Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
1captainsim...es.rar
windows7-x64
3captainsim...es.rar
windows10-2004-x64
3captainsim...tz.ttf
windows7-x64
4captainsim...tz.ttf
windows10-2004-x64
7captainsim...ar.ttf
windows7-x64
3captainsim...ar.ttf
windows10-2004-x64
7captainsim...ch.flt
windows7-x64
3captainsim...ch.flt
windows10-2004-x64
3captainsim...se.flt
windows7-x64
3captainsim...se.flt
windows10-2004-x64
3captainsim...ft.cfg
windows7-x64
3captainsim...ft.cfg
windows10-2004-x64
3captainsim...on.flt
windows7-x64
3captainsim...on.flt
windows10-2004-x64
3captainsim...as.cfg
windows7-x64
3captainsim...as.cfg
windows10-2004-x64
3captainsim...mb.flt
windows7-x64
3captainsim...mb.flt
windows10-2004-x64
3captainsim...es.cfg
windows7-x64
3captainsim...es.cfg
windows10-2004-x64
3captainsim...al.flt
windows7-x64
3captainsim...al.flt
windows10-2004-x64
3captainsim...el.cfg
windows7-x64
3captainsim...el.cfg
windows10-2004-x64
3captainsim...ay.cfg
windows7-x64
3captainsim...ay.cfg
windows10-2004-x64
3captainsim...04.bin
windows7-x64
3captainsim...04.bin
windows10-2004-x64
3captainsim...4.gltf
windows7-x64
3captainsim...4.gltf
windows10-2004-x64
3captainsim...04.xml
windows7-x64
3captainsim...04.xml
windows10-2004-x64
1Analysis
-
max time kernel
148s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/09/2024, 17:50
Static task
static1
Behavioral task
behavioral1
Sample
captainsim-aircraft-m774-v1-3-0-updated-liveries.rar
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
captainsim-aircraft-m774-v1-3-0-updated-liveries.rar
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
captainsim-aircraft-m774/Captain_Sim/fonts/Quartz.ttf
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
captainsim-aircraft-m774/Captain_Sim/fonts/Quartz.ttf
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
captainsim-aircraft-m774/Captain_Sim/fonts/Roboto-Regular.ttf
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
captainsim-aircraft-m774/Captain_Sim/fonts/Roboto-Regular.ttf
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/Approach.flt
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/Approach.flt
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/Cruise.flt
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/Cruise.flt
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/aircraft.cfg
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/aircraft.cfg
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/apron.flt
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/apron.flt
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/cameras.cfg
Resource
win7-20240729-en
Behavioral task
behavioral16
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/cameras.cfg
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/climb.flt
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/climb.flt
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/engines.cfg
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/engines.cfg
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/final.flt
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/final.flt
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/flight_model.cfg
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/flight_model.cfg
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/gameplay.cfg
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/gameplay.cfg
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/model/m774_404.bin
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/model/m774_404.bin
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/model/m774_404.gltf
Resource
win7-20240729-en
Behavioral task
behavioral30
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/model/m774_404.gltf
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/model/m774_404.xml
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/model/m774_404.xml
Resource
win10v2004-20240802-en
General
-
Target
captainsim-aircraft-m774-v1-3-0-updated-liveries.rar
-
Size
345.2MB
-
MD5
3822a805952ba74f3bcdf288ab71fd29
-
SHA1
353711013d2c3290854c5e029ee3c74acb35f998
-
SHA256
18139a654a7161b085bb900abbe306b08694874d9288369f56e065c54af6f3f0
-
SHA512
89e946c00ac38ec128877d70b161453acfdcdd594f1092762489eb8a9151ca6be5bc7039c6677914caf0731ac3929f5a51e1e9e4dbcc5cfac8be6e2c25fdc76d
-
SSDEEP
6291456:Zqx+tX904fsW1n5JsitGyassuEWpq86vW4poJ3V856OS+S74LeAujXeY0:M+/Zrn7llahi6bylO8DTbVjg
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1716 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1716 vlc.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe 1716 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1716 vlc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2528 wrote to memory of 2108 2528 cmd.exe 31 PID 2528 wrote to memory of 2108 2528 cmd.exe 31 PID 2528 wrote to memory of 2108 2528 cmd.exe 31 PID 2108 wrote to memory of 2876 2108 rundll32.exe 33 PID 2108 wrote to memory of 2876 2108 rundll32.exe 33 PID 2108 wrote to memory of 2876 2108 rundll32.exe 33 PID 2876 wrote to memory of 1716 2876 rundll32.exe 35 PID 2876 wrote to memory of 1716 2876 rundll32.exe 35 PID 2876 wrote to memory of 1716 2876 rundll32.exe 35
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\captainsim-aircraft-m774-v1-3-0-updated-liveries.rar1⤵
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\captainsim-aircraft-m774-v1-3-0-updated-liveries.rar2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\captainsim-aircraft-m774-v1-3-0-updated-liveries.rar3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\captainsim-aircraft-m774-v1-3-0-updated-liveries.rar"4⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1716
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD50e99a7d3ce16050cbed3a8428b3bd356
SHA12ca6fdf37fa747d315ade8a38915fb81577a04e4
SHA25648182205abfd5bb61d07ebfa0d81071b512fa6633fd8a284dd5cb967fbf08b8d
SHA5124ed8dbc9c4a3b225b89325f8bb329c33a8e667a28631abae9780dc01eefeaa006cbfbdfd5ffc19f2c145b8dd185de04a8c97aa7a42e8e87752523ad0b528c4f1
-
Filesize
18B
MD5bc50f52549ed0081d2dee55afb806835
SHA147f20e1155eed8cfe5fcc08f48e122115fa93fc4
SHA256b939b5c05b2402f6f1bc2ddb86f0d239c4caa405e3b7fbb2dacfcdf443fead41
SHA512c39b5f95005c622a32da8b81e2585109289fb8b554b59252805164098dc3702c5bb70e186ee63febf6d108afa003f69908a56431c34559c7f9fad67ca0dd886f