Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
56s -
max time network
22s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
17/04/2024, 13:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Crowbar.exe
Resource
win10-20240404-en
windows10-1703-x64
7 signatures
120 seconds
General
-
Target
Crowbar.exe
-
Size
4.3MB
-
MD5
3ec3b40887c5cf7962773e60dfb201bc
-
SHA1
d9e8c971af104fe9e095d3917683ad63a6a03c28
-
SHA256
b723a406a7f99a5565c10dd6e8c8de02e8988f6162e7fe44bd0e9ca9d58ebad9
-
SHA512
01ee89e1f4c0a963b4f2b139bae118479565f38bd556244fae976b103b13c657aa2610bbf18952d0d5cb86faeff8997d7f574f64f075f556204c309c742dba8c
-
SSDEEP
49152:bmEVdZRzpCm9wROW5TUBJ55rfAocpl1LVC8aoLCE4c4OTernGmcFxs/0JhxCU5:zwDNA5Kb1LYvc4Ovfs/6
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000\Software\Microsoft\Internet Explorer\TypedURLs Crowbar.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4760 Crowbar.exe Token: SeDebugPrivilege 4356 taskmgr.exe Token: SeSystemProfilePrivilege 4356 taskmgr.exe Token: SeCreateGlobalPrivilege 4356 taskmgr.exe Token: 33 4356 taskmgr.exe Token: SeIncBasePriorityPrivilege 4356 taskmgr.exe -
Suspicious use of FindShellTrayWindow 49 IoCs
pid Process 4760 Crowbar.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe -
Suspicious use of SendNotifyMessage 48 IoCs
pid Process 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe 4356 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Crowbar.exe"C:\Users\Admin\AppData\Local\Temp\Crowbar.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4760
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4356