Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
1captainsim...es.rar
windows7-x64
3captainsim...es.rar
windows10-2004-x64
3captainsim...tz.ttf
windows7-x64
4captainsim...tz.ttf
windows10-2004-x64
7captainsim...ar.ttf
windows7-x64
3captainsim...ar.ttf
windows10-2004-x64
7captainsim...ch.flt
windows7-x64
3captainsim...ch.flt
windows10-2004-x64
3captainsim...se.flt
windows7-x64
3captainsim...se.flt
windows10-2004-x64
3captainsim...ft.cfg
windows7-x64
3captainsim...ft.cfg
windows10-2004-x64
3captainsim...on.flt
windows7-x64
3captainsim...on.flt
windows10-2004-x64
3captainsim...as.cfg
windows7-x64
3captainsim...as.cfg
windows10-2004-x64
3captainsim...mb.flt
windows7-x64
3captainsim...mb.flt
windows10-2004-x64
3captainsim...es.cfg
windows7-x64
3captainsim...es.cfg
windows10-2004-x64
3captainsim...al.flt
windows7-x64
3captainsim...al.flt
windows10-2004-x64
3captainsim...el.cfg
windows7-x64
3captainsim...el.cfg
windows10-2004-x64
3captainsim...ay.cfg
windows7-x64
3captainsim...ay.cfg
windows10-2004-x64
3captainsim...04.bin
windows7-x64
3captainsim...04.bin
windows10-2004-x64
3captainsim...4.gltf
windows7-x64
3captainsim...4.gltf
windows10-2004-x64
3captainsim...04.xml
windows7-x64
3captainsim...04.xml
windows10-2004-x64
1Analysis
-
max time kernel
118s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/09/2024, 17:50
Static task
static1
Behavioral task
behavioral1
Sample
captainsim-aircraft-m774-v1-3-0-updated-liveries.rar
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
captainsim-aircraft-m774-v1-3-0-updated-liveries.rar
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
captainsim-aircraft-m774/Captain_Sim/fonts/Quartz.ttf
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
captainsim-aircraft-m774/Captain_Sim/fonts/Quartz.ttf
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
captainsim-aircraft-m774/Captain_Sim/fonts/Roboto-Regular.ttf
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
captainsim-aircraft-m774/Captain_Sim/fonts/Roboto-Regular.ttf
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/Approach.flt
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/Approach.flt
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/Cruise.flt
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/Cruise.flt
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/aircraft.cfg
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/aircraft.cfg
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/apron.flt
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/apron.flt
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/cameras.cfg
Resource
win7-20240729-en
Behavioral task
behavioral16
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/cameras.cfg
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/climb.flt
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/climb.flt
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/engines.cfg
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/engines.cfg
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/final.flt
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/final.flt
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/flight_model.cfg
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/flight_model.cfg
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/gameplay.cfg
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/gameplay.cfg
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/model/m774_404.bin
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/model/m774_404.bin
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/model/m774_404.gltf
Resource
win7-20240729-en
Behavioral task
behavioral30
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/model/m774_404.gltf
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/model/m774_404.xml
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/model/m774_404.xml
Resource
win10v2004-20240802-en
General
-
Target
captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/Cruise.flt
-
Size
5KB
-
MD5
ba1247e2ddc258aa18e63e96c8b7886e
-
SHA1
0e1cc2d082466176030acad88cc0a57747595a8a
-
SHA256
13e9dc2582277ebdb49baef78a216e623cca3a3dbd7d0ffcd3fa4facf2df74cc
-
SHA512
c9a842acf61c5c2550831027274e775b193f23e2bd35a3ce3a7ac56c50b8a6412fe800a0c9114f47e571ae595079e460fb6e37772095b78241f99a385ea49a17
-
SSDEEP
96:pEUPE57uoFupFu2FuUXm5t4Pmcyh5iLj4zK2p:a7uoFupFu2FugnPmBh4X4zK2p
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\flt_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\.flt\ = "flt_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\flt_auto_file\shell\Read rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\flt_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\flt_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\.flt rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\flt_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\flt_auto_file\shell\Read\command rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2828 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2828 AcroRd32.exe 2828 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2192 wrote to memory of 2800 2192 cmd.exe 32 PID 2192 wrote to memory of 2800 2192 cmd.exe 32 PID 2192 wrote to memory of 2800 2192 cmd.exe 32 PID 2800 wrote to memory of 2828 2800 rundll32.exe 33 PID 2800 wrote to memory of 2828 2800 rundll32.exe 33 PID 2800 wrote to memory of 2828 2800 rundll32.exe 33 PID 2800 wrote to memory of 2828 2800 rundll32.exe 33
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\captainsim-aircraft-m774\SimObjects\Airplanes\CS_B777F_GE110B1\Cruise.flt1⤵
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\captainsim-aircraft-m774\SimObjects\Airplanes\CS_B777F_GE110B1\Cruise.flt2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\captainsim-aircraft-m774\SimObjects\Airplanes\CS_B777F_GE110B1\Cruise.flt"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2828
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD52fc161992f798e6ec6106d996a46fb44
SHA15b6a0d9dc5050ba764e484377ee49d44a6157054
SHA256aa548549a36561b646c3b48e1f4581bd72a90b648a7a880a95cfd8cb94dabda3
SHA51229d0c42b827d39ad4381d1dafdb3d7af98bc34c174fc148c0a0b9109773f4472713b51ff23c4b0649a5f257ad0a503c3b5ddb80958b52667ce0769455b25acd4