Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    73s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    29/01/2025, 22:22

General

  • Target

    DenuvoGenerator.exe

  • Size

    28.8MB

  • MD5

    a7f28976c91fc93e8c03636114a514f4

  • SHA1

    011b721766cb4c1d1a049c5d6d2a2dd4b01ba02b

  • SHA256

    edbca620600a6de56762e841f12eb92b4c940b50036404422fdd3f0d79350653

  • SHA512

    38a52902d56c43be0147a4ad47bec0fc8ddc752d5ef8b6ae822f8c9b559238e42a7fe7d59ba6392311411e428471ea586b8f28ce57b61ca558c33e57d5a1f397

  • SSDEEP

    786432:2ow/lm7W8888m1NK85l8dPXh6BYdBUjdSYCxeDj0Vh:Slm7Wm8mKWlmPRaYdB61j0

Score
7/10
upx

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DenuvoGenerator.exe
    "C:\Users\Admin\AppData\Local\Temp\DenuvoGenerator.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:760
    • C:\Users\Admin\AppData\Local\Temp\DenuvoGenerator.exe
      "C:\Users\Admin\AppData\Local\Temp\DenuvoGenerator.exe"
      2⤵
      • Loads dropped DLL
      PID:1940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI7602\python313.dll

    Filesize

    1.8MB

    MD5

    9a3d3ae5745a79d276b05a85aea02549

    SHA1

    a5e60cac2ca606df4f7646d052a9c0ea813e7636

    SHA256

    09693bab682495b01de8a24c435ca5900e11d2d0f4f0807dae278b3a94770889

    SHA512

    46840b820ee3c0fa511596124eb364da993ec7ae1670843a15afd40ac63f2c61846434be84d191bd53f7f5f4e17fad549795822bb2b9c792ac22a1c26e5adf69

  • memory/1940-1149-0x000007FEF6780000-0x000007FEF6DE5000-memory.dmp

    Filesize

    6.4MB