Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
1captainsim...es.rar
windows7-x64
3captainsim...es.rar
windows10-2004-x64
3captainsim...tz.ttf
windows7-x64
4captainsim...tz.ttf
windows10-2004-x64
7captainsim...ar.ttf
windows7-x64
3captainsim...ar.ttf
windows10-2004-x64
7captainsim...ch.flt
windows7-x64
3captainsim...ch.flt
windows10-2004-x64
3captainsim...se.flt
windows7-x64
3captainsim...se.flt
windows10-2004-x64
3captainsim...ft.cfg
windows7-x64
3captainsim...ft.cfg
windows10-2004-x64
3captainsim...on.flt
windows7-x64
3captainsim...on.flt
windows10-2004-x64
3captainsim...as.cfg
windows7-x64
3captainsim...as.cfg
windows10-2004-x64
3captainsim...mb.flt
windows7-x64
3captainsim...mb.flt
windows10-2004-x64
3captainsim...es.cfg
windows7-x64
3captainsim...es.cfg
windows10-2004-x64
3captainsim...al.flt
windows7-x64
3captainsim...al.flt
windows10-2004-x64
3captainsim...el.cfg
windows7-x64
3captainsim...el.cfg
windows10-2004-x64
3captainsim...ay.cfg
windows7-x64
3captainsim...ay.cfg
windows10-2004-x64
3captainsim...04.bin
windows7-x64
3captainsim...04.bin
windows10-2004-x64
3captainsim...4.gltf
windows7-x64
3captainsim...4.gltf
windows10-2004-x64
3captainsim...04.xml
windows7-x64
3captainsim...04.xml
windows10-2004-x64
1Analysis
-
max time kernel
118s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/09/2024, 17:50
Static task
static1
Behavioral task
behavioral1
Sample
captainsim-aircraft-m774-v1-3-0-updated-liveries.rar
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
captainsim-aircraft-m774-v1-3-0-updated-liveries.rar
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
captainsim-aircraft-m774/Captain_Sim/fonts/Quartz.ttf
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
captainsim-aircraft-m774/Captain_Sim/fonts/Quartz.ttf
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
captainsim-aircraft-m774/Captain_Sim/fonts/Roboto-Regular.ttf
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
captainsim-aircraft-m774/Captain_Sim/fonts/Roboto-Regular.ttf
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/Approach.flt
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/Approach.flt
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/Cruise.flt
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/Cruise.flt
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/aircraft.cfg
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/aircraft.cfg
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/apron.flt
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/apron.flt
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/cameras.cfg
Resource
win7-20240729-en
Behavioral task
behavioral16
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/cameras.cfg
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/climb.flt
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/climb.flt
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/engines.cfg
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/engines.cfg
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/final.flt
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/final.flt
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/flight_model.cfg
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/flight_model.cfg
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/gameplay.cfg
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/gameplay.cfg
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/model/m774_404.bin
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/model/m774_404.bin
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/model/m774_404.gltf
Resource
win7-20240729-en
Behavioral task
behavioral30
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/model/m774_404.gltf
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/model/m774_404.xml
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/model/m774_404.xml
Resource
win10v2004-20240802-en
General
-
Target
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/Approach.flt
-
Size
5KB
-
MD5
21e9be821af081b9b295d00f719cf379
-
SHA1
6df2a21f78fc23cfe2a8f727ae898067ec7859f1
-
SHA256
adb067b89239b8bb885eb0c55f62d7a942990120e47a8675f2cf0669d0b87fb0
-
SHA512
179bc9ea9c30a80b5457be03d2cb62dd8537e206af9fc989299372069c003f88f69ebaf494e868da28dfbe4aafa39c48edc964f41a63cab4a85862cf4b9a7551
-
SSDEEP
96:pEUPE57uoFupFu2FuUXm5t4PRcyEYiLj4zK2p:a7uoFupFu2FugnPRBEVX4zK2p
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\flt_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\.flt rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\.flt\ = "flt_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\flt_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\flt_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\flt_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\flt_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\flt_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2800 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2800 AcroRd32.exe 2800 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2376 wrote to memory of 2428 2376 cmd.exe 32 PID 2376 wrote to memory of 2428 2376 cmd.exe 32 PID 2376 wrote to memory of 2428 2376 cmd.exe 32 PID 2428 wrote to memory of 2800 2428 rundll32.exe 33 PID 2428 wrote to memory of 2800 2428 rundll32.exe 33 PID 2428 wrote to memory of 2800 2428 rundll32.exe 33 PID 2428 wrote to memory of 2800 2428 rundll32.exe 33
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\captainsim-aircraft-m774\SimObjects\Airplanes\CS_B777F_GE110B1\Approach.flt1⤵
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\captainsim-aircraft-m774\SimObjects\Airplanes\CS_B777F_GE110B1\Approach.flt2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\captainsim-aircraft-m774\SimObjects\Airplanes\CS_B777F_GE110B1\Approach.flt"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2800
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD523f99b96c57651ed99edca65308873a3
SHA12134bab8f8808a24b52d5268f1c8e59d073d97ef
SHA256c50bf0f84f5867f459ba76e44bcdea9dd28589130d30a23b71be61ef242dca6d
SHA512c2894b0dc5c36dd5aa8a3d36148380646970c36bab011e0165cc7923fba8c8311b776b632731782dd8db0ff2d47b61655c99bae96dadf9c384c88b08092c9ad0