Overview

overview

7

Static

static

10

Danger-Mul...in.zip

windows10-2004-x64

7

Danger-Mul....0.exe

windows10-2004-x64

3

Resubmissions

02-12-2024 10:05

241202-l4j75awmbl 10

06-11-2024 12:03

241106-n71emaskem 10

06-11-2024 12:00

241106-n6lvvaskdj 10

Analysis

  • max time kernel
    119s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • submitted
    06-11-2024 12:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Danger-Multitool-2.0-main.zip

  • Size

    429KB

  • MD5

    0f07d3850fe266d560a925329417366f

  • SHA1

    2d269af3aad6f80601b81ada4308ab563952ef9f

  • SHA256

    71050844beef6a2221e7a65df0f97646358b4aa41c12cadb85132c38d0a9effa

  • SHA512

    455a96bcc865038404875edfcdc1e80a95f1308020168cbe1ee32514e99b22a0ee06f3520dbd74ee29f7486de23c4f5d6a83a4843b614ee93c21af8de3eb827d

  • SSDEEP

    12288:WPklW7J1s66V5QHat6vjJY/QgABfmVigB:U7K3oe/rAV4

Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 17 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 15 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 32 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 24 IoCs
  • Suspicious use of SetWindowsHookEx 43 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Danger-Multitool-2.0-main.zip"
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3456
    • C:\Users\Admin\AppData\Local\Temp\7zO08D6E397\Danger Multitool 2.0.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO08D6E397\Danger Multitool 2.0.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:3004
    • C:\Users\Admin\AppData\Local\Temp\7zO08DAED97\Danger Multitool 2.0.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO08DAED97\Danger Multitool 2.0.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:1928
    • C:\Users\Admin\AppData\Local\Temp\7zO08DC9A97\Danger Multitool 2.0.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO08DC9A97\Danger Multitool 2.0.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2100
    • C:\Users\Admin\AppData\Local\Temp\7zO08D434E7\Danger Multitool 2.0.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO08D434E7\Danger Multitool 2.0.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:5060
    • C:\Users\Admin\AppData\Local\Temp\7zO08DB4FF7\Danger Multitool 2.0.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO08DB4FF7\Danger Multitool 2.0.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:4136
    • C:\Users\Admin\AppData\Local\Temp\7zO08D2C8F7\Danger Multitool 2.0.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO08D2C8F7\Danger Multitool 2.0.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:1220
    • C:\Users\Admin\AppData\Local\Temp\7zO08DAD4C7\Danger Multitool 2.0.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO08DAD4C7\Danger Multitool 2.0.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:3412
    • C:\Users\Admin\AppData\Local\Temp\7zO08D1B3C7\Danger Multitool 2.0.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO08D1B3C7\Danger Multitool 2.0.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:4952
    • C:\Users\Admin\AppData\Local\Temp\7zO08DFBEC7\Danger Multitool 2.0.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO08DFBEC7\Danger Multitool 2.0.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2780
    • C:\Users\Admin\AppData\Local\Temp\7zO08DB89C7\Danger Multitool 2.0.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO08DB89C7\Danger Multitool 2.0.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2388
    • C:\Users\Admin\AppData\Local\Temp\7zO08D735D7\Danger Multitool 2.0.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO08D735D7\Danger Multitool 2.0.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:952
    • C:\Users\Admin\AppData\Local\Temp\7zO08D42418\Danger Multitool 2.0.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO08D42418\Danger Multitool 2.0.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2592
    • C:\Users\Admin\AppData\Local\Temp\7zO08DD5218\Danger Multitool 2.0.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO08DD5218\Danger Multitool 2.0.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:3728
    • C:\Users\Admin\AppData\Local\Temp\7zO08D71B18\Danger Multitool 2.0.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO08D71B18\Danger Multitool 2.0.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:4384
    • C:\Users\Admin\AppData\Local\Temp\7zO08D4C1D8\Danger Multitool 2.0.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO08D4C1D8\Danger Multitool 2.0.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2292
    • C:\Users\Admin\AppData\Local\Temp\7zO08D75B29\Danger Multitool 2.0.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO08D75B29\Danger Multitool 2.0.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:1848
    • C:\Users\Admin\AppData\Local\Temp\7zO08D0A869\Danger Multitool 2.0.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO08D0A869\Danger Multitool 2.0.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2416
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2216
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO08D1F228\README.md
      2⤵
      • Opens file in notepad (likely ransom note)
      PID:4348
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2172
  • C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\UninstallEdit.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2052
  • C:\Windows\SysWOW64\werfault.exe
    werfault.exe /h /shared Global\892748945eb04daca028e0453b30bad1 /t 3184 /p 2052
    1⤵
      PID:2736

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\7zO08D1F228\README.md
      Filesize

      158B

      MD5

      1578b4fd6f566e5315362ae30926a4b2

      SHA1

      ec02b4a2580491e426dc4f1139f8cd8c12770840

      SHA256

      c76414b13a2981641a279b008c131649457233d7d90429c696d46bdfbad57f01

      SHA512

      611713834a549cdc3e1862d69bad6cfb7f866981b4103c98b0e56215022273580562a156213501a720134953e21b6f9f1b8795cc807394b501c019dcc7f1aebf

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\7zO08D6E397\Danger Multitool 2.0.exe
      Filesize

      733KB

      MD5

      1f491b029221bcbcc52f101effcdcd05

      SHA1

      0df19428a47dc69ff5fbf09ceb89169e8e3261e8

      SHA256

      6307526cdf7d6d87e41f57b43c2231e4a88cd65f974a72078ee247543c24241b

      SHA512

      c43c633a335361001e789cee9eed489a284b9f7f535e45ef2851d9c42dcfbcfb7ac83bac34fa9304643d93fb5edefd480c851294a720b261c98fc3c1b34de6e1

      Download Submit