6de55708dffd9df0510a105116ff789e9c1bf8fda54c3f66ec841e23a72a35a9

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 20:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CrysisCoop/Bin64/Crysis Co-op.lnk
Size

1KB
MD5

1a668109d996061cb7230abc2a7605fe
SHA1

62a391068a0d0f00f554b9ed78d5da9f82726ec0
SHA256

87f668dbc1fb0764266a866ba095ce8af94e4f090a05a26f81e86dbf883c5856
SHA512

dd67e43d68c87c1cc49733fec0ad1d9dd80ca6fac2faa4ef82b5d392f2663d903ca8d8994e8f5cb15b2c97ead5382a39d291b564fc6e511335ae9da9fa7db6c2

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\CrysisCoop\Bin64\Crysis Co-op.lnk"
1⤵
- Enumerates connected drives
PID:1700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...