File name:

Sample_infostealer.zip

Full analysis: https://app.any.run/tasks/504f2667-27f2-4b3b-baf7-e58b4b466f12
Verdict: Malicious activity
Threats:

HijackLoader is a modular malware acting as a vehicle for distributing different types of malicious software on compromised systems. It gained prominence during the summer of 2023 and has since been used in multiple attacks against organizations from various sectors, including hospitality businesses.

Malware Trends Tracker     >>>
Analysis date: December 20, 2023, 12:21:42
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
hijackloader
loader
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

A0E0CA0CC05C154A6DBCAA05D56BF763

SHA1:

3A759F7CD60964B64DB7ACCA34433D61D78B4F7F

SHA256:

2209F0BF5F827E134D7387076DCAC013493AAB798F8B18F61B26C90F70F1F954

SSDEEP:

98304:kV3uPQxiEP4CKgEySs7R4t+Ve6R/MftY1hcr6OhpwLfzplJuPvG9WsUXFQead/mU:Ma2C3cx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • HIJACKLOADER has been detected (YARA)

      • AppSetup.exe (PID: 864)
      • AppSetup.exe (PID: 2572)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 2036)

  • INFO

    • Checks supported languages

      • AppSetup.exe (PID: 864)
      • AppSetup.exe (PID: 2572)
      • AppSetup.exe (PID: 240)

    • Reads the computer name

      • AppSetup.exe (PID: 864)
      • AppSetup.exe (PID: 2572)
      • AppSetup.exe (PID: 240)

    • Manual execution by a user

      • AppSetup.exe (PID: 2572)
      • explorer.exe (PID: 316)
      • taskmgr.exe (PID: 1600)
      • AppSetup.exe (PID: 240)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 2036)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2023:12:14 06:33:46
ZipCRC: 0xa89dbc98
ZipCompressedSize: 422779
ZipUncompressedSize: 960832
ZipFileName: AppSetup.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
50
Monitored processes
6
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs #HIJACKLOADER appsetup.exe explorer.exe no specs #HIJACKLOADER appsetup.exe taskmgr.exe no specs appsetup.exe

Process information

PID
CMD
Path
Indicators
Parent process
240"C:\Users\admin\Desktop\AppSetup.exe" C:\Users\admin\Desktop\AppSetup.exe
explorer.exe
User:
admin
Company:
Cisco WebEx LLC
Integrity Level:
HIGH
Description:
ptInst
Exit code:
3221225477
Version:
4007,0,2005,1900
Modules
Images
c:\users\admin\desktop\appsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wininet.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
316"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
864"C:\Users\admin\AppData\Local\Temp\Rar$EXa2036.40060\AppSetup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2036.40060\AppSetup.exe
WinRAR.exe
User:
admin
Company:
Cisco WebEx LLC
Integrity Level:
MEDIUM
Description:
ptInst
Exit code:
3221225477
Version:
4007,0,2005,1900
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2036.40060\appsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wininet.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1600"C:\Windows\system32\taskmgr.exe" /4C:\Windows\System32\taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Task Manager
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2036"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Sample_infostealer.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2572"C:\Users\admin\Desktop\AppSetup.exe" C:\Users\admin\Desktop\AppSetup.exe
explorer.exe
User:
admin
Company:
Cisco WebEx LLC
Integrity Level:
MEDIUM
Description:
ptInst
Exit code:
3221225477
Version:
4007,0,2005,1900
Modules
Images
c:\users\admin\desktop\appsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wininet.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
Total events
1 237
Read events
1 211
Write events
26
Delete events
0

Modification events

(PID) Process:(2036) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(2036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
28
Suspicious files
4
Text files
16
Unknown types
0

Dropped files

PID
Process
Filename
Type
2036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2036.40060\AppSetup.exeexecutable
MD5:B15BAC961F62448C872E1DC6D3931016
SHA256:BF1A0C67B433F52EBD304553F022BAA34BFBCA258C932D2B4B8B956B1467BFA5
2036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2036.40060\Settings\Libs\SharpVectors.Model.dllexecutable
MD5:F03710878B14CF133BBFF7D6C0538F6A
SHA256:351BD575C366600C3EBBAC47847C9A16408955D84B57B7BB1D39C7E6D8786585
2036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2036.40060\Settings\Libs\SharpVectors.Css.dllexecutable
MD5:54049DD45805BD2D1BF07A035C6B5C95
SHA256:AB07BBB6C4718615DD7A67AE67976E1CFE97C257D93FD2286234F6785E726F0A
2036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2036.40060\Settings\Libs\SharpVectors.Converters.Wpf.dllexecutable
MD5:58C8888A75C72A8FBE6728B0D3385181
SHA256:CC26FD5B60A066C236F23768E0612EEBC2E664DD2ABF81413C62027A75A07F94
2036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2036.40060\Settings\Libs\SharpVectors.Dom.dllexecutable
MD5:E125D7EF892C3B01A47280A9E9FF7B1B
SHA256:4B85224A1183DBC22DB0EC004835E7284E1BACF7B88CF556F426B0F4CD543FE1
2036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2036.40060\Settings\Libs\SharpVectors.Core.dllexecutable
MD5:F55EA929028235BC4B26E87CF60C5A6A
SHA256:341F99A0EF2388BCB10FDCB1B305270A2332072F4C1EA25124BDE91EE699FE2D
2036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2036.40060\Settings\HandyControls.txttext
MD5:41C8910CAE4DC901922E58B618BF5968
SHA256:BA52B3124ECA4E9E9ABCBE8E4F6BB9DA75B0647AC8D135292716AAEF5CF0C6A3
2036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2036.40060\Settings\Libs\SharpVectors.Rendering.Wpf.dllexecutable
MD5:D2D3DE3AA205B45CC77EA6E5CB8C8D07
SHA256:4841856D55B9244D000B53AED72D8E1AD1EC5064C85AE628953012193E413411
2036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2036.40060\Settings\Drop Icons.txttext
MD5:F603CED25A3360C092855E507579AC7C
SHA256:795782CD1C06683E88B59DF9FEA91794E1F47DAE568AC84267B6C5699D8387E1
2036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2036.40060\Settings\FolderBrowserEx.txttext
MD5:E69719C20DFAEDF395EE3DE052DD0EED
SHA256:231CF882B16477966B27D02E6B1BEC69744B75F92609EA4620DCB3459546FB40
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
3
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Sample_infostealer.zip