Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23/04/2024, 21:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ItronFCSHelp.exe
Resource
win7-20240221-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
ItronFCSHelp.exe
Resource
win10v2004-20240412-en
4 signatures
150 seconds
General
-
Target
ItronFCSHelp.exe
-
Size
16.9MB
-
MD5
bff90f501255354c42069acb063997da
-
SHA1
c389e5b7b7702d029e6781814b65d9178f74a472
-
SHA256
9ed1ea5db3055b2015d11317b42fd012cf2c3becde14349f577e070f2bc16e27
-
SHA512
2512ce0ce3b7bcff4045e069066b07058b7567ac90f736a92c769f15dd64186f872deb8eaeae6096eb19c8e742b17e52d148d5735345402eb776604f752cc4b6
-
SSDEEP
393216:fVkJ9Aw69W+gh98zIwA2WWv9QgZq7LUFFNLEN1A:nt9+hmTWXb7QLGLA
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main ItronFCSHelp.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe -
Suspicious use of SendNotifyMessage 5 IoCs
pid Process 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe 2952 ItronFCSHelp.exe