6de55708dffd9df0510a105116ff789e9c1bf8fda54c3f66ec841e23a72a35a9

Analysis

max time kernel
35s
max time network
22s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 20:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CrysisCoop/Bin32/Crysis Co-op.lnk
Size

1KB
MD5

a90cbdbeb3ca80e39d9af823d2c36595
SHA1

b21888022a70011504a5888ef72e28f6ab446cd4
SHA256

85e433bb16bbedadccf5c5528f7cf6608e852da3adda286a8ab8951c3fbeef93
SHA512

10127f5ad1fc973372bd3f68566153c5bd9173eac94278e4b42f95a2f01daa6fa7529cff5f9448608216813b8e2dd4dfa02f38d7428cdbf59b5f263b6bee2d4f

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\CrysisCoop\Bin32\Crysis Co-op.lnk"
1⤵
- Enumerates connected drives
PID:2072

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...