c99288da420eaf55840ef62076c4aa0ebdddc41100c70b900f429e439cf4387a

General

Target

2024-10-31_666248d4624eb5b840447bff7bb5932c_hijackloader_jeefo_magniber.exe
Size

1.5MB
MD5

666248d4624eb5b840447bff7bb5932c
SHA1

0d80295027db0e87ae269a68192d16c54fb6226a
SHA256

c99288da420eaf55840ef62076c4aa0ebdddc41100c70b900f429e439cf4387a
SHA512

dd2ca69a9ee7f4d9bb019404224a5faf9879b598f2abdec72950dc2a8e84ff8794997cb27c489ad61a47ac99f137865a2a3cbdec5fc30c7097f3da90ad0734ee
SSDEEP

49152:JRPGPWI+llRK7lC1oClOQZFcYD61tVeNIcTr6w0SMe:JRPTVaYNWnVRKMe

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1904	svchost.exe
1624	2024-10-31_666248d4624eb5b840447bff7bb5932c_hijackloader_jeefo_magniber.exe
1216	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
1904	svchost.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	svchost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	2024-10-31_666248d4624eb5b840447bff7bb5932c_hijackloader_jeefo_magniber.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-31_666248d4624eb5b840447bff7bb5932c_hijackloader_jeefo_magniber.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-31_666248d4624eb5b840447bff7bb5932c_hijackloader_jeefo_magniber.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1904	1640	2024-10-31_666248d4624eb5b840447bff7bb5932c_hijackloader_jeefo_magniber.exe	30
PID 1640 wrote to memory of 1904	1640	2024-10-31_666248d4624eb5b840447bff7bb5932c_hijackloader_jeefo_magniber.exe	30
PID 1640 wrote to memory of 1904	1640	2024-10-31_666248d4624eb5b840447bff7bb5932c_hijackloader_jeefo_magniber.exe	30
PID 1640 wrote to memory of 1904	1640	2024-10-31_666248d4624eb5b840447bff7bb5932c_hijackloader_jeefo_magniber.exe	30
PID 1904 wrote to memory of 1624	1904	svchost.exe	31
PID 1904 wrote to memory of 1624	1904	svchost.exe	31
PID 1904 wrote to memory of 1624	1904	svchost.exe	31
PID 1904 wrote to memory of 1624	1904	svchost.exe	31

C:\Users\Admin\AppData\Local\Temp\2024-10-31_666248d4624eb5b840447bff7bb5932c_hijackloader_jeefo_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-31_666248d4624eb5b840447bff7bb5932c_hijackloader_jeefo_magniber.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\svchost.exe
  "C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\2024-10-31_666248d4624eb5b840447bff7bb5932c_hijackloader_jeefo_magniber.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Users\Admin\AppData\Local\Temp\2024-10-31_666248d4624eb5b840447bff7bb5932c_hijackloader_jeefo_magniber.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-31_666248d4624eb5b840447bff7bb5932c_hijackloader_jeefo_magniber.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1624

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\svchost.exe

Filesize
35KB

MD5
9e3c13b6556d5636b745d3e466d47467

SHA1
2ac1c19e268c49bc508f83fe3d20f495deb3e538

SHA256
20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8

SHA512
5a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b

Download Submit
\Users\Admin\AppData\Local\Temp\2024-10-31_666248d4624eb5b840447bff7bb5932c_hijackloader_jeefo_magniber.exe

Filesize
1.5MB

MD5
5815de044c3274cc17afce0081c59d4c

SHA1
dab1d0c743ecfab7b00689277811423049b63ffc

SHA256
384d4597d503494237e30f7a54fbb88d2b23e4135c8c399ff844b1e182779024

SHA512
4a64bbdadd9a2b6746188a7ef0b3a06312eb540b67a174d9529ae455d0a7e96583abb41241f964036f36bb480b32f9e256943c025371e9c39b3b12a669c8e3d6

Download Submit
memory/1216-18-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1216-33-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1640-5-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1904-15-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing