Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
73s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
29/01/2025, 22:22
Behavioral task
behavioral1
Sample
DenuvoGenerator.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
DenuvoGenerator.exe
Resource
win10v2004-20250129-en
General
-
Target
DenuvoGenerator.exe
-
Size
28.8MB
-
MD5
a7f28976c91fc93e8c03636114a514f4
-
SHA1
011b721766cb4c1d1a049c5d6d2a2dd4b01ba02b
-
SHA256
edbca620600a6de56762e841f12eb92b4c940b50036404422fdd3f0d79350653
-
SHA512
38a52902d56c43be0147a4ad47bec0fc8ddc752d5ef8b6ae822f8c9b559238e42a7fe7d59ba6392311411e428471ea586b8f28ce57b61ca558c33e57d5a1f397
-
SSDEEP
786432:2ow/lm7W8888m1NK85l8dPXh6BYdBUjdSYCxeDj0Vh:Slm7Wm8mKWlmPRaYdB61j0
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1940 DenuvoGenerator.exe -
resource yara_rule behavioral1/files/0x00030000000209b0-1147.dat upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 760 wrote to memory of 1940 760 DenuvoGenerator.exe 30 PID 760 wrote to memory of 1940 760 DenuvoGenerator.exe 30 PID 760 wrote to memory of 1940 760 DenuvoGenerator.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\DenuvoGenerator.exe"C:\Users\Admin\AppData\Local\Temp\DenuvoGenerator.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\DenuvoGenerator.exe"C:\Users\Admin\AppData\Local\Temp\DenuvoGenerator.exe"2⤵
- Loads dropped DLL
PID:1940
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD59a3d3ae5745a79d276b05a85aea02549
SHA1a5e60cac2ca606df4f7646d052a9c0ea813e7636
SHA25609693bab682495b01de8a24c435ca5900e11d2d0f4f0807dae278b3a94770889
SHA51246840b820ee3c0fa511596124eb364da993ec7ae1670843a15afd40ac63f2c61846434be84d191bd53f7f5f4e17fad549795822bb2b9c792ac22a1c26e5adf69