Overview

overview

7

Static

static

3

CADe_SIMU_4_0.7z

windows10-ltsc_2021-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    66s
  • max time network
    36s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260513-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    18/05/2026, 15:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    CADe_SIMU_4_0.7z
  • Size 6.9MB
  • Sample260518-sljbfaew2s
  • SHA256 11b7013829c409f420aa5c0d7c398c1bfce5c14e32021adb4112239494e2cb17
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\CADe_SIMU_4_0.7z"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4584
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4808
    • C:\Users\Admin\Desktop\CADe_SIMU_4_0\CADe_SIMU.exe
      "C:\Users\Admin\Desktop\CADe_SIMU_4_0\CADe_SIMU.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4012

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          CADe_SIMU.exe
          • Path C:\Users\Admin\Desktop\CADe_SIMU_4_0\CADe_SIMU.exe
          • Size 44.7MB
          • SHA256 5f7b56f8b01ea2cd472e9112c251496914a358b57e6de08d3a8111c80ba50fb9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MFC42D.DLL
          • Path C:\Users\Admin\Desktop\CADe_SIMU_4_0\MFC42D.DLL
          • Size 908KB
          • SHA256 3a3fa253ce80cf55027abc7918f8984057a94d1832302fb9893402aba9d35dff
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MFCO42D.DLL
          • Path C:\Users\Admin\Desktop\CADe_SIMU_4_0\MFCO42D.DLL
          • Size 780KB
          • SHA256 c24f04b2bdcd9211e49853ec874c6d5c1bc6487b09c378d185aa37cceea5c4c5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSVCRTD.DLL
          • Path C:\Users\Admin\Desktop\CADe_SIMU_4_0\MSVCRTD.DLL
          • Size 376KB
          • SHA256 db39f55c12069c366e4d1ce73dc42fb76cd5587468182048cc11ecfedd518b9a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libnodave.dll
          • Path C:\Users\Admin\Desktop\CADe_SIMU_4_0\libnodave.dll
          • Size 124KB
          • SHA256 d61b4728dc1bdfbfcee780b2eecc867549ff4637bc611ba115e023d4bda493b6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download