Overview

overview

7

Static

static

3

Setup.exe

windows10-2004-x64

7

Setup.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/10/2026, 02:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Setup.exe
  • Size 893KB
  • Sample261027-dbe4psaz5p
  • SHA256 57d2dc96bedd504680c1526b354bd925b2fa2ba0ce7ce9f4b0157081776dd6f2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 8 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    PID:4912
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:5964

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          ccla2.exe
          • Path C:\Program Files (x86)\Agni\CCLA2\ccla2.exe
          • Size 505KB
          • SHA256 27e3b8557d8ad679893963eb022c20d26b5c519494aca5d23d4234ee613fb5a5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          English.vlg
          • Path C:\Users\Admin\AppData\Local\Temp\~vis0000\English.vlg
          • Size 13KB
          • SHA256 75081f741b450b8049d3a0106121516745bba675681fb490e78b7978238258d5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ccla2.jpg
          • Path C:\Users\Admin\AppData\Local\Temp\~vis0000\ccla2.jpg
          • Size 61KB
          • SHA256 7c0404c0947cbb90c71333ad4d4e9f4165f0af4011ca57bb907e7cfdb200708c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          default.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\~vis0000\default.bmp
          • Size 18KB
          • SHA256 d9d5e28eb445e7986bdef4d409868af205d525f2f0729427dfe3e33a7251b15d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jpeg.dll
          • Path C:\Users\Admin\AppData\Local\Temp\~vis0000\jpeg.dll
          • Size 104KB
          • SHA256 c83e2f98b9182073002b24c731f9fe0512bc4a3b468181c677d20fc465218232
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          rollback.log
          • Path C:\Users\Admin\AppData\Local\Temp\~vis0000\rollback.log
          • Size 162B
          • SHA256 9c90f5fe41f66319bd8e188d9701ba483e6137466361abef12bdfb6a3d93d66f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          rollback.log
          • Path C:\Users\Admin\AppData\Local\Temp\~vis0000\rollback.log
          • Size 371B
          • SHA256 5091845f05100d603df43134c63b9093bd96747bddecdcb6ece23e827d84ec56
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          side.jpg
          • Path C:\Users\Admin\AppData\Local\Temp\~vis0000\side.jpg
          • Size 15KB
          • SHA256 6d0d253ae5a5898e1ab5cdd8aec0db9c22f1d8ccbebc67d7a1f55fc46f3ce3a4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          uninst32.exe
          • Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninst32.exe
          • Size 84KB
          • SHA256 f241f37d423dd5c192b22ca1d4655dbf9e9b861487a6ac0f958b190e975934dc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          uninstal.log
          • Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
          • Size 634B
          • SHA256 b2203b3bdcc80258b59733ef78903727a3a61d3d82cb70e44f0e4eac1d70b417
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          uninstal.log
          • Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
          • Size 1KB
          • SHA256 3c4154aa47f0b49d7bc55b1cdb784fe399f4ff63271b6fcdb1a9005be933b413
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          uninstal.log
          • Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
          • Size 298B
          • SHA256 a43ed09ecd74c5d158c0e059fdb26add13f2eb4e744bac22df3789bad27eaa76
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          uninstal.log
          • Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
          • Size 363B
          • SHA256 19edd3b87700b3e3eb14e1f810b102ef93dfd79b2aa1fff3428725c3a8f78cdb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          vise32ex.dll
          • Path C:\Users\Admin\AppData\Local\Temp\~vis0000\vise32ex.dll
          • Size 496KB
          • SHA256 6d4209a51dedb0aedcdfd5cbed6fc80dbc34b51cd1dc176d788f07b5cdf06642
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/4912-46-0x00000000027B0000-0x00000000027CB000-memory.dmp
          Download