba0e2cb04aa70fb3b61f
SHA512 8112b59b33d926455182188fd0a6ce4c9699fcc30c63b8d97596e335ad5255a04950e400b034b8908eb888837ef52c1ca9b7825db485201c34cb3dc8f4c0bf8d
TLSH
T161F0D610D0159382B0A338C8274E5E0C9288C945799B4A7BE0CCD35FE885F25F1BD0E3
MD5 SHA1 SHA512 TLSH

Submit Download

uninstal.log

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
Size 1KB
SHA256 3c4154aa47f0b49d7bc55b1cdb784fe399f4ff63271b6fcdb1a9005be933b413
MD5 257679a0811032875dddca0288eae54d
SHA1 a1ffc438b088e17205f35282a36071fe2d015ab5
SHA512 65ae707435fd9fc6250684114375628659184f7d9ce2038fc4b10e199066481ee892d31b8a1e5f43cdc4ccf81c07c75bda2bfcddf58ee79f6be78d936e179366
TLSH
T1FE31A115D621539175E33186178E1ACA52C4C94B769E2AE3E0CDE11FA64BF1972BE0C3
MD5 SHA1 SHA512 TLSH

Submit Download

uninstal.log

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
Size 261B
SHA256 66c9384a72ac69df49b0c76e9ae2d8fe9a1670850d11949bf70741d07e466706
MD5 46840b2efede023e8ddfaa8fd3e73b6b
SHA1 83b845b1b3049c1ff93ae79ccd97b1ba05421482
SHA512 7f01a64610b968b32ee584e9595ee34cecb78bfef6b07c4d89caa5e9801059fe494ed5108f345e1f3c58b3183bf98919738eeacef0cfe5cbad983399045b5d30
TLSH
T180D02B12D401824534C22CC433491A88018C494064D600A9F5CCC34B98C4D3532AA4B3
MD5 SHA1 SHA512 TLSH

Submit Download

vise32ex.dll

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\vise32ex.dll
Size 496KB
SHA256 6d4209a51dedb0aedcdfd5cbed6fc80dbc34b51cd1dc176d788f07b5cdf06642
MD5 db798587868984eb838a71338f6ffe53
SHA1 c9fef0b8e6806137f29beb8c0eae04f1c5bb8c39
SHA512 1e6f4ce4156693f9f9a8f70b8b9ff5080a27ac903929ae7aefd277c455d088aaf6b19ddc1edc131eb552eada877462829473885804df7f9246d412754d098c58
SSDEEP 12288:Ibyt0WsROjuYUM7sSm4GVv/5er2jlOZNs+4:cyt0RdQo56WUZW+4
TLSH
T1C6B48D51AA56A8BDD15CF6B4309E7B352E3ACF44423A87C3D375DC366D21281AE3930E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unvise32.exe

Path C:\Windows\unvise32.exe
Size 84KB
SHA256 f241f37d423dd5c192b22ca1d4655dbf9e9b861487a6ac0f958b190e975934dc
MD5 84b4f61f59a421bd85d97b35d194b42b
SHA1 d3f2bac1a72f82c42d551c066c8ec841f46adb60
SHA512 4bbbe843a56e5b3a554a23e16450ce33543c6a7a37e917908e7ab1c7a729700b3f04a83bccadd126017ab5fca73d57e9caef085d349112672c14328e05d66b88
SSDEEP 1536:Pche6hyD7/XwxVwSmIULfBTpgj8wJK92a+SoLJMA:PkzhyDLXiwoULJE8wJK4a+So9T
TLSH
T189836C127BD184B2F5B92632386D7F7ADA3FEE050131CA874360EF562D316C1E929396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4540-46-0x0000000003600000-0x000000000361B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads