Overview
overview
7Static
static
3TinyCAD-2.60.01.exe
windows10-2004-x64
7TinyCAD-2.60.01.exe
windows11-ltsc_2024-x64
7$DOCUMENTS...R0.exe
windows10-2004-x64
7$DOCUMENTS...R0.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows11-ltsc_2024-x64
3$R9/$R0.exe
windows10-2004-x64
7$R9/$R0.exe
windows11-ltsc_2024-x64
7TinyCAD.chm
windows10-2004-x64
1TinyCAD.chm
windows11-ltsc_2024-x64
1TinyCad.exe
windows10-2004-x64
3TinyCad.exe
windows11-ltsc_2024-x64
3iconv.dll
windows10-2004-x64
3iconv.dll
windows11-ltsc_2024-x64
3libpng13.dll
windows10-2004-x64
3libpng13.dll
windows11-ltsc_2024-x64
3zlib1.dll
windows10-2004-x64
3zlib1.dll
windows11-ltsc_2024-x64
3Analysis
- max time kernel
148s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 12:25
Behavioral task
behavioral1
Sample
TinyCAD-2.60.01.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
TinyCAD-2.60.01.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
$DOCUMENTS/TinyCAD Examples/$R0.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$DOCUMENTS/TinyCAD Examples/$R0.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsisdl.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsisdl.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
$R9/$R0.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
$R9/$R0.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
TinyCAD.chm
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
TinyCAD.chm
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
TinyCad.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
TinyCad.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
iconv.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
iconv.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
libpng13.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral18
Sample
libpng13.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral19
Sample
zlib1.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral20
Sample
zlib1.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target TinyCAD-2.60.01.exe
- Size 2.4MB
- Sample260808-plndls1sg1
- SHA256 fc42f3a200e5fbc2d7a431daa42b6a431077690f9cf2c5dbf983f35ef22377b2
- MD5 d859a2aef7cdf7fb690bda9a28ad7189
- SHA1 7b742f8a491fa3eaec0223e7a192cde3974097f1
- SHA512 6129c3c847d147d4b7e020885357fd081cdf5938e1fe08725fed11a8170e5305790574f29c4d9690a4ca4cae37e94732bf32ede0c93cccda5b7703393cecdc15
- SSDEEP 49152:YT65P7uMTTZ0qvf/1xN7PdJ4Cd8CuDsZQvUMgY5vvMsold:/P7uYLDRTdPuuWlgY5vU3
- TLSH T187C53381F560DE39FB21203518BCE75AAF72C4671984930F92AD1B4F98D7BA9AC0C578
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3828 TinyCad.exe - Loads dropped DLL 11 IoCs
pid Process 3388 TinyCAD-2.60.01.exe 3388 TinyCAD-2.60.01.exe 3388 TinyCAD-2.60.01.exe 3388 TinyCAD-2.60.01.exe 3388 TinyCAD-2.60.01.exe 3828 TinyCad.exe 3828 TinyCad.exe 3828 TinyCad.exe 3828 TinyCad.exe 3828 TinyCad.exe 3828 TinyCad.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\msvcr71.dll TinyCAD-2.60.01.exe - Drops file in Program Files directory 52 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\TinyCAD\library\Connectors.mdb TinyCad.exe File opened for modification C:\Program Files (x86)\TinyCAD\library\Connectors.ldb TinyCad.exe File opened for modification C:\Program Files (x86)\TinyCAD\library\IC-VREG.mdb TinyCad.exe File created C:\Program Files (x86)\TinyCAD\library\DISCRETE.mdb TinyCAD-2.60.01.exe File opened for modification C:\Program Files (x86)\TinyCAD\TinyCAD.url TinyCAD-2.60.01.exe File opened for modification C:\Program Files (x86)\TinyCAD\library\IC-OPAMP.ldb TinyCad.exe File opened for modification C:\Program Files (x86)\TinyCAD\library\passive2.mdb TinyCad.exe File opened for modification C:\Program Files (x86)\TinyCAD\library\valve.mdb TinyCad.exe File opened for modification C:\Program Files (x86)\TinyCAD\library\valve.ldb TinyCad.exe File created C:\Program Files (x86)\TinyCAD\library\IC-OPAMP.mdb TinyCAD-2.60.01.exe File created C:\Program Files (x86)\TinyCAD\library\passive.mdb TinyCAD-2.60.01.exe File created C:\Program Files (x86)\TinyCAD\library\semi.mdb TinyCAD-2.60.01.exe File created C:\Program Files (x86)\TinyCAD\library\valve.mdb TinyCAD-2.60.01.exe File opened for modification C:\Program Files (x86)\TinyCAD\library\AC connectors.ldb TinyCad.exe File opened for modification C:\Program Files (x86)\TinyCAD\library\DISCRETE.ldb TinyCad.exe File opened for modification C:\Program Files (x86)\TinyCAD\library\Microcontroller.mdb TinyCad.exe File opened for modification C:\Program Files (x86)\TinyCAD\library\semi.ldb TinyCad.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\dao350.dll TinyCAD-2.60.01.exe File opened for modification C:\Program Files (x86)\TinyCAD\library\IC-CMOS4000.ldb TinyCad.exe File opened for modification C:\Program Files (x86)\TinyCAD\library\Microcontroller.ldb TinyCad.exe File created C:\Program Files (x86)\TinyCAD\TinyCAD.chm TinyCAD-2.60.01.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\system.mdb TinyCad.exe File opened for modification C:\Program Files (x86)\TinyCAD\library\passive.ldb TinyCad.exe File created C:\Program Files (x86)\TinyCAD\library\74TTL.mdb TinyCAD-2.60.01.exe File created C:\Program Files (x86)\TinyCAD\library\Connectors.mdb TinyCAD-2.60.01.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\DAO2535.TLB TinyCAD-2.60.01.exe File opened for modification C:\Program Files (x86)\TinyCAD\library\74TTL.mdb TinyCad.exe File opened for modification C:\Program Files (x86)\TinyCAD\library\Analog.ldb TinyCad.exe File opened for modification C:\Program Files (x86)\TinyCAD\library\IC-VREG.ldb TinyCad.exe File opened for modification C:\Program Files (x86)\TinyCAD\library\switches.mdb TinyCad.exe File opened for modification C:\Program Files (x86)\TinyCAD\library\switches.ldb TinyCad.exe File created C:\Program Files (x86)\TinyCAD\TinyCad.exe TinyCAD-2.60.01.exe File created C:\Program Files (x86)\TinyCAD\iconv.dll TinyCAD-2.60.01.exe File created C:\Program Files (x86)\TinyCAD\uninst.exe TinyCAD-2.60.01.exe File opened for modification C:\Program Files (x86)\TinyCAD\library\AC connectors.mdb TinyCad.exe File opened for modification C:\Program Files (x86)\TinyCAD\library\IC-OPAMP.mdb TinyCad.exe File opened for modification C:\Program Files (x86)\TinyCAD\library\passive.mdb TinyCad.exe File opened for modification C:\Program Files (x86)\TinyCAD\library\passive2.ldb TinyCad.exe File opened for modification C:\Program Files (x86)\TinyCAD\library\semi.mdb TinyCad.exe File created C:\Program Files (x86)\TinyCAD\libpng13.dll TinyCAD-2.60.01.exe File created C:\Program Files (x86)\TinyCAD\library\AC connectors.mdb TinyCAD-2.60.01.exe File created C:\Program Files (x86)\TinyCAD\library\IC-VREG.mdb TinyCAD-2.60.01.exe File created C:\Program Files (x86)\TinyCAD\library\passive2.mdb TinyCAD-2.60.01.exe File created C:\Program Files (x86)\TinyCAD\library\switches.mdb TinyCAD-2.60.01.exe File opened for modification C:\Program Files (x86)\TinyCAD\library\Analog.mdb TinyCad.exe File opened for modification C:\Program Files (x86)\TinyCAD\library\DISCRETE.mdb TinyCad.exe File opened for modification C:\Program Files (x86)\TinyCAD\library\IC-CMOS4000.mdb TinyCad.exe File created C:\Program Files (x86)\TinyCAD\zlib1.dll TinyCAD-2.60.01.exe File created C:\Program Files (x86)\TinyCAD\library\Analog.mdb TinyCAD-2.60.01.exe File created C:\Program Files (x86)\TinyCAD\library\IC-CMOS4000.mdb TinyCAD-2.60.01.exe File created C:\Program Files (x86)\TinyCAD\library\Microcontroller.mdb TinyCAD-2.60.01.exe File opened for modification C:\Program Files (x86)\TinyCAD\library\74TTL.ldb TinyCad.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TinyCAD-2.60.01.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TinyCad.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dsn\shell\print\command\ = "C:\\PROGRA~2\\TinyCAD\\TinyCad.exe /dde" TinyCad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DAO.Field.35\CLSID\ = "{00000014-0000-0010-8000-00AA006D2EA4}" TinyCAD-2.60.01.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000013-0000-0010-8000-00AA006D2EA4}\InprocServer32\ThreadingModel = "Apartment" TinyCAD-2.60.01.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000015-0000-0010-8000-00AA006D2EA4}\ProgID TinyCAD-2.60.01.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000016-0000-0010-8000-00AA006D2EA4}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DAO\\dao350.dll" TinyCAD-2.60.01.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000019-0000-0010-8000-00AA006D2EA4}\InprocServer32\ThreadingModel = "Apartment" TinyCAD-2.60.01.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TinyCAD design\shell\open TinyCad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dsn\DefaultIcon\ = "C:\\PROGRA~2\\TinyCAD\\TinyCad.exe,1" TinyCad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.dsn\ShellNew TinyCad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000010-0000-0010-8000-00AA006D2EA4}\ProgID TinyCAD-2.60.01.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000014-0000-0010-8000-00AA006D2EA4} TinyCAD-2.60.01.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000017-0000-0010-8000-00AA006D2EA4}\ = "DAO.User.35" TinyCAD-2.60.01.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000018-0000-0010-8000-00AA006D2EA4}\ProgID\ = "DAO.QueryDef.35" TinyCAD-2.60.01.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000019-0000-0010-8000-00AA006D2EA4}\ = "DAO.Relation.35" TinyCAD-2.60.01.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000010-0000-0010-8000-00AA006D2EA4}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DAO\\dao350.dll" TinyCAD-2.60.01.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000014-0000-0010-8000-00AA006D2EA4}\ = "DAO.Field.35" TinyCAD-2.60.01.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000017-0000-0010-8000-00AA006D2EA4}\InprocServer32\ThreadingModel = "Apartment" TinyCAD-2.60.01.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TinyCAD design TinyCad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dsn TinyCad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000013-0000-0010-8000-00AA006D2EA4}\ProgID\ = "DAO.TableDef.35" TinyCAD-2.60.01.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DAO.TableDef.35\CLSID TinyCAD-2.60.01.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000013-0000-0010-8000-00AA006D2EA4}\ProgID TinyCAD-2.60.01.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dsn\shell\open\ddeexec TinyCad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dsn\shell\printto\ddeexec TinyCad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DAO.PrivateDBEngine.35\CLSID TinyCAD-2.60.01.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DAO.Group.35\ = "Microsoft DAO 3.51 Object Library Group" TinyCAD-2.60.01.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\WOW6432Node\CLSID TinyCAD-2.60.01.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000011-0000-0010-8000-00AA006D2EA4}\ = "DAO.PrivateDBEngine.35" TinyCAD-2.60.01.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000015-0000-0010-8000-00AA006D2EA4}\InprocServer32\ThreadingModel = "Apartment" TinyCAD-2.60.01.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000016-0000-0010-8000-00AA006D2EA4}\InprocServer32 TinyCAD-2.60.01.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00025E01-0000-0000-C000-000000000046}\4.0 TinyCAD-2.60.01.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DAO.QueryDef.35 TinyCAD-2.60.01.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00025E01-0000-0000-C000-000000000046}\4.0\HELPDIR\ = "C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DAO\\" TinyCAD-2.60.01.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000010-0000-0010-8000-00AA006D2EA4}\ = "DAO.DBEngine.35" TinyCAD-2.60.01.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000018-0000-0010-8000-00AA006D2EA4}\InprocServer32 TinyCAD-2.60.01.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DAO.PrivateDBEngine.35 TinyCAD-2.60.01.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000018-0000-0010-8000-00AA006D2EA4}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DAO\\dao350.dll" TinyCAD-2.60.01.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00025E01-0000-0000-C000-000000000046}\4.0\0\win32 TinyCAD-2.60.01.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TinyCAD design\shell\open\command\ = "TinyCAD %1" TinyCad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.dsn\ShellNew\NullFile TinyCad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ TinyCAD-2.60.01.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DAO.Field.35\ = "Microsoft DAO 3.51 Object Library Field" TinyCAD-2.60.01.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000013-0000-0010-8000-00AA006D2EA4}\ = "DAO.TableDef.35" TinyCAD-2.60.01.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000019-0000-0010-8000-00AA006D2EA4}\InprocServer32 TinyCAD-2.60.01.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dsn\shell\open TinyCad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DAO.Relation.35 TinyCAD-2.60.01.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00025E01-0000-0000-C000-000000000046}\4.0\FLAGS\ = "0" TinyCAD-2.60.01.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DAO.DBEngine.35\ = "Microsoft DAO 3.51 Object Library DBEngine" TinyCAD-2.60.01.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DAO.User.35\ = "Microsoft DAO 3.51 Object Library User" TinyCAD-2.60.01.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DAO.TableDef.35 TinyCAD-2.60.01.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DAO.Field.35 TinyCAD-2.60.01.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DAO.Index.35\CLSID TinyCAD-2.60.01.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000015-0000-0010-8000-00AA006D2EA4}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DAO\\dao350.dll" TinyCAD-2.60.01.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000017-0000-0010-8000-00AA006D2EA4}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DAO\\dao350.dll" TinyCAD-2.60.01.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dsn\shell\open\command TinyCad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dsn\shell\printto\command\ = "C:\\PROGRA~2\\TinyCAD\\TinyCad.exe /dde" TinyCad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DAO.DBEngine.35\CLSID\ = "{00000010-0000-0010-8000-00AA006D2EA4}" TinyCAD-2.60.01.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DAO.Relation.35\CLSID TinyCAD-2.60.01.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000018-0000-0010-8000-00AA006D2EA4} TinyCAD-2.60.01.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000019-0000-0010-8000-00AA006D2EA4}\ProgID TinyCAD-2.60.01.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DAO.QueryDef.35\ = "Microsoft DAO 3.51 Object Library QueryDef" TinyCAD-2.60.01.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000017-0000-0010-8000-00AA006D2EA4}\ProgID\ = "DAO.User.35" TinyCAD-2.60.01.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00025E01-0000-0000-C000-000000000046}\4.0\ = "Microsoft DAO 3.51 Object Library" TinyCAD-2.60.01.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00025E01-0000-0000-C000-000000000046}\4.0\0\win32\ = "C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DAO\\dao350.dll" TinyCAD-2.60.01.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3828 TinyCad.exe 3828 TinyCad.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3388 wrote to memory of 3828 3388 TinyCAD-2.60.01.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\TinyCAD-2.60.01.exe"C:\Users\Admin\AppData\Local\Temp\TinyCAD-2.60.01.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Program Files (x86)\TinyCAD\TinyCad.exe"C:\Program Files (x86)\TinyCAD\TinyCad.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3828
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\dao350.dll
- Size 556KB
- SHA256 a4b20735be317a924d2e36707baaf911fbae890ca53c5044fb506f15d33bcb6d
- MD5 8888bdbd4e118d915d40a11748282bca
- SHA1 4e8822d2242d175cc3d708843e2cd71b7ee7033d
- SHA512 a96f5e72905571de84f515dd8a19c87d5143ead532bf01f0132da8262974bfaf910f24b466d49cd4ee83845fc65f02c273a550786854aec3e0f4fa713929b562
- SSDEEP 6144:lO4zReIcAtVXrPsS3Syvqe4v2QeD8yCaDSCwBwAlvz6Bm2hf9QdHHtMMeOh4J7Wu:lO4zRe7AvBiyvqe4pe7wHlv1tO7VYFk
- TLSH T162C45C4BF2D740F9DD05E53404A7976BFB382B429829D449BBF92F9A6A73310122E173
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TinyCAD\TinyCad.exe
- Size 1.3MB
- SHA256 7e97f2a196e6ba982b25c82d0a56545c9aebd60c121519fff73b7f5dfacb1d37
- MD5 3ba37c3495378c47f6da375686bd100a
- SHA1 5c2e7e1c260a66184318970a2455370a14b43baf
- SHA512 fb954278cd63add29efbbd7199a05efcee21a7dfffa46fae94e427e84ad39b3aa62ad22e42b27620b093411672c486a7a97ea30ab74b7c49049b7887c30e1e20
- SSDEEP 24576:MBhywQ+hsw6/Yfn/cxVk11e1vn+bbmYjxqKjN4/SPBN:6P95+vn+bbmYjxqQ4iBN
- TLSH T137555A81B5C340FBC69F037018BE566952F0AE15CF258AFBA18D6ACD5AF06C0597F329
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TinyCAD\iconv.dll
- Size 872KB
- SHA256 6c1515881ed377c0821f14ba079ffd51cc8d910c4b20581f3d19f423b78847f2
- MD5 ab9fb1c95dbd24f12a31869bf4f8cdfd
- SHA1 c45fee79ceb7bb2c9b74cb5967a9f0e4145e9b11
- SHA512 dad60d53801ea34b53f0690c4c16e168a1877d3859b35826143f8a9b340113ba6037b851e0d18951f03dab2fb166bd3fba752fa29be1ad87141afc21cb4a8ff9
- SSDEEP 24576:3KCf2FfWl8KuqGavkg3NyNIbbbIoIBAUZLY:3F+s8KuqGaX0ToIBAUZLY
- TLSH T12615CF91F392CF27F827C5B0893AAB2BD54BEC225B0644137B66778E8E773A454C8117
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TinyCAD\libpng13.dll
- Size 128KB
- SHA256 b0c41a753b05dc2ca9f96b1539bc8aba0385fb57981e5b765afa2e494f5fea29
- MD5 da4ae9b0a0ba1233c16685140a01d29b
- SHA1 d9fbb1933504eec69374a23b25972a1bb4e3339c
- SHA512 56876e2be9e62cebf0c46e136ac05dcd72b2a575c8af019114e7ac1ceab339ea419cdb0d3ea46cffdd51df70c4ea97a1bf3c369c24b94d62740c565f2648a2da
- SSDEEP 3072:N/HIm1FNDVLTesB8ayE4P3cRn3bxnq8Kj2uoqpp:amBLC2u
- TLSH T13BD3AED3B265D4F1E5CB437D1AAF773B4A702B26532EEAC352802A64F4332D45A38761
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TinyCAD\library\74TTL.mdb
- Size 208KB
- SHA256 5e06847e96813108bf051ac1cd05d3b91ee9977c250b8edc97ad44a0d70cc32c
- MD5 41f601ee4b93fe4a7bc8176362952917
- SHA1 0388e24953388e6874e5ee01de5f5ead99eb00fb
- SHA512 db6b6be4710003b754aa25411bba00182409852ff8994e50fd53e9112ecb0accad5a2a8a53f1456c4d3dc2a8ba8fc58cf67618fda9b803aada6c908010373c64
- SSDEEP 768:3vBzEHkXync5xKdIC15XG0cnO+gtdaSewDeH2Aq/cxrZa:3vEkinc5xKx3cnO+gtQSJkr
- TLSH T1DC24EB16FF088C57D4424B3258E787493B30EC44179FDB4B24A073A9AE7B3D59DAE688
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TinyCAD\library\AC connectors.mdb
- Size 160KB
- SHA256 7163b5e7b826a71c1828ad27018443f8978690ab35308f00e1d3ee09872c35de
- MD5 9fe13b5806a1a9206fd8183c2d65ad14
- SHA1 f4efed397e4443a476368dab89a9865778b148da
- SHA512 a10a407d1b02d761d4ff5c34c663e206494368235e7720b85ac49be2e5cff11c2160caece9652c4853990ef77a83faf8e2930d8b124d5aff8352daf9c2e9645f
- SSDEEP 192:LZIOFuWroTMd7VlvDYyj/mmTA6HasjTUxU/yKUx4upeFkftTzck8ucOME:CTqDv8qmiA6F3k9KUx40eFkV8ucO
- TLSH T1C4F39B03B7848D12E4515E30BEE387892E31FC045AD2978B25C4B31EAE7B7C5DD62AD9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TinyCAD\library\Analog.mdb
- Size 192KB
- SHA256 9791eb34309b05e1e4b9c4995b56a84e822bf1f5f1484ebf231a0b92ee1c27c1
- MD5 f8364d82ec56010e6ffb5b4bdade8120
- SHA1 58876fff09e48f68748b3137dbccd5d1483ec5ba
- SHA512 795a4d7ec3ed1ae27382b3a2790452c301ac7356f9b60cacaeb333c770b7de34a5f2963e616abb60761d70d1b4c5f3c09d7184d78cc39a93ab4d477441264756
- SSDEEP 768:60GZQcQAvKl6k7oJLAxAYNyfMiNGSL3TAsO5hxbqnD:cv9k7wAxU3T
- TLSH T13B146606FB848917D0545B31ADE283993B30FC459BC76B4B2084B329EE7B7C9DD93698
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TinyCAD\library\Connectors.mdb
- Size 328KB
- SHA256 f9774d29d6de3be8a1408138bdb1b19c4c2f5cd9dd1e5329f603aa02527ff162
- MD5 99ad69d2ac4fd9bce681d4312cce09b6
- SHA1 ea128c27ce2f879e40c2f0d1e94bc21373650f30
- SHA512 a3258808e0884d2d830ecab9e79be602f1337f38632f42f8eb98e8ff089046764fa9840d15f0b310a4cba1f45fa2774e6ccccc8bce333abeb570643baa9a7bbe
- SSDEEP 768:oO5d2K411M6MHE2Lwq9phI+kM0zxa83aMd1daEzEwneUzzQuoeWzdj4Lq4i4XQQz:oO56
- TLSH T1AD6464A2F1C01270F44512F3D256B3549A3064448B19E7AB6277E22DBF63BD7AB790F4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TinyCAD\library\DISCRETE.mdb
- Size 176KB
- SHA256 71350ec9d25f25b027c65cf9541609e164b11d1904c0aef726a96cfb820a26fa
- MD5 b5d9964dad4edb73b392fa2e6cc9a944
- SHA1 6dd35cbcc442ae102e44b09a6a036346eebe3cb3
- SHA512 587779e7377d7657d822a18959d1054d91dec7db513f3614d3017f82f3e1c4a820fbcbc5400464da376fa7e76d24e2b4ef0600c0bbb994e4b4b059aa21bb07bd
- SSDEEP 384:8eu/vL2+J4iA6DskL9RH7x70RVvgJosIBpVekZ4OjF7bZIxfV2:34vq7KskX7xAL
- TLSH T1AB047816FB508803E0956B30EEE383853B31FC845BC2578B2184B32DAE7B7D5DD96695
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TinyCAD\library\IC-CMOS4000.mdb
- Size 168KB
- SHA256 3782d223bc434c74377a3a05546d2fc7c50b3875fc3cc7bdccdcd4ba64f2ac48
- MD5 d68f81ba390b4e9171f2daef3a3f95c0
- SHA1 b157531019f289a5a23acde30191c1659d23b339
- SHA512 19eb5bfca54ab926ed7dc5f5ce5e6a9fad0c2c80cca0de0e60d3272dfdf4382d258eab76864ea41d1e47b406529d9ff593cbc10d9fe38a62447512db30eb3477
- SSDEEP 384:QoFa5vBd7iA6+MkuDxwu6610B+ijx0C38jOzZ7:a5vzjTMkuDxRf
- TLSH T179F3C826FB908E12D5645E31BDE387883F31FC418A92DB8B2090736E6E7B3D59D156C8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TinyCAD\library\IC-OPAMP.mdb
- Size 160KB
- SHA256 5ac5dd5e090f5de17993c4a704ffb4de00f598c9f7b71fca5c695b450ad443e6
- MD5 aba60f5e5cd3cd17b5ad12385454d3b8
- SHA1 5a5dec0c9e0b889c36526b49035e19c5e503fa26
- SHA512 7db38ee80fa4064e054d4896b6316bb995fa0ea005b92aae68406266162b710fc9d5a0f7736ce78b96a89eb69cfcdcf754715b6c55c24dd905eff13a381130b9
- SSDEEP 384:vTSmv72hAciA6moWkuFxc0qek5NH+KsV:vxva5toWkuFxc0Y5
- TLSH T1C0F3B817BBD48E12E4556E31BEE347892F31BC0159D6C78B2080B31E7E7B2C59E216D9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TinyCAD\library\IC-VREG.mdb
- Size 160KB
- SHA256 3c0363448d09640db2caab75b1cc722767f9b53b9227e843759cfe501224bec4
- MD5 2691299ca7806e539f1ff28ae98dc652
- SHA1 26b36c5ce6ae43997dcf2db0ed08afa7367bb890
- SHA512 919047b4bfc0c9cd7d66807ee755a4ab4e393a54f6aff31dd4f098005d0917c6bf4074fb8f1f0e622e8c65ff0081d4777bdc3b4ab76649ec3f05d67083b7ce13
- SSDEEP 384:tTCfJvsABOiA6KWkQ0Fxh7sfjtho4+oOikS:tGvfgPWk/FxhwHB
- TLSH T131F3A902F7948D22D5566E31BEE387892F21FC0199D58BCB2084B31E6E7B7C59D21BC9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TinyCAD\library\Microcontroller.mdb
- Size 204KB
- SHA256 765bcc943bfd50da81ba8f4adef537a90ede9fba7bf4719ba7968bb98bfe5947
- MD5 06ff702c93a7ab8246c78a465165ef39
- SHA1 d63ffb2d051b7060b61848a3694e8d1a620c4bdf
- SHA512 9c87bfe376ca3af2c53f4c94d9dc9167735be74cd72fc6860932be05e65e5d2851759c2e434bee761dc292563a135fe569689831b1a688a024c28ba73e0d68c9
- SSDEEP 768:XV2HxuDa9Mv8G97QQWMc9SutQjKNmfnY0h5l+ontzV7HhrPWfklu/irrPgKH8GbL:XVtz
- TLSH T1BF149EC0E2C06290F11013B75369B9289D319489CD55F6BDFA33D32A9F53A76BBB6078
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TinyCAD\library\passive.mdb
- Size 200KB
- SHA256 a64c20627f998d378038bb32679697463a99169e443ba1f0417823d6bf2f95ca
- MD5 e21f58c6121816c70fd8ec79f5eacef4
- SHA1 377c8869cc095f6914850c7a4680aee6d1ac34d3
- SHA512 46cd9ded4a192b1cfb182d4125f2d4e9cfabe8a55a856098e33b4192cb4ceb9e3cf8000c346e8c2e25b57ecb754f8d75529d3338c3a773c931f18fcba2aace0f
- SSDEEP 768:DxCgvn2mHkjCQatfAVx9GXkgkdMu+qqGTVZ1:D0gvdk2pAVxgXkZ
- TLSH T1DB14FB16EF84C807D0855B31EEF283893A31ECC94BD7674B6488722A9DB73D8DCD2599
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TinyCAD\library\passive2.mdb
- Size 192KB
- SHA256 d0bb040f829e03add423faf4d1962e20809240e3c1dba07314ee6c83c4617171
- MD5 60e74e42f3b200e85f5dfc2a2ac07a85
- SHA1 76c9a92852c6071339e79eea06ee754d43a47985
- SHA512 77a11e19e6c36181e4710a7f41910bb41f6838da717a86dcb30e4f4f6353de390fb6060fbc71fa4d6352d4b8934fefb489070fac380fc07730db4b6d331eda08
- SSDEEP 768:tvCLrvkF3Qx7AHVBuYJ0JxNEz2RWITzTZwNz:tvMkpQx71NEz+
- TLSH T1FB14AC1ABB40C813D5945B30EDE283993B31FC858BDA574B30C47729AE7B7D4CC92A98
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TinyCAD\library\semi.mdb
- Size 180KB
- SHA256 36920faf6f3742643962bcd0dc2bfaa44fd02a3ec283771c96cd525b0b260eb5
- MD5 8f827edc5f115e6f2adfbc938fbea641
- SHA1 77540cb7eb554dfee265ed4a2c746c70264df643
- SHA512 667a3146cb01f8798c58a514c591ac6fe16a4142611f81f5d45b15701c55579e6c68d525305e76400fef191c7f711bbd61cbbbad411e2895611b46c2c5fc6b37
- SSDEEP 384:3UdQvfCiA6AHkAl0nSEx2huGoF9bwrJ8ITeVE15mYeS:RvUZHkgExU
- TLSH T10604A906FF948813E0552F31ADE683853B31FC854BC6978B2184B32DAE7B3D9DC96685
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TinyCAD\library\switches.mdb
- Size 180KB
- SHA256 3b4487c87cdbc6cb0368f8642cd9e96e87beebc37c66ae0279961a0e35b86d1e
- MD5 67c80e23d982982cd89f73705f975ead
- SHA1 f75cf303082cf1e636beead0ca9e805ae5a9326c
- SHA512 035ff6126af48372ed841199a51320df90f58a8224ba584abea5ff8af628be1712d6b7e445282a792588143061cfd6f4858c23187bee6e00962127d91822fc35
- SSDEEP 384:lUZYFvnyHMx1iA6w3vkfR9azWBxPFgmFaRAwM43nUG5:Lvy+pJ3vkpCWBxPFPt43
- TLSH T1A104AB5AFF95C913DAA44934BEE3C3992731FC818A8A878B32C4731D2DBB7D44C61694
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TinyCAD\library\valve.mdb
- Size 156KB
- SHA256 166292b31900c288f7024960fcb1593f437826e036f559686e2724943fe2d9cb
- MD5 be5bd8a9ce321cd9b26810647088085e
- SHA1 362438e6c3fb2056aa55fa240d7d921d5471fd9b
- SHA512 51768b64267bd3b7df5067fadf8341e9876557be6698341c80d62f3e1ce81e8de0e952be2bcc7effdba32b0917eadd529cc83e3b8c6596005aa7974671410728
- SSDEEP 384:xkHok+E9Hkr2gTCq62KiA6KhsX+1Nx4w0y92Nz1O5:xkHok9y2gTbU/hsX0x4w0y92G
- TLSH T105F3DE03FBC48512F5DD6A304EE347C9E63ABED05E568B0B2494BB1E7C312C6AD61AD1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TinyCAD\zlib1.dll
- Size 54KB
- SHA256 2b6a6a55016c7cfeb5e8434b822743e48d53af879da70b84e4dcd1e205731a82
- MD5 d274ea8c4b243a5f9431c475f1cb6890
- SHA1 8fb5863bc0476936552c57201db7157062d4c52d
- SHA512 506ab9e4525f8a12fc9d96f2d083d93a2ae66cbb34acfbfed87fb9e20f0841e1962640f40cdfccd2c0f05ba586efde2c4af5be824df12271c506465182d0448f
- SSDEEP 1536:TozJ1f1Q4HroGEXRKQ6CthnToIfnIOrIOnvK:MPlHrARKQ6YTBfJdnvK
- TLSH T1C7436D1287D997E6E8B8153A54DF931ECB32B20547AEC6C7684C1BA568133E5A7303CF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsw1341.tmp\InstallOptions.dll
- Size 12KB
- SHA256 a505e6c537a5ce0166227dda9f7671605395592ac9f1a3764e8a01b713939db1
- MD5 07f3b3445f66e1089567796bf3c8be78
- SHA1 851eb574c1067b23a654f8aa47b17ef599b24d1c
- SHA512 8c56308fff3a947b26fd0d98dbdd96c406ddf967f5d7abee8cba082b6c46a4e575094bb0bb981551ac5160bb5089cf6fb125dd17a659c427e28c07402adab1c3
- SSDEEP 192:pzi5iBjGHp29db9Dd+w6VPESclh3I8dYvwqu7hwbbHF1QuCb:pO5kjGHSDdgjo6pvwqu72bbMum
- TLSH T1CE422A6223849CF3E795423AB0563B036B9696267D516ED1C7330FC67E2308E6EB6353
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsw1341.tmp\ioSpecial.ini
- Size 624B
- SHA256 589c0dc0415d8c25541dd47c2475703cfdfa7b9e8cbee09dccca8e8c826ab5a3
- MD5 22fdd577c83062182a320d66b712345f
- SHA1 1053da75c6d5729b372c39f5953e5b60c323fc4d
- SHA512 ceadf256f3c258ae42f01c37ac57cf367cf152c4a9d2968e61ff8356235c6d7055911f9fc37bf67f238236b5eb0e4e4a73eb4944b7cbb2f3e8c2740975c4fa14
- TLSH T14FF0A298411A031E8834561654FF7BE507D02D384B0236F4F5625C83D74ECE288ED6C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsw1341.tmp\ioSpecial.ini
- Size 698B
- SHA256 ca3688d000f1d1985041da16ed3f8ece56e759a7945eb82d0bf8fa832a33b748
- MD5 0d95196f6490a06c5e107cc48a3dcb93
- SHA1 0671bd08e0ca9987f3267b994cbe68663645da0c
- SHA512 d9b8c0413cd64aa15ca2e871f1d0b8ef42bee772138fdc22939450b838fc3b3f16df8076385c4670bffab8fd861b341a72192dda8ee04046491256dc5fd4b6e6
- TLSH T16901F489841F9329042054A660FE37E547D02D3C4B123CF6F0529C86534DDD34AEDED2
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\msvcr71.dll
- Size 340KB
- SHA256 8094af5ee310714caebccaeee7769ffb08048503ba478b879edfef5f1a24fefe
- MD5 86f1895ae8c5e8b17d99ece768a70732
- SHA1 d5502a1d00787d68f548ddeebbde1eca5e2b38ca
- SHA512 3b7ce2b67056b6e005472b73447d2226677a8cadae70428873f7efa5ed11a3b3dbf6b1a42c5b05b1f2b1d8e06ff50dfc6532f043af8452ed87687eefbf1791da
- SSDEEP 6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E
- TLSH T10374C012B1A3CCB3D0B6007449596B599BBFE43046798A73BFE80E4E4F746D1D726A23
- MD5 SHA1 SHA512 SSDEEP TLSH