Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
1captainsim...es.rar
windows7-x64
3captainsim...es.rar
windows10-2004-x64
3captainsim...tz.ttf
windows7-x64
4captainsim...tz.ttf
windows10-2004-x64
7captainsim...ar.ttf
windows7-x64
3captainsim...ar.ttf
windows10-2004-x64
7captainsim...ch.flt
windows7-x64
3captainsim...ch.flt
windows10-2004-x64
3captainsim...se.flt
windows7-x64
3captainsim...se.flt
windows10-2004-x64
3captainsim...ft.cfg
windows7-x64
3captainsim...ft.cfg
windows10-2004-x64
3captainsim...on.flt
windows7-x64
3captainsim...on.flt
windows10-2004-x64
3captainsim...as.cfg
windows7-x64
3captainsim...as.cfg
windows10-2004-x64
3captainsim...mb.flt
windows7-x64
3captainsim...mb.flt
windows10-2004-x64
3captainsim...es.cfg
windows7-x64
3captainsim...es.cfg
windows10-2004-x64
3captainsim...al.flt
windows7-x64
3captainsim...al.flt
windows10-2004-x64
3captainsim...el.cfg
windows7-x64
3captainsim...el.cfg
windows10-2004-x64
3captainsim...ay.cfg
windows7-x64
3captainsim...ay.cfg
windows10-2004-x64
3captainsim...04.bin
windows7-x64
3captainsim...04.bin
windows10-2004-x64
3captainsim...4.gltf
windows7-x64
3captainsim...4.gltf
windows10-2004-x64
3captainsim...04.xml
windows7-x64
3captainsim...04.xml
windows10-2004-x64
1Analysis
-
max time kernel
14s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/09/2024, 17:50
Static task
static1
Behavioral task
behavioral1
Sample
captainsim-aircraft-m774-v1-3-0-updated-liveries.rar
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
captainsim-aircraft-m774-v1-3-0-updated-liveries.rar
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
captainsim-aircraft-m774/Captain_Sim/fonts/Quartz.ttf
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
captainsim-aircraft-m774/Captain_Sim/fonts/Quartz.ttf
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
captainsim-aircraft-m774/Captain_Sim/fonts/Roboto-Regular.ttf
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
captainsim-aircraft-m774/Captain_Sim/fonts/Roboto-Regular.ttf
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/Approach.flt
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/Approach.flt
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/Cruise.flt
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/Cruise.flt
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/aircraft.cfg
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/aircraft.cfg
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/apron.flt
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/apron.flt
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/cameras.cfg
Resource
win7-20240729-en
Behavioral task
behavioral16
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/cameras.cfg
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/climb.flt
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/climb.flt
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/engines.cfg
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/engines.cfg
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/final.flt
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/final.flt
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/flight_model.cfg
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/flight_model.cfg
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/gameplay.cfg
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/gameplay.cfg
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/model/m774_404.bin
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/model/m774_404.bin
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/model/m774_404.gltf
Resource
win7-20240729-en
Behavioral task
behavioral30
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/model/m774_404.gltf
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/model/m774_404.xml
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/model/m774_404.xml
Resource
win10v2004-20240802-en
General
-
Target
captainsim-aircraft-m774/Captain_Sim/fonts/Roboto-Regular.ttf
-
Size
141KB
-
MD5
54a91b0619ccf9373d525109268219dc
-
SHA1
1d1d41fcadc571decb6444211b7993b99ce926e2
-
SHA256
b2efabca5ea4bc56eea829713706b5cd0788b82aca153bd4adde9b1573933b4f
-
SHA512
7f79ff3b42a672371814f42814aa5646328b1a314691d30ce09ffdc7a322adcb1af66625274f7fac024ca2f22a42b625001735711c430faef6e077e1f1d24887
-
SSDEEP
3072:ENAluNu8V5ZftwYlLzEeNgHS2pOpdO4WqLpMaSZFKVet:ENAH8XZuadpZuFw+
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1208 wrote to memory of 2756 1208 cmd.exe 30 PID 1208 wrote to memory of 2756 1208 cmd.exe 30 PID 1208 wrote to memory of 2756 1208 cmd.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\captainsim-aircraft-m774\Captain_Sim\fonts\Roboto-Regular.ttf1⤵
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\System32\fontview.exe"C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\captainsim-aircraft-m774\Captain_Sim\fonts\Roboto-Regular.ttf2⤵PID:2756
-