c031a1a29441d679585a0bb2d2fdb9489284dab44e6cdd7f49567aa61d6033ac

Analysis

max time kernel
40s
max time network
32s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 10:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Advice-copy3006202600112.exe
Size 442KB
Sample260702-mkm1caev2p
SHA256 c031a1a29441d679585a0bb2d2fdb9489284dab44e6cdd7f49567aa61d6033ac
MD5 d3637445d6eed926ac84568a832dc417
SHA1 a2da102beae88fca89c800f9a9634c1712567908
SHA512 9a80208b3d48f008e9c3e1e76a89b4d3664a6fdf821ee9b8f46d00eac63312d4970d8d97eb3c6a07ce27e1349b475774899d8801fda4e9349d338efd2aea1576
SSDEEP 6144:zXsKoGSLxIxDZzoJDGj90YskfccUPRqsxAsTBC1Oppeo01VbvNXHyWAKN1y:zX1xliGj908+Pds1OCrbFXHQAy
TLSH
T1BFA4F12C3EE9CA56C2619974D97AD7F92D792DA0DCC0874BAA7C7E083D331AD29410C7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2892	Advice-copy3006202600112.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Advice-copy3006202600112.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	Advice-copy3006202600112.exe

C:\Users\Admin\AppData\Local\Temp\Advice-copy3006202600112.exe
"C:\Users\Admin\AppData\Local\Temp\Advice-copy3006202600112.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cyclotella.lnk

Path C:\Users\Admin\AppData\Local\Temp\cyclotella.lnk
Size 900B
SHA256 e558c2f88557b6a7c9168015f13f8e01d0fdb063be7e0f1fb02916dc7ec7cc8c
MD5 04017960c9954147516800fd0785e9fd
SHA1 6454c7182665e931a6f89c455bb3ddad9920d140
SHA512 d680b93164fc2ca7552946d62c4acf8fc344a0b284fba5ee936927aa07aa34b6c881c9a2db0b7eeabeae1c919313dd3ef9beb3d555863b83b179a8c3618ab793
TLSH
T1DB112B460E951B25D6F25BBA85FA234AE6727C57FFA80F494014824528A02E1F8F4F3F
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn2310.tmp\System.dll
Size 12KB
SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
MD5 192639861e3dc2dc5c08bb8f8c7260d5
SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
TLSH
T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH