Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2024, 21:50
Static task
static1
Behavioral task
behavioral1
Sample
spopr.exe
Resource
win7-20231129-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
spopr.exe
Resource
win10v2004-20240419-en
5 signatures
150 seconds
General
-
Target
spopr.exe
-
Size
15.6MB
-
MD5
96635acc38e3549a0ba2a180d6d51e79
-
SHA1
6a15b50cad92bcbb533512cc756b54caa00ba54e
-
SHA256
cfecdd4542e1ef6a45ccafea603be0dc48610ff20377526344854fcfbc7b2356
-
SHA512
c87e9e49246493f98031f7bd8a24e8df1a0fe245e87ba2bbee2fbdc54176bb2310cc21d881c2b8e4af2b6098efeffe7b0debf386e94b01554b43ffd19197284e
-
SSDEEP
98304:cSuAzAl4/8AyLvSxwlKMBoNjBXuRedMxS0OuPOvtiUBG42OXfW9Q3lU7XzEHcFvz:cSueAwtGbToNB8VOvH2xQ1WDUc1uAUy
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Disable Script Debugger = "yes" spopr.exe Set value (str) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DisableScriptDebuggerIE = "yes" spopr.exe -
Suspicious use of FindShellTrayWindow 14 IoCs
pid Process 3672 spopr.exe 3672 spopr.exe 3672 spopr.exe 3672 spopr.exe 3672 spopr.exe 3672 spopr.exe 3672 spopr.exe 3672 spopr.exe 3672 spopr.exe 3672 spopr.exe 3672 spopr.exe 3672 spopr.exe 3672 spopr.exe 3672 spopr.exe -
Suspicious use of SendNotifyMessage 14 IoCs
pid Process 3672 spopr.exe 3672 spopr.exe 3672 spopr.exe 3672 spopr.exe 3672 spopr.exe 3672 spopr.exe 3672 spopr.exe 3672 spopr.exe 3672 spopr.exe 3672 spopr.exe 3672 spopr.exe 3672 spopr.exe 3672 spopr.exe 3672 spopr.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3672 spopr.exe 3672 spopr.exe 3672 spopr.exe 3672 spopr.exe