Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/09/2024, 17:50

General

  • Target

    captainsim-aircraft-m774/Captain_Sim/fonts/Quartz.ttf

  • Size

    56KB

  • MD5

    55f96a010646b90457e9bc03d43e2b67

  • SHA1

    74d93c590b5de2e4ee03fd3d3cc8ea64439131cc

  • SHA256

    8ef16894dc23cde8fd4775d96190528d7d5b9eaea40c145a4dcde8282aeb5225

  • SHA512

    3984193c18e4f0e89b662e7ee84a082abc3c42f6fda763a9d846760a08519abf1b7e5cbe6beb48e2a640713bc74c14b58406aae38dbd9f607622524cd2e4b05e

  • SSDEEP

    768:AXHhXTE6suVhMbsznpsP02HsbnOFANYOEI++0vDwk0v6frIu:cRoetzC02mF0rASfrN

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\captainsim-aircraft-m774\Captain_Sim\fonts\Quartz.ttf
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2076
    • C:\Windows\System32\fontview.exe
      "C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\captainsim-aircraft-m774\Captain_Sim\fonts\Quartz.ttf
      2⤵
        PID:760

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads