0b5d646c34390e9600d9fdfe58494290fcf9feadda84455f242dc632d2385d79

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 929KB
Sample261027-dbf11aaz5q
SHA256 0b5d646c34390e9600d9fdfe58494290fcf9feadda84455f242dc632d2385d79
MD5 566c0ff7f666b77ae7cd1785dd190b50
SHA1 fc87883462319ac604c94614309d73899f3c7dfc
SHA512 7674446f9a7ee9c905d30300d7440a0b23955980039b285a6dc9d9337686ee14e4c471c58113efff3929c8363a592ffe26243c4ed2cbeca2da4e5ebecb1e45b2
SSDEEP 24576:aGZFgUWYcy2OxssGti3TouIFZTwXcDWmxon8lRYS3R9sQCOaY:avUR9/s23BiT964on8lv3R6c
TLSH
T12D15231835E585FFE44B08B211650BB4CA3FEEAF5E318FCA5B53788D65B3AD24630119
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1312	ccla-3.exe

Loads dropped DLL 3 IoCs

pid	Process
5792	Setup.exe
5792	Setup.exe
5792	Setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 6 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	ccla-3.exe
File opened (read-only)	\??\A:	Setup.exe
File opened (read-only)	\??\B:	Setup.exe
File opened (read-only)	\??\D:	Setup.exe
File opened (read-only)	\??\A:	ccla-3.exe
File opened (read-only)	\??\B:	ccla-3.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Agni\CCLA3\ccla-3.exe	Setup.exe
File created	C:\Program Files (x86)\Agni\CCLA3\uninstal.log	Setup.exe
File created	C:\Program Files (x86)\Agni\CCLA3\xxxxxxxx.yyy	Setup.exe
File opened for modification	C:\Program Files (x86)\Agni\CCLA3\xxxxxxxx.yyy	Setup.exe
File opened for modification	C:\Program Files (x86)\Agni\CCLA3\	Setup.exe
File opened for modification	C:\Program Files (x86)\Agni\CCLA3\uninstal.log	Setup.exe
File opened for modification	C:\Program Files (x86)\Agni\	Setup.exe
File created	C:\Program Files (x86)\Agni\CCLA3\ccla-3.exe	Setup.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\unvise32.exe	Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccla-3.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0\0	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	Setup.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1312	ccla-3.exe
1312	ccla-3.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5792 wrote to memory of 1312	5792	Setup.exe	91

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5792
- C:\Program Files (x86)\Agni\CCLA3\ccla-3.exe
  "C:\Program Files (x86)\Agni\CCLA3\ccla-3.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1312

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ccla-3.exe

Path C:\Program Files (x86)\Agni\CCLA3\ccla-3.exe
Size 715KB
SHA256 ec89adb60b99a70d3ff4fb284e0bc1409a239bf913bf970c8d9dfd889501fedc
MD5 32caef734c4a4bba42dda1905f59142e
SHA1 84e3e147ab1f26dc3ca77e63cdd36d24aeea3cbd
SHA512 c79546dbfbb0f60d271539eef1ceed6278cde1de69710d5c2335ac9c75dac4fb9b7d842343e6b598f05463a3e6ed8d4ec2c2e74b46802d1bbaa5cd49c5cb8f28
SSDEEP 12288:NyTZNF+Q2ryN/MapeK7+AxaqpgeLNJq7U+cG79o:NyNNFysBpGAxe6NJWU+cf
TLSH
T1B6F4BF25B706D151D91A01721E02D3C89BA6FD14FE7A874334ECB38FEDB2857A927B48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

English.vlg

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\English.vlg
Size 13KB
SHA256 75081f741b450b8049d3a0106121516745bba675681fb490e78b7978238258d5
MD5 707e3b6418526ed6729deb4a1307f1f2
SHA1 521a175e2e18ad316c8fbf25aa35c35dbf449668
SHA512 cbf15467cbd0797a8ec781ce8fcae416c9dd30db052e32c85aa717ec955e24f5592ab937c2f8b82e7cf862c09a4a5d767808b56000bf3942da58c457a3fbcc86
SSDEEP 192:juireshg6lzCsFxDV6E6iVe9SVcZTCnfuxoiWR8UC+TdvnNLfPmCTwmOuG:juiv7t6E6i44VnfJiWRRvnNLfPmCg
TLSH
T18C52A78E5B4683B62A9102DBE28F37C365D0C05F126E159141E6B07D73AA745C3EB2D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agnimain.JPG

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\agnimain.JPG
Size 24KB
SHA256 8894f0d1527e87173dc8081bf6d8a2094456f134152fcf3446aaa0328a8a9828
MD5 f61301d8b66f20bbbfce4f80cd813d41
SHA1 a18dc5342f3035f7e712b32a9e5bf0038ad77a4d
SHA512 db1167f45c5b4b9c6ebeb336e4d0a99a752ccccd9888be9e460568a88160e7bb44d7698f891b0aa2d6ebd7d575e56954a03c1bdd3972ce6566c38124537b20d1
SSDEEP 384:26H4BwSRBkMhnqv3i9LMUwgq00OP4vYP9kMJha3ApXfUF+FCeEsbgiN5EAgwP:XYxXkr3lUw7FMlJsQtfUmCPySAgwP
TLSH
T1F2B2BE1A08597C6EDFCF642B6807F3B0F220587A3632E87A594C6ED33F916675200B5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccla3.jpg

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\ccla3.jpg
Size 61KB
SHA256 d9c7e791314091f1e56d6296dfd1070aa691b7c856a1f01c4a916e1433794c97
MD5 2a570887f2dacd8e7ecf68d36d5040dd
SHA1 d0cad494f79d315f7e2e0a81e739cc99756c297b
SHA512 ced1cb43f16609cbfffe1ade77ff44059f9ec35165488f2ceef533a60a8a111f3f6cf6f4b7615be854a5bb74081297568cae47ed61a01b560ead6b242fdd503c
SSDEEP 1536:VJyT1dJ57DbRf+klOkxfCG31J/3InLG10h3aJxSbu7F:Vmf5PNWkl/J3T+6+h3wxSI
TLSH
T15653F2DB478F22A95A6371AEC42D0400546B45D194BAAEA2F63FC471E074C6CF1BCBF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\jpeg.dll
Size 104KB
SHA256 c83e2f98b9182073002b24c731f9fe0512bc4a3b468181c677d20fc465218232
MD5 0da8449291b80aac6c6f7e356d14ba36
SHA1 421456596c690b69d262dcb5e96f474c3c92ab14
SHA512 4e99332b791a7629d8541fce0e3d56d3452168abbbe5e56e38d79edb440bf1e12ca2d73d2f79d78a5c2ba282ab3ff84103691153fe26da670e9a9a28f75713ac
SSDEEP 1536:+ouMgB/g8nm5mAifWSyUtdKTgopIZ/sh5iTjHoDVK:+ouMgBIe7hp/oi/HoDVK
TLSH
T148A3B03176A04071D0E70276165AAF2EDFBE23620AEE5ED3877869501F309B1FE37586
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rollback.log

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\rollback.log
Size 163B
SHA256 3159151998df985b9ce01466d20ee9abd60ed6a71dbbac2bb6695321c6b8d20d
MD5 fdffc317bcf219561c996d72b3c3e68d
SHA1 8cb3486a37d0633d4241e37ec696aad045ba38e9
SHA512 e7f37aa728525d92d9b9e1483e0a29015500e0ede7edc7c106c244220efa19a814ef806aded66d0c40719e87ad3267bda78d1611065baa4104afab30999c6062
TLSH
T1C4C04C1A9826C7D47697F99933586D2CE31D9E08796704A6AAC8DB1B84C0D6C60EC1F0
MD5 SHA1 SHA512 TLSH

Submit Download

rollback.log

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\rollback.log
Size 372B
SHA256 dfaaed0b259e0ee6653ef7aea601fcce468cac3a6c36a9eec27228c0541fef8b
MD5 459a89a587ff5add369c8b06d7d9f590
SHA1 fb79020028237a5f374f975245ae846c89e6a1c9
SHA512 4aee583e81221ea50ad9b471a5bacf623417bde074daea4b9f75c4c4ec5a233aef8033af703661cf71526c098aaf14e07854bf6e892009d9874c153070befb7e
TLSH
T1E7E09268E425D380B5A77585234DAD0CC2CCD904799B4AF398CCC71FE88AE1DB0F91D2
MD5 SHA1 SHA512 TLSH

Submit Download

side.jpg

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\side.jpg
Size 15KB
SHA256 6d0d253ae5a5898e1ab5cdd8aec0db9c22f1d8ccbebc67d7a1f55fc46f3ce3a4
MD5 0628eead1cc860656cc645de759ab0f7
SHA1 47e4d7f66e42187809b1316d433e93ef58ba9158
SHA512 3b8e032f398d4529a32340f4181458f82f8ec34fb53c5cdd6b5dbab72e421cf7b09d3956b8e9be1c1eb7201dd87068a7d9071fa3882eecdfb4f4a4fb45508dc4
SSDEEP 384:0HYocJ0uBMEU570gXIeUmDHF1+JB0qJR9:0HtcCueh5nIJmh1WCqp
TLSH
T1D962D0D377CBA233A660CE62D57A29CF6635CD002B4199921D2D00C8F471D6716C876F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninst32.exe

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninst32.exe
Size 84KB
SHA256 f241f37d423dd5c192b22ca1d4655dbf9e9b861487a6ac0f958b190e975934dc
MD5 84b4f61f59a421bd85d97b35d194b42b
SHA1 d3f2bac1a72f82c42d551c066c8ec841f46adb60
SHA512 4bbbe843a56e5b3a554a23e16450ce33543c6a7a37e917908e7ab1c7a729700b3f04a83bccadd126017ab5fca73d57e9caef085d349112672c14328e05d66b88
SSDEEP 1536:Pche6hyD7/XwxVwSmIULfBTpgj8wJK92a+SoLJMA:PkzhyDLXiwoULJE8wJK4a+So9T
TLSH
T189836C127BD184B2F5B92632386D7F7ADA3FEE050131CA874360EF562D316C1E929396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstal.log

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
Size 364B
SHA256 9fc0b96e378ad7a9a5375d2b32d6903442f001a7ecdbf55283427cdcc4ec1dd4
MD5 52f9b6560c38e07e3301416c727d4a33
SHA1 e7074e5fe90c0b3a9ff910f2e2b2768063298e40
SHA512 a8268db7bb74d3614a9911c8351bb26ab58ef58e34e04b6f7e273aadc950977e49b9437c20f7a8dffa91854af395f4a67ad62d441e68648d8a53d1edbd3e92d0
TLSH
T1A1E0D816E405C69534C37C8933591D5C524C490468A600AAB5CCC74B98C0D3872E90F1
MD5 SHA1 SHA512 TLSH

Submit Download

uninstal.log

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
Size 382B
SHA256 d35dd521082e40b3e81a0ffd5acd52dfb8010294deaccd266f86cececaf55154
MD5 ce2edc0b8f1f319628dce8247daee5f5
SHA1 4f660260d102293d320f2c8619f2a71cccc62c87
SHA512 b23509fb15dced8a312e46583860116f1f78d816717506362a502b268a514b0cc8eea8337fd33f463644459eebb64547179003f14235791c4a121b890786420e
TLSH
T19EE09216E406C7993483788933591D5C924C890868A640AAF6CCC74B98C0E3872BD0B1
MD5 SHA1 SHA512 TLSH

Submit Download

uninstal.log

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
Size 635B
SHA256 d6b383546723ce3d39e9056e169c6dde4a79e9589f802617cb5b84a012b512c5
MD5 41bad59281fdba76cf17833da3392206
SHA1 5aa5eaa0bd9826472940fbd0736abbc6f28bd6d2
SHA512 8c22e9b938495cf68f007732bdc2ba08e8465a096fbaa55c72c1d774e42b4e9e9b20d05097a319200ee834588f86e5d198a15e7c8d1fbc29a6afe128799f0f94
TLSH
T16EF0D605D4169382B0A33888274E5E0C928CC949799B9A7BE1CC935FE885F25B1BD0E2
MD5 SHA1 SHA512 TLSH

Submit Download

uninstal.log

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
Size 1KB
SHA256 18cfce1a25be9d7212bb77faac040ce63130536ab534715f87318945d98cb886
MD5 7c6752006de526aba31b5b4c20d0bc0e
SHA1 500a00a85740308d7594ab2938b3dc3749570dd9
SHA512 bffdd91613e8aee4c64ad8cd823750350581f2e2d29e3a1d94ebd3ded3393197f3ea7bc34c638cd2fa7d47be7f07a09bb2adfc41e7e80396379cfbfd0c422f67
TLSH
T11131C319E611839175E33145074E1ACA52C8C94B765E6EE3E4CDA11FA64BF19727E0C2
MD5 SHA1 SHA512 TLSH

Submit Download

uninstal.log

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
Size 298B
SHA256 f49bfd9a69ee106dc8a219107d08e6e10514ab9ee5d205c7f9ba78698ece72f9
MD5 ebbc6fc2d34d7d7f69427fb85bebe484
SHA1 d4deda004eda89ca12e9c52f3c5a8a2152631254
SHA512 d7e41d3349ed68b951b5e518170c41e0b0dc3353b75a04ec6fb5f01465ea39ddbb0d10ad11851a09a1be5a8441e82a32b9f6279f2a2a07fc5ffe62857d3150ff
TLSH
T15DE0C216E405C69538C36CC93799199C518C894468A650A9F6CCD78B98C0E3932AA4B2
MD5 SHA1 SHA512 TLSH

Submit Download

vise32ex.dll

Path C:\Users\Admin\AppData\Local\Temp\~vis0000\vise32ex.dll
Size 496KB
SHA256 e961f8d2230b1af03b6e197a47749287a1ef0bb75079f75e31918d5b1d406350
MD5 d70a34b3c52cdc98b5be0768704270fb
SHA1 2af17046882da9e02851ec7e6087578cc4a55d2c
SHA512 984d446f8315571feb549f63a4a36c6ee9cd3495fe8a96648ff39bf7c7be105f3180df583dca2efeba021298b0213bbc70853231d2cf051769d9284dbafa8571
SSDEEP 12288:BDyt4AueNq6rdo+CRJL4GVq2hLsVCyhYZ4SE:Byt4ADHHQLh4j2ZrE
TLSH
T1F9B48D50AA56A8BDD15CF5B4309E6B362E3ACF44427A87C3D375DC366D21281EE3930E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1312-265-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1312-266-0x0000000000509000-0x000000000050A000-memory.dmp

Download

memory/1312-267-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5792-52-0x0000000002750000-0x000000000276B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads