Analysis

  • max time kernel
    137s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/02/2024, 20:14

General

  • Target

    JangaFX EmberGen Enterprise v1.0.4 WIN/embergen_1_0_4_installer.exe

  • Size

    57.2MB

  • MD5

    43c20c7a3a57962ba3aa44b3bd00bace

  • SHA1

    7f05507330c51b165f0e6a7403b777d3e6ef4e6a

  • SHA256

    6a0d23beb7ac16c0b106fb9e2e8bf11eea02f088a905f9809390c08c4a949cf4

  • SHA512

    4835bbfb2ef32e1360bfd29baa36bce8201b4f953d36c917f7d755e5815e8a1d7890948d6ab1750208ef7206904c6061d720883315e4d14e4de8893963a5e348

  • SSDEEP

    1572864:gbvQ1s9XcrVzPPba3msz0ISQEH7HCDNE610hHSS4i4o18N:gDQdVDDIOeEbiDb1MSS47N

Score
7/10

Malware Config

Signatures

  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JangaFX EmberGen Enterprise v1.0.4 WIN\embergen_1_0_4_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\JangaFX EmberGen Enterprise v1.0.4 WIN\embergen_1_0_4_installer.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2512
    • C:\Users\Admin\AppData\Local\Temp\is-57CBI.tmp\embergen_1_0_4_installer.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-57CBI.tmp\embergen_1_0_4_installer.tmp" /SL5="$80050,59153228,832512,C:\Users\Admin\AppData\Local\Temp\JangaFX EmberGen Enterprise v1.0.4 WIN\embergen_1_0_4_installer.exe"
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:5008
      • C:\Program Files\JangaFX\EmberGen\VC_redist.x64.exe
        "C:\Program Files\JangaFX\EmberGen\VC_redist.x64.exe" /install /quiet /norestart
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4684
        • C:\Windows\Temp\{4BC4C7E2-6057-4E70-988A-FF142A91B23D}\.cr\VC_redist.x64.exe
          "C:\Windows\Temp\{4BC4C7E2-6057-4E70-988A-FF142A91B23D}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Program Files\JangaFX\EmberGen\VC_redist.x64.exe" -burn.filehandle.attached=648 -burn.filehandle.self=656 /install /quiet /norestart
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2276
      • C:\Program Files\JangaFX\EmberGen\EmberGen.exe
        "C:\Program Files\JangaFX\EmberGen\EmberGen.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2068

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\JangaFX\EmberGen\EmberGen.exe

          Filesize

          8.2MB

          MD5

          4be377c5bb118b96fba2e450e0a9267b

          SHA1

          e1851fcbb81d2aef36cdd6a5a3c07354c8dd85e5

          SHA256

          208b838755083599b358550988c841f31c6aa835d030a071b6a50cc9e463f05f

          SHA512

          42fb53dd69c1587c132adf98136b95fcd583038b753c4a46aaf309f0173d9fcd41a84bfc699e201238dbb586eaaadba16d15739a5ca1575efb13f8c383089a6f

        • C:\Program Files\JangaFX\EmberGen\EmberGen.exe

          Filesize

          256KB

          MD5

          d03ad72b685952f2a93d15009344761e

          SHA1

          129e387d997b8974f66987cd3e1d71d14c332b5d

          SHA256

          6d0a9886c8cfe12c83498a609c86acf8af0b68f0264edfe5cb8f49e4e1b91777

          SHA512

          201037b914ee9d1b56e55d58e13d83fc758620003c2aee45f618e9299ebfbe1333fcaeee0e6162ee5d5044ed7480b690eb5a8d18177aad94353da210efa506f3

        • C:\Program Files\JangaFX\EmberGen\EmberGen.exe

          Filesize

          448KB

          MD5

          6079968d9202a78a86d83fe7423f8fdf

          SHA1

          0ec307b0ef5f10b6dd2fdc23e87b808ee590fb02

          SHA256

          1ac719ec362633463f5dbf450f95b84aa34c8be7971f88825d8a1fda684d87c9

          SHA512

          6ee9a286afa69e976bd2a0bdbbc584fde8bbbd4cb450942575c44539f641fa4343de381029c56b79d8b2c4975dd143d541eafb77f0e802b2e05921d1cebb960e

        • C:\Program Files\JangaFX\EmberGen\TurboActivate.dll

          Filesize

          1.3MB

          MD5

          5bbec33f549e9e44389be11ceb3c3f02

          SHA1

          3aeb71f10f5fa8b5df59358e0c6e3b7a21a23217

          SHA256

          f53487d184b268f5ddcecff98c2f62e5141ec0030b54a65f02cc4e7057d5c7ad

          SHA512

          91df575a850276d9eb4aa19ff32b74e4947a5b5836ee874a95a793603aef3330e7b73e1cca43cfcc432558800f46749e9bb51cb9504847c98e85fdcb81bbe571

        • C:\Program Files\JangaFX\EmberGen\TurboFloat.dll

          Filesize

          1.2MB

          MD5

          e63679298cbf7273e4ac8f4bf720f68a

          SHA1

          b4ef94f680090e17b46ed1b4f1d3ebc4ee9bf7ea

          SHA256

          1475605b46351616689811a3fbcbbaae1bb40b62612986edfbae5e05df096963

          SHA512

          892e6256d4eaa1e6d31d06b33729def3eb8abfccf2b345dc717ff540a27987956a67bcbf7ad159879ee516beeb2b532676cc220c32f2f36d4cdff37ab470770f

        • C:\Program Files\JangaFX\EmberGen\VC_redist.x64.exe

          Filesize

          4.9MB

          MD5

          6b09e111b6a9c7725cd48e6485b9d823

          SHA1

          d1ffd368ef9afe60f4102826840aba1e68cabe32

          SHA256

          7c8996c90a3b310ae8d59f85be3eaf9e4c729422af5a8262f102989a5bc7313b

          SHA512

          2d8e132485a80b64f6e0dfdef6af2b1da6adadd44ee22b3b7ae348bad4232f94987e08be70d78945c922e78c089bf90344f42fec307f92c2b69377d1186607ff

        • C:\Program Files\JangaFX\EmberGen\VC_redist.x64.exe

          Filesize

          4.6MB

          MD5

          7677277c01c387582fb317f8bb7ed61b

          SHA1

          ae1e81cb079c83aeca6ea74913a71674d4d64190

          SHA256

          3c8a397865058c39c3e92afc33181c3ecc11476d6bf7ed1de540487824019b3b

          SHA512

          6224ce2492dea48105482987eb0b983e147746a8b803061e08e215f01348e2bb7f60b97650a0bb1edb26d052af632735979d2f7f6f4f8176246688fbf4fba9a1

        • C:\Users\Admin\AppData\Local\Temp\is-57CBI.tmp\embergen_1_0_4_installer.tmp

          Filesize

          3.1MB

          MD5

          33e017fa55cece71daf2f1b7a289b380

          SHA1

          8a834d925e74e9c89f93e9b46c01791e84c2d966

          SHA256

          d478c7730c76bdb3250acd7f0c7ca5895df7710c3283e2507450ee72bf15f2c7

          SHA512

          a0457630d8735e07e1ab9832ed71379ccb2630f8ff17738ca706331abf81d0832925e5f14fd555a256268dc089ff81434bbb6afe305039999ef9e0316954f05f

        • C:\Windows\Temp\{4BC4C7E2-6057-4E70-988A-FF142A91B23D}\.cr\VC_redist.x64.exe

          Filesize

          384KB

          MD5

          57cdadede3379a93633287fd16376b6c

          SHA1

          fd39252fb552d7dc0967e386eb9324e00f4b242b

          SHA256

          ac9a98826f75cfdd1fddeb4b5d7c67accb1a1cc2250fa47b664bc7abd87be9d1

          SHA512

          cb9cef89e24e7f552055aea3bbf4a41198e579bd99a61cbed0392377e044ebbde098a5a05c4453157721b3293a4fa97b89e1087961045913892c33cebe626057

        • C:\Windows\Temp\{4BC4C7E2-6057-4E70-988A-FF142A91B23D}\.cr\VC_redist.x64.exe

          Filesize

          633KB

          MD5

          7f28c88875700454d8fb733341658edd

          SHA1

          434159872b168112b86e91cf84f4d9d545ab0410

          SHA256

          92d6a54089399fab9f00f25ccf568bdc2f4838aefbf37d51bc1ac94ed41508b9

          SHA512

          7b0d332ef78506e116ad620eb34424d7ca168822f768c30fe54a55168075e88d9fb40f1c4eb02498c3379843f50ac79bcc3d42a77b82d6157bfbd3fc4bd462fb

        • C:\Windows\Temp\{5664C433-4162-4EC4-B3DB-17C21769881C}\.ba\logo.png

          Filesize

          1KB

          MD5

          d6bd210f227442b3362493d046cea233

          SHA1

          ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

          SHA256

          335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

          SHA512

          464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

        • C:\Windows\Temp\{5664C433-4162-4EC4-B3DB-17C21769881C}\.ba\wixstdba.dll

          Filesize

          191KB

          MD5

          eab9caf4277829abdf6223ec1efa0edd

          SHA1

          74862ecf349a9bedd32699f2a7a4e00b4727543d

          SHA256

          a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

          SHA512

          45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

        • memory/2068-281-0x00007FF6446A0000-0x00007FF646EF8000-memory.dmp

          Filesize

          40.3MB

        • memory/2068-276-0x00007FF6446A0000-0x00007FF646EF8000-memory.dmp

          Filesize

          40.3MB

        • memory/2512-7-0x0000000000400000-0x00000000004D8000-memory.dmp

          Filesize

          864KB

        • memory/2512-0-0x0000000000400000-0x00000000004D8000-memory.dmp

          Filesize

          864KB

        • memory/2512-279-0x0000000000400000-0x00000000004D8000-memory.dmp

          Filesize

          864KB

        • memory/5008-11-0x0000000000E50000-0x0000000000E51000-memory.dmp

          Filesize

          4KB

        • memory/5008-5-0x0000000000E50000-0x0000000000E51000-memory.dmp

          Filesize

          4KB

        • memory/5008-8-0x0000000000400000-0x000000000071C000-memory.dmp

          Filesize

          3.1MB

        • memory/5008-278-0x0000000000400000-0x000000000071C000-memory.dmp

          Filesize

          3.1MB

        • memory/5008-30-0x0000000000400000-0x000000000071C000-memory.dmp

          Filesize

          3.1MB

        • memory/5008-268-0x0000000000400000-0x000000000071C000-memory.dmp

          Filesize

          3.1MB