Analysis
-
max time kernel
118s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
22/02/2024, 20:14
General
-
Target
JangaFX EmberGen Enterprise v1.0.4 WIN/embergen_1_0_4_installer.exe
-
Size
57.2MB
-
MD5
43c20c7a3a57962ba3aa44b3bd00bace
-
SHA1
7f05507330c51b165f0e6a7403b777d3e6ef4e6a
-
SHA256
6a0d23beb7ac16c0b106fb9e2e8bf11eea02f088a905f9809390c08c4a949cf4
-
SHA512
4835bbfb2ef32e1360bfd29baa36bce8201b4f953d36c917f7d755e5815e8a1d7890948d6ab1750208ef7206904c6061d720883315e4d14e4de8893963a5e348
-
SSDEEP
1572864:gbvQ1s9XcrVzPPba3msz0ISQEH7HCDNE610hHSS4i4o18N:gDQdVDDIOeEbiDb1MSS47N
Malware Config
Signatures
-
UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 11 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 25 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JangaFX EmberGen Enterprise v1.0.4 WIN\embergen_1_0_4_installer.exe"C:\Users\Admin\AppData\Local\Temp\JangaFX EmberGen Enterprise v1.0.4 WIN\embergen_1_0_4_installer.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-TJIBP.tmp\embergen_1_0_4_installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-TJIBP.tmp\embergen_1_0_4_installer.tmp" /SL5="$7011E,59153228,832512,C:\Users\Admin\AppData\Local\Temp\JangaFX EmberGen Enterprise v1.0.4 WIN\embergen_1_0_4_installer.exe"2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\JangaFX\EmberGen\VC_redist.x64.exe"C:\Program Files\JangaFX\EmberGen\VC_redist.x64.exe" /install /quiet /norestart3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{7FF0C0B6-4A62-4840-A1AA-C6EFE302821F}\.cr\VC_redist.x64.exe"C:\Windows\Temp\{7FF0C0B6-4A62-4840-A1AA-C6EFE302821F}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Program Files\JangaFX\EmberGen\VC_redist.x64.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188 /install /quiet /norestart4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Program Files\JangaFX\EmberGen\EmberGen.exe"C:\Program Files\JangaFX\EmberGen\EmberGen.exe"3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD58aab5209f0b8895d4974154ffeaaed01
SHA1b3527d66ae9c297d7b7721ea7ccd5bd1eee7c5dc
SHA256bf70c276dafbeb713b398f821fe7b4fa926f5b8b00189b5b800b2161cfea6de8
SHA5128db5a71bd351b04c178e0ebe4fbfff2c3a9ae1412d831d52c6d354beb33d50d26775359919fa2e7fe9e8e3a31c4690db819d8f2cb50a6bfef80f35d4a23d853e
-
Filesize
465KB
MD5d6431d4866ab024bc77f64ff90dadd4e
SHA1a6d1c2efb2e1eb961a91823c3666820f5d1a03e2
SHA256c50527a3b78bb0f8b301620ca56136c13bf8e18273b5d39ad39f9928fb3d25b3
SHA512fd56b9d68cac0366d27c9e4afce82ef3dee96cac788016237ea161cf21473d5d557ec151bbe9335236f868a5b7d2f7d3b32ad5474a42f4b16998359359b0e2a5
-
Filesize
192KB
MD5c7d539168461f651c9f8c7d209a0bcfe
SHA18a844815224e92e710eebe4c9b73bdb80db00537
SHA256b809d93d76752b80a68dea9dbef12d0c79e1e8d6f4dd793a84c3e9832699af6e
SHA512adbc9511419afe85c09be83f45e3b71655c1c6724e22009c054fc3726892d6d241930f982453af68106d5483fe5dee870e757b9a805803e25c08a568c86be174
-
Filesize
390KB
MD59a5a0f7057b8d04dcc28031fefd6f63c
SHA1aa8ad9963563ea66fc07c85be3442cb85967b653
SHA2567e58bdf3960344186719e6265e5e514f2afb5e8214bbe9a569094dba40fd7129
SHA5121f36544d442fc851e6e56fe8cb3cadff84ac4e2ffbc570fec6a5885b726ab849251c659c94de188ca27a0d1b57846f8d25e09326933a45572f6175d19b289d93
-
Filesize
3.1MB
MD533e017fa55cece71daf2f1b7a289b380
SHA18a834d925e74e9c89f93e9b46c01791e84c2d966
SHA256d478c7730c76bdb3250acd7f0c7ca5895df7710c3283e2507450ee72bf15f2c7
SHA512a0457630d8735e07e1ab9832ed71379ccb2630f8ff17738ca706331abf81d0832925e5f14fd555a256268dc089ff81434bbb6afe305039999ef9e0316954f05f
-
Filesize
1.4MB
MD5f73c3a9fbb5f10df460cacff2e11b4f1
SHA103c01b8971c6d5f886f53a7c9b6af6e035b9871a
SHA256547d52b0d414086ecc1912fa3d38f42e2d151b87c717790ed76bc0bb75d5c53b
SHA512eba7ec1f560a71ee2f140190b2e3728459aeef772831938beac69a553da3ed3a13b05746168814484d153fac30c76ed55a4ef36e3f6d7145ebdbdc191a4b9c30
-
Filesize
633KB
MD57f28c88875700454d8fb733341658edd
SHA1434159872b168112b86e91cf84f4d9d545ab0410
SHA25692d6a54089399fab9f00f25ccf568bdc2f4838aefbf37d51bc1ac94ed41508b9
SHA5127b0d332ef78506e116ad620eb34424d7ca168822f768c30fe54a55168075e88d9fb40f1c4eb02498c3379843f50ac79bcc3d42a77b82d6157bfbd3fc4bd462fb
-
Filesize
1KB
MD5d6bd210f227442b3362493d046cea233
SHA1ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA256335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
SHA512464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
-
Filesize
3.7MB
MD59f683e295245599ec2bb60b35705f072
SHA17be9e624c06b4fd48c50b6bacd82a391861d6304
SHA256419ac9fc8a034176f195f6f951317985061cb8948ce5410d88485334faf828a2
SHA512d1dfffa54c264dc3e835f85c6c4e4f66e05c5804781e026b974ff409e38e44f51a894fd58ba0be76a711cd3933bc3bf6cb58f849886c4836b8c201f16d89d8ab
-
Filesize
1.8MB
MD5486dad4f2582da48e00fbdc398ba4b50
SHA1eadecfac6d4b44c733d034ff11463144253778bc
SHA256c9ce03d7368d3cee0166d76dc74ccbcc718abdb45f9cc8012bdd03407e9e4ab0
SHA512061aafc4cc7964627d5f9127ea1de80fb47b130fc308e4954d16b9edc3345f94898e3a548381564d328869c8e16f2e7cab140842c7a2c618f74a560085687742
-
Filesize
1.0MB
MD5234db0eb9fdfa5e15fd452e84db6bd5a
SHA10530bc767b5fdda976ca75a6a87bc9f499d96a5a
SHA2562bf81c76f860f363cb67f9a8a2b870f48d13f371d1175efb34f1087d2af82c81
SHA512a746577fd4e38e1b1c51b276706be7e34584804bf39f28d7f9b74c8ea761479e6133d1f955af31340de2c015b83f27b9c4e530161b40624ccbb2cca25eae512c
-
Filesize
963KB
MD57dfe13f890ad379ad6c1fb4fe9cb4cd2
SHA15f9ecb6f8dceea2f91393550bb8268882af9243a
SHA256b2ecde534a0d0e98b5529517bf3d3e1401e8a9ba77f8e3652fa82df029101891
SHA5125c9ee1ffe66b2306f28dad0815a74d7b337c62fc805642f3659a13f73a1c8c39fbd230aa4c0bd2bebbd05c6431bfe29260b8712f9662a7805eb13133761db758
-
Filesize
820KB
MD5212b9700489d96c85d785e92a52fcaf9
SHA14eeecb162e388544323f07918c7b340bea25f6ec
SHA256ce8abeafe05caf8f4f488b96925623272b72727a40ce6bda3adeb8f26d688c90
SHA5127784125f516af6cc39378e76d9ba5914cd08e12b61d1a1b88facfa9c1b20b45e6877ef19902cc3e051129b2fab7d8b2571a726e60a649828dbb74704041a402e
-
Filesize
896KB
MD599befd2748f51754fd5368380831bb9a
SHA19c2316e7cfdf7c9f04a57b5b5227f80615e22070
SHA256f8e80d663884091286e8e8a15ce9eac669f3e8d9342ba917440de5dcd81b53f2
SHA5122690f6326c0817373d7c03b13f61a658a9ea8ba66ca9e83325dd0d1d65a4a5d0a3aadbff96810ec3ab36476746e70cef197cc05cb67de867b843004d12421ec5
-
Filesize
725KB
MD5a5206b08742b30e9ab863a294b7db896
SHA16cb71c762f2999bc57be6da0e82151d6abbf6f57
SHA256eeb5f2f34a04f983784e166a96b1633860fef881bc84c3972106651644f91b8f
SHA512b35d41578e2257c35cd74ea863d478af2cc752cb7aa5d263dcfb743a2998f218b4b73912430230fe0226d64f6f47808e59d8db0ad4b4b8c24bcd07712a3f6353
-
Filesize
759KB
MD57d9f6fb0d7a6657860e5ed65ffb274f9
SHA1be6e054237ca3c1918ce22e6b20eb85911eac99a
SHA25680598fedd43f498cba4672d3997baa106d9d8a5c1aafad521a81727bfac56248
SHA51285ace8c57d229a805165e85520787d1459c10d13db0dd57e34b5086aaae2bd0d6514dd23295c604d71b786872e0bd8a8750c95f464892936098fc86d8d600e12
-
Filesize
1.6MB
MD58c313af172b21e782d42119c3237f760
SHA1c772b4b78044541ae376220a294d2908a0e8138e
SHA25617892bdc10e7a6522db44c7c54909d8bd5710253c5c35f90570f97423967edf8
SHA512021f90fb8c676fdf3b3e91b1a144d5084ae0a5cdd1659e6b3b1c5922e005410c0d42ec458c6bd9a2443ef2f939dc4568406c60a01a8a6d8696382bd4bd0bfc5e
-
Filesize
191KB
MD5eab9caf4277829abdf6223ec1efa0edd
SHA174862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA51245b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
-
Filesize
3.1MB
-
Filesize
40.3MB
-
Filesize
64KB
-
Filesize
40.3MB
-
Filesize
4KB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
3.1MB
-
Filesize
40.3MB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
864KB
