Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
1captainsim...es.rar
windows7-x64
3captainsim...es.rar
windows10-2004-x64
3captainsim...tz.ttf
windows7-x64
4captainsim...tz.ttf
windows10-2004-x64
7captainsim...ar.ttf
windows7-x64
3captainsim...ar.ttf
windows10-2004-x64
7captainsim...ch.flt
windows7-x64
3captainsim...ch.flt
windows10-2004-x64
3captainsim...se.flt
windows7-x64
3captainsim...se.flt
windows10-2004-x64
3captainsim...ft.cfg
windows7-x64
3captainsim...ft.cfg
windows10-2004-x64
3captainsim...on.flt
windows7-x64
3captainsim...on.flt
windows10-2004-x64
3captainsim...as.cfg
windows7-x64
3captainsim...as.cfg
windows10-2004-x64
3captainsim...mb.flt
windows7-x64
3captainsim...mb.flt
windows10-2004-x64
3captainsim...es.cfg
windows7-x64
3captainsim...es.cfg
windows10-2004-x64
3captainsim...al.flt
windows7-x64
3captainsim...al.flt
windows10-2004-x64
3captainsim...el.cfg
windows7-x64
3captainsim...el.cfg
windows10-2004-x64
3captainsim...ay.cfg
windows7-x64
3captainsim...ay.cfg
windows10-2004-x64
3captainsim...04.bin
windows7-x64
3captainsim...04.bin
windows10-2004-x64
3captainsim...4.gltf
windows7-x64
3captainsim...4.gltf
windows10-2004-x64
3captainsim...04.xml
windows7-x64
3captainsim...04.xml
windows10-2004-x64
1Analysis
-
max time kernel
150s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
28/09/2024, 17:50
Static task
static1
Behavioral task
behavioral1
Sample
captainsim-aircraft-m774-v1-3-0-updated-liveries.rar
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
captainsim-aircraft-m774-v1-3-0-updated-liveries.rar
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
captainsim-aircraft-m774/Captain_Sim/fonts/Quartz.ttf
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
captainsim-aircraft-m774/Captain_Sim/fonts/Quartz.ttf
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
captainsim-aircraft-m774/Captain_Sim/fonts/Roboto-Regular.ttf
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
captainsim-aircraft-m774/Captain_Sim/fonts/Roboto-Regular.ttf
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/Approach.flt
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/Approach.flt
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/Cruise.flt
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/Cruise.flt
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/aircraft.cfg
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/aircraft.cfg
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/apron.flt
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/apron.flt
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/cameras.cfg
Resource
win7-20240729-en
Behavioral task
behavioral16
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/cameras.cfg
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/climb.flt
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/climb.flt
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/engines.cfg
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/engines.cfg
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/final.flt
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/final.flt
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/flight_model.cfg
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/flight_model.cfg
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/gameplay.cfg
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/gameplay.cfg
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/model/m774_404.bin
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/model/m774_404.bin
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/model/m774_404.gltf
Resource
win7-20240729-en
Behavioral task
behavioral30
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/model/m774_404.gltf
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/model/m774_404.xml
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/model/m774_404.xml
Resource
win10v2004-20240802-en
General
-
Target
captainsim-aircraft-m774/Captain_Sim/fonts/Quartz.ttf
-
Size
56KB
-
MD5
55f96a010646b90457e9bc03d43e2b67
-
SHA1
74d93c590b5de2e4ee03fd3d3cc8ea64439131cc
-
SHA256
8ef16894dc23cde8fd4775d96190528d7d5b9eaea40c145a4dcde8282aeb5225
-
SHA512
3984193c18e4f0e89b662e7ee84a082abc3c42f6fda763a9d846760a08519abf1b7e5cbe6beb48e2a640713bc74c14b58406aae38dbd9f607622524cd2e4b05e
-
SSDEEP
768:AXHhXTE6suVhMbsznpsP02HsbnOFANYOEI++0vDwk0v6frIu:cRoetzC02mF0rASfrN
Malware Config
Signatures
-
Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\Fonts\Quartz_5.ttf fontview.exe File created C:\Windows\Fonts\Quartz_8.ttf fontview.exe File created C:\Windows\Fonts\Quartz_A.ttf fontview.exe File opened for modification C:\Windows\Fonts\Quartz.ttf fontview.exe File created C:\Windows\Fonts\Quartz_0.ttf fontview.exe File created C:\Windows\Fonts\Quartz_1.ttf fontview.exe File created C:\Windows\Fonts\Quartz_3.ttf fontview.exe File created C:\Windows\Fonts\Quartz_4.ttf fontview.exe File created C:\Windows\Fonts\Quartz.ttf fontview.exe File created C:\Windows\Fonts\Quartz_2.ttf fontview.exe File created C:\Windows\Fonts\Quartz_6.ttf fontview.exe File created C:\Windows\Fonts\Quartz_7.ttf fontview.exe File created C:\Windows\Fonts\Quartz_9.ttf fontview.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3008 wrote to memory of 2984 3008 cmd.exe 30 PID 3008 wrote to memory of 2984 3008 cmd.exe 30 PID 3008 wrote to memory of 2984 3008 cmd.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\captainsim-aircraft-m774\Captain_Sim\fonts\Quartz.ttf1⤵
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\System32\fontview.exe"C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\captainsim-aircraft-m774\Captain_Sim\fonts\Quartz.ttf2⤵
- Drops file in Windows directory
PID:2984
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD555f96a010646b90457e9bc03d43e2b67
SHA174d93c590b5de2e4ee03fd3d3cc8ea64439131cc
SHA2568ef16894dc23cde8fd4775d96190528d7d5b9eaea40c145a4dcde8282aeb5225
SHA5123984193c18e4f0e89b662e7ee84a082abc3c42f6fda763a9d846760a08519abf1b7e5cbe6beb48e2a640713bc74c14b58406aae38dbd9f607622524cd2e4b05e