After almost two days on this seemingly easy box I finally found the root flag. Iām still not sure which process is running and updating that one file, so if anyone is willing to discuss please dm me.
thanks to jkr for showing me a nice way to monitor the running processes 