Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
8CADe_SIMUd...CN.exe
windows7-x64
1CADe_SIMUd...CN.exe
windows10-2004-x64
1CADe_SIMUd...2D.dll
windows7-x64
1CADe_SIMUd...2D.dll
windows10-2004-x64
1CADe_SIMUd...2D.dll
windows7-x64
1CADe_SIMUd...2D.dll
windows10-2004-x64
1CADe_SIMUd...TD.dll
windows7-x64
3CADe_SIMUd...TD.dll
windows10-2004-x64
3Analysis
-
max time kernel
90s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
15/10/2022, 04:33
Behavioral task
behavioral1
Sample
CADe_SIMUdqfz电路图仿真软件/CADe_SIMUdqfz/CADe_SIMU CN.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
CADe_SIMUdqfz电路图仿真软件/CADe_SIMUdqfz/CADe_SIMU CN.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
CADe_SIMUdqfz电路图仿真软件/CADe_SIMUdqfz/MFC42D.dll
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
CADe_SIMUdqfz电路图仿真软件/CADe_SIMUdqfz/MFC42D.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
CADe_SIMUdqfz电路图仿真软件/CADe_SIMUdqfz/MFCO42D.dll
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
CADe_SIMUdqfz电路图仿真软件/CADe_SIMUdqfz/MFCO42D.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral7
Sample
CADe_SIMUdqfz电路图仿真软件/CADe_SIMUdqfz/MSVCRTD.dll
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
CADe_SIMUdqfz电路图仿真软件/CADe_SIMUdqfz/MSVCRTD.dll
Resource
win10v2004-20220812-en
General
-
Target
CADe_SIMUdqfz电路图仿真软件/CADe_SIMUdqfz/MFCO42D.dll
-
Size
345KB
-
MD5
a6d49b9367d4eade1e0217aeb7422ff5
-
SHA1
8cc08df30a815305f42feca44a3db91c70544b70
-
SHA256
f306d0671f2c377819d26e0cd1f52bfd301436f45cb436c203030aebb9ee67e4
-
SHA512
d0682e4a027cbd73f982b760db0423f61d449db4f40b98c8aac2624c6b6700162c01ee70fa58810142018d8a1800c5ac00ab20804ee574281b3aded83c3fec42
-
SSDEEP
6144:CnmrVCWFXGTZeWHa/7dqpdNpn0ZCynsKqmgVpAcpHV7a:CmRCGenAYx9I
Malware Config
Signatures
-
Modifies registry class 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0BE35200-8F91-11CE-9DE3-00AA004BB851}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0BE35201-8F91-11CE-9DE3-00AA004BB851} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0BE35201-8F91-11CE-9DE3-00AA004BB851}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0BE35202-8F91-11CE-9DE3-00AA004BB851} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0BE35202-8F91-11CE-9DE3-00AA004BB851}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0BE35200-8F91-11CE-9DE3-00AA004BB851} regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2640 2236 regsvr32.exe 81 PID 2236 wrote to memory of 2640 2236 regsvr32.exe 81 PID 2236 wrote to memory of 2640 2236 regsvr32.exe 81
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\CADe_SIMUdqfz电路图仿真软件\CADe_SIMUdqfz\MFCO42D.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\CADe_SIMUdqfz电路图仿真软件\CADe_SIMUdqfz\MFCO42D.dll2⤵
- Modifies registry class
PID:2640
-