Analysis

  • max time kernel
    118s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    22/02/2024, 20:14

General

  • Target

    JangaFX EmberGen Enterprise v1.0.4 WIN/embergen_1_0_4_installer.exe

  • Size

    57.2MB

  • MD5

    43c20c7a3a57962ba3aa44b3bd00bace

  • SHA1

    7f05507330c51b165f0e6a7403b777d3e6ef4e6a

  • SHA256

    6a0d23beb7ac16c0b106fb9e2e8bf11eea02f088a905f9809390c08c4a949cf4

  • SHA512

    4835bbfb2ef32e1360bfd29baa36bce8201b4f953d36c917f7d755e5815e8a1d7890948d6ab1750208ef7206904c6061d720883315e4d14e4de8893963a5e348

  • SSDEEP

    1572864:gbvQ1s9XcrVzPPba3msz0ISQEH7HCDNE610hHSS4i4o18N:gDQdVDDIOeEbiDb1MSS47N

Score
7/10

Malware Config

Signatures

  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JangaFX EmberGen Enterprise v1.0.4 WIN\embergen_1_0_4_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\JangaFX EmberGen Enterprise v1.0.4 WIN\embergen_1_0_4_installer.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:3048
    • C:\Users\Admin\AppData\Local\Temp\is-TJIBP.tmp\embergen_1_0_4_installer.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-TJIBP.tmp\embergen_1_0_4_installer.tmp" /SL5="$7011E,59153228,832512,C:\Users\Admin\AppData\Local\Temp\JangaFX EmberGen Enterprise v1.0.4 WIN\embergen_1_0_4_installer.exe"
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2116
      • C:\Program Files\JangaFX\EmberGen\VC_redist.x64.exe
        "C:\Program Files\JangaFX\EmberGen\VC_redist.x64.exe" /install /quiet /norestart
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2888
        • C:\Windows\Temp\{7FF0C0B6-4A62-4840-A1AA-C6EFE302821F}\.cr\VC_redist.x64.exe
          "C:\Windows\Temp\{7FF0C0B6-4A62-4840-A1AA-C6EFE302821F}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Program Files\JangaFX\EmberGen\VC_redist.x64.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188 /install /quiet /norestart
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1988
      • C:\Program Files\JangaFX\EmberGen\EmberGen.exe
        "C:\Program Files\JangaFX\EmberGen\EmberGen.exe"
        3⤵
        • Executes dropped EXE
        PID:2184

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\JangaFX\EmberGen\EmberGen.exe

          Filesize

          1.4MB

          MD5

          8aab5209f0b8895d4974154ffeaaed01

          SHA1

          b3527d66ae9c297d7b7721ea7ccd5bd1eee7c5dc

          SHA256

          bf70c276dafbeb713b398f821fe7b4fa926f5b8b00189b5b800b2161cfea6de8

          SHA512

          8db5a71bd351b04c178e0ebe4fbfff2c3a9ae1412d831d52c6d354beb33d50d26775359919fa2e7fe9e8e3a31c4690db819d8f2cb50a6bfef80f35d4a23d853e

        • C:\Program Files\JangaFX\EmberGen\EmberGen.exe

          Filesize

          465KB

          MD5

          d6431d4866ab024bc77f64ff90dadd4e

          SHA1

          a6d1c2efb2e1eb961a91823c3666820f5d1a03e2

          SHA256

          c50527a3b78bb0f8b301620ca56136c13bf8e18273b5d39ad39f9928fb3d25b3

          SHA512

          fd56b9d68cac0366d27c9e4afce82ef3dee96cac788016237ea161cf21473d5d557ec151bbe9335236f868a5b7d2f7d3b32ad5474a42f4b16998359359b0e2a5

        • C:\Program Files\JangaFX\EmberGen\VC_redist.x64.exe

          Filesize

          192KB

          MD5

          c7d539168461f651c9f8c7d209a0bcfe

          SHA1

          8a844815224e92e710eebe4c9b73bdb80db00537

          SHA256

          b809d93d76752b80a68dea9dbef12d0c79e1e8d6f4dd793a84c3e9832699af6e

          SHA512

          adbc9511419afe85c09be83f45e3b71655c1c6724e22009c054fc3726892d6d241930f982453af68106d5483fe5dee870e757b9a805803e25c08a568c86be174

        • C:\Program Files\JangaFX\EmberGen\VC_redist.x64.exe

          Filesize

          390KB

          MD5

          9a5a0f7057b8d04dcc28031fefd6f63c

          SHA1

          aa8ad9963563ea66fc07c85be3442cb85967b653

          SHA256

          7e58bdf3960344186719e6265e5e514f2afb5e8214bbe9a569094dba40fd7129

          SHA512

          1f36544d442fc851e6e56fe8cb3cadff84ac4e2ffbc570fec6a5885b726ab849251c659c94de188ca27a0d1b57846f8d25e09326933a45572f6175d19b289d93

        • C:\Users\Admin\AppData\Local\Temp\is-TJIBP.tmp\embergen_1_0_4_installer.tmp

          Filesize

          3.1MB

          MD5

          33e017fa55cece71daf2f1b7a289b380

          SHA1

          8a834d925e74e9c89f93e9b46c01791e84c2d966

          SHA256

          d478c7730c76bdb3250acd7f0c7ca5895df7710c3283e2507450ee72bf15f2c7

          SHA512

          a0457630d8735e07e1ab9832ed71379ccb2630f8ff17738ca706331abf81d0832925e5f14fd555a256268dc089ff81434bbb6afe305039999ef9e0316954f05f

        • C:\Users\Admin\AppData\Local\Temp\is-TJIBP.tmp\embergen_1_0_4_installer.tmp

          Filesize

          1.4MB

          MD5

          f73c3a9fbb5f10df460cacff2e11b4f1

          SHA1

          03c01b8971c6d5f886f53a7c9b6af6e035b9871a

          SHA256

          547d52b0d414086ecc1912fa3d38f42e2d151b87c717790ed76bc0bb75d5c53b

          SHA512

          eba7ec1f560a71ee2f140190b2e3728459aeef772831938beac69a553da3ed3a13b05746168814484d153fac30c76ed55a4ef36e3f6d7145ebdbdc191a4b9c30

        • C:\Windows\Temp\{7FF0C0B6-4A62-4840-A1AA-C6EFE302821F}\.cr\VC_redist.x64.exe

          Filesize

          633KB

          MD5

          7f28c88875700454d8fb733341658edd

          SHA1

          434159872b168112b86e91cf84f4d9d545ab0410

          SHA256

          92d6a54089399fab9f00f25ccf568bdc2f4838aefbf37d51bc1ac94ed41508b9

          SHA512

          7b0d332ef78506e116ad620eb34424d7ca168822f768c30fe54a55168075e88d9fb40f1c4eb02498c3379843f50ac79bcc3d42a77b82d6157bfbd3fc4bd462fb

        • C:\Windows\Temp\{EC9BF963-8A3C-488A-99B5-7ED10E53517D}\.ba\logo.png

          Filesize

          1KB

          MD5

          d6bd210f227442b3362493d046cea233

          SHA1

          ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

          SHA256

          335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

          SHA512

          464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

        • \Program Files\JangaFX\EmberGen\EmberGen.exe

          Filesize

          3.7MB

          MD5

          9f683e295245599ec2bb60b35705f072

          SHA1

          7be9e624c06b4fd48c50b6bacd82a391861d6304

          SHA256

          419ac9fc8a034176f195f6f951317985061cb8948ce5410d88485334faf828a2

          SHA512

          d1dfffa54c264dc3e835f85c6c4e4f66e05c5804781e026b974ff409e38e44f51a894fd58ba0be76a711cd3933bc3bf6cb58f849886c4836b8c201f16d89d8ab

        • \Program Files\JangaFX\EmberGen\EmberGen.exe

          Filesize

          1.8MB

          MD5

          486dad4f2582da48e00fbdc398ba4b50

          SHA1

          eadecfac6d4b44c733d034ff11463144253778bc

          SHA256

          c9ce03d7368d3cee0166d76dc74ccbcc718abdb45f9cc8012bdd03407e9e4ab0

          SHA512

          061aafc4cc7964627d5f9127ea1de80fb47b130fc308e4954d16b9edc3345f94898e3a548381564d328869c8e16f2e7cab140842c7a2c618f74a560085687742

        • \Program Files\JangaFX\EmberGen\EmberGen.exe

          Filesize

          1.0MB

          MD5

          234db0eb9fdfa5e15fd452e84db6bd5a

          SHA1

          0530bc767b5fdda976ca75a6a87bc9f499d96a5a

          SHA256

          2bf81c76f860f363cb67f9a8a2b870f48d13f371d1175efb34f1087d2af82c81

          SHA512

          a746577fd4e38e1b1c51b276706be7e34584804bf39f28d7f9b74c8ea761479e6133d1f955af31340de2c015b83f27b9c4e530161b40624ccbb2cca25eae512c

        • \Program Files\JangaFX\EmberGen\EmberGen.exe

          Filesize

          963KB

          MD5

          7dfe13f890ad379ad6c1fb4fe9cb4cd2

          SHA1

          5f9ecb6f8dceea2f91393550bb8268882af9243a

          SHA256

          b2ecde534a0d0e98b5529517bf3d3e1401e8a9ba77f8e3652fa82df029101891

          SHA512

          5c9ee1ffe66b2306f28dad0815a74d7b337c62fc805642f3659a13f73a1c8c39fbd230aa4c0bd2bebbd05c6431bfe29260b8712f9662a7805eb13133761db758

        • \Program Files\JangaFX\EmberGen\EmberGen.exe

          Filesize

          820KB

          MD5

          212b9700489d96c85d785e92a52fcaf9

          SHA1

          4eeecb162e388544323f07918c7b340bea25f6ec

          SHA256

          ce8abeafe05caf8f4f488b96925623272b72727a40ce6bda3adeb8f26d688c90

          SHA512

          7784125f516af6cc39378e76d9ba5914cd08e12b61d1a1b88facfa9c1b20b45e6877ef19902cc3e051129b2fab7d8b2571a726e60a649828dbb74704041a402e

        • \Program Files\JangaFX\EmberGen\EmberGen.exe

          Filesize

          896KB

          MD5

          99befd2748f51754fd5368380831bb9a

          SHA1

          9c2316e7cfdf7c9f04a57b5b5227f80615e22070

          SHA256

          f8e80d663884091286e8e8a15ce9eac669f3e8d9342ba917440de5dcd81b53f2

          SHA512

          2690f6326c0817373d7c03b13f61a658a9ea8ba66ca9e83325dd0d1d65a4a5d0a3aadbff96810ec3ab36476746e70cef197cc05cb67de867b843004d12421ec5

        • \Program Files\JangaFX\EmberGen\EmberGen.exe

          Filesize

          725KB

          MD5

          a5206b08742b30e9ab863a294b7db896

          SHA1

          6cb71c762f2999bc57be6da0e82151d6abbf6f57

          SHA256

          eeb5f2f34a04f983784e166a96b1633860fef881bc84c3972106651644f91b8f

          SHA512

          b35d41578e2257c35cd74ea863d478af2cc752cb7aa5d263dcfb743a2998f218b4b73912430230fe0226d64f6f47808e59d8db0ad4b4b8c24bcd07712a3f6353

        • \Program Files\JangaFX\EmberGen\VC_redist.x64.exe

          Filesize

          759KB

          MD5

          7d9f6fb0d7a6657860e5ed65ffb274f9

          SHA1

          be6e054237ca3c1918ce22e6b20eb85911eac99a

          SHA256

          80598fedd43f498cba4672d3997baa106d9d8a5c1aafad521a81727bfac56248

          SHA512

          85ace8c57d229a805165e85520787d1459c10d13db0dd57e34b5086aaae2bd0d6514dd23295c604d71b786872e0bd8a8750c95f464892936098fc86d8d600e12

        • \Users\Admin\AppData\Local\Temp\is-TJIBP.tmp\embergen_1_0_4_installer.tmp

          Filesize

          1.6MB

          MD5

          8c313af172b21e782d42119c3237f760

          SHA1

          c772b4b78044541ae376220a294d2908a0e8138e

          SHA256

          17892bdc10e7a6522db44c7c54909d8bd5710253c5c35f90570f97423967edf8

          SHA512

          021f90fb8c676fdf3b3e91b1a144d5084ae0a5cdd1659e6b3b1c5922e005410c0d42ec458c6bd9a2443ef2f939dc4568406c60a01a8a6d8696382bd4bd0bfc5e

        • \Windows\Temp\{EC9BF963-8A3C-488A-99B5-7ED10E53517D}\.ba\wixstdba.dll

          Filesize

          191KB

          MD5

          eab9caf4277829abdf6223ec1efa0edd

          SHA1

          74862ecf349a9bedd32699f2a7a4e00b4727543d

          SHA256

          a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

          SHA512

          45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

        • memory/2116-43-0x0000000000400000-0x000000000071C000-memory.dmp

          Filesize

          3.1MB

        • memory/2116-286-0x0000000004290000-0x0000000006AE8000-memory.dmp

          Filesize

          40.3MB

        • memory/2116-177-0x00000000036F0000-0x0000000003700000-memory.dmp

          Filesize

          64KB

        • memory/2116-289-0x0000000004290000-0x0000000006AE8000-memory.dmp

          Filesize

          40.3MB

        • memory/2116-14-0x0000000000240000-0x0000000000241000-memory.dmp

          Filesize

          4KB

        • memory/2116-11-0x0000000000400000-0x000000000071C000-memory.dmp

          Filesize

          3.1MB

        • memory/2116-277-0x0000000000400000-0x000000000071C000-memory.dmp

          Filesize

          3.1MB

        • memory/2116-182-0x00000000036F0000-0x0000000003700000-memory.dmp

          Filesize

          64KB

        • memory/2116-8-0x0000000000240000-0x0000000000241000-memory.dmp

          Filesize

          4KB

        • memory/2116-284-0x0000000000400000-0x000000000071C000-memory.dmp

          Filesize

          3.1MB

        • memory/2184-287-0x000000013F9D0000-0x0000000142228000-memory.dmp

          Filesize

          40.3MB

        • memory/3048-10-0x0000000000400000-0x00000000004D8000-memory.dmp

          Filesize

          864KB

        • memory/3048-285-0x0000000000400000-0x00000000004D8000-memory.dmp

          Filesize

          864KB

        • memory/3048-1-0x0000000000400000-0x00000000004D8000-memory.dmp

          Filesize

          864KB