Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    28/09/2024, 17:50

General

  • Target

    captainsim-aircraft-m774/SimObjects/Airplanes/CS_B777F_GE110B1/Cruise.flt

  • Size

    5KB

  • MD5

    ba1247e2ddc258aa18e63e96c8b7886e

  • SHA1

    0e1cc2d082466176030acad88cc0a57747595a8a

  • SHA256

    13e9dc2582277ebdb49baef78a216e623cca3a3dbd7d0ffcd3fa4facf2df74cc

  • SHA512

    c9a842acf61c5c2550831027274e775b193f23e2bd35a3ce3a7ac56c50b8a6412fe800a0c9114f47e571ae595079e460fb6e37772095b78241f99a385ea49a17

  • SSDEEP

    96:pEUPE57uoFupFu2FuUXm5t4Pmcyh5iLj4zK2p:a7uoFupFu2FugnPmBh4X4zK2p

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\captainsim-aircraft-m774\SimObjects\Airplanes\CS_B777F_GE110B1\Cruise.flt
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2192
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\captainsim-aircraft-m774\SimObjects\Airplanes\CS_B777F_GE110B1\Cruise.flt
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2800
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\captainsim-aircraft-m774\SimObjects\Airplanes\CS_B777F_GE110B1\Cruise.flt"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2828

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    2fc161992f798e6ec6106d996a46fb44

    SHA1

    5b6a0d9dc5050ba764e484377ee49d44a6157054

    SHA256

    aa548549a36561b646c3b48e1f4581bd72a90b648a7a880a95cfd8cb94dabda3

    SHA512

    29d0c42b827d39ad4381d1dafdb3d7af98bc34c174fc148c0a0b9109773f4472713b51ff23c4b0649a5f257ad0a503c3b5ddb80958b52667ce0769455b25acd4