Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
16s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
30/01/2025, 20:30
Behavioral task
behavioral1
Sample
DenuvoGenerator.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
DenuvoGenerator.exe
Resource
win10v2004-20250129-en
General
-
Target
DenuvoGenerator.exe
-
Size
7.6MB
-
MD5
075806151758ee773b4d8e1fbdf5bb70
-
SHA1
ffd707b639d822928ea4939f0bfc2e5ab0000cc0
-
SHA256
00dbe1d5a715d6834a9aca05a8a63992630d893d95b5f6bb5637bcbc7c856682
-
SHA512
e9758f6d6a15afd102bd442466dd607c23f18a79e9b07c8024871a54f11b3d66cac37b5bdaf27f34f37e8e52c820e1a9d375952dba1270cd39ae71e2bf3efa23
-
SSDEEP
196608:14D+kdGiwfI9jUCBB7m+mKOY7rXrZusooDmhfvsbnTNWk:e56IHL7HmBYXrYoaUNn
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1908 DenuvoGenerator.exe -
resource yara_rule behavioral1/files/0x000500000001a4c9-21.dat upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2328 wrote to memory of 1908 2328 DenuvoGenerator.exe 30 PID 2328 wrote to memory of 1908 2328 DenuvoGenerator.exe 30 PID 2328 wrote to memory of 1908 2328 DenuvoGenerator.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\DenuvoGenerator.exe"C:\Users\Admin\AppData\Local\Temp\DenuvoGenerator.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\DenuvoGenerator.exe"C:\Users\Admin\AppData\Local\Temp\DenuvoGenerator.exe"2⤵
- Loads dropped DLL
PID:1908
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD59a3d3ae5745a79d276b05a85aea02549
SHA1a5e60cac2ca606df4f7646d052a9c0ea813e7636
SHA25609693bab682495b01de8a24c435ca5900e11d2d0f4f0807dae278b3a94770889
SHA51246840b820ee3c0fa511596124eb364da993ec7ae1670843a15afd40ac63f2c61846434be84d191bd53f7f5f4e17fad549795822bb2b9c792ac22a1c26e5adf69