Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    28/09/2024, 17:50

General

  • Target

    captainsim-aircraft-m774/Captain_Sim/fonts/Quartz.ttf

  • Size

    56KB

  • MD5

    55f96a010646b90457e9bc03d43e2b67

  • SHA1

    74d93c590b5de2e4ee03fd3d3cc8ea64439131cc

  • SHA256

    8ef16894dc23cde8fd4775d96190528d7d5b9eaea40c145a4dcde8282aeb5225

  • SHA512

    3984193c18e4f0e89b662e7ee84a082abc3c42f6fda763a9d846760a08519abf1b7e5cbe6beb48e2a640713bc74c14b58406aae38dbd9f607622524cd2e4b05e

  • SSDEEP

    768:AXHhXTE6suVhMbsznpsP02HsbnOFANYOEI++0vDwk0v6frIu:cRoetzC02mF0rASfrN

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 13 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\captainsim-aircraft-m774\Captain_Sim\fonts\Quartz.ttf
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3008
    • C:\Windows\System32\fontview.exe
      "C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\captainsim-aircraft-m774\Captain_Sim\fonts\Quartz.ttf
      2⤵
      • Drops file in Windows directory
      PID:2984

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Fonts\Quartz_0.ttf

    Filesize

    56KB

    MD5

    55f96a010646b90457e9bc03d43e2b67

    SHA1

    74d93c590b5de2e4ee03fd3d3cc8ea64439131cc

    SHA256

    8ef16894dc23cde8fd4775d96190528d7d5b9eaea40c145a4dcde8282aeb5225

    SHA512

    3984193c18e4f0e89b662e7ee84a082abc3c42f6fda763a9d846760a08519abf1b7e5cbe6beb48e2a640713bc74c14b58406aae38dbd9f607622524cd2e4b05e

  • memory/2984-26-0x00000000004B0000-0x00000000004B1000-memory.dmp

    Filesize

    4KB

  • memory/2984-31-0x00000000004B0000-0x00000000004B1000-memory.dmp

    Filesize

    4KB