| File name: | lummaps1.zip |
| Full analysis: | https://app.any.run/tasks/086e6949-e34d-4614-9f8e-03fc50f13e5d |
| Verdict: | Malicious activity |
| Threats: | HijackLoader is a modular malware acting as a vehicle for distributing different types of malicious software on compromised systems. It gained prominence during the summer of 2023 and has since been used in multiple attacks against organizations from various sectors, including hospitality businesses. |
| Analysis date: | May 15, 2025, 16:22:58 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v5.1 to extract, compression method=AES Encrypted |
| MD5: | 70ED92ED5A70E73D6DC19F1AFCD9AA18 |
| SHA1: | D370D34E450BEC59D40A5FF7E2D7448A9A326132 |
| SHA256: | 277443C934C624EB4401CD04C57EF1AAE3306DD4CC3BCC782395F2055FA3A7C7 |
| SSDEEP: | 384:LdtU/LDMrzjLL1UmLEm/CHayVi0VoVuUQOhphYO:LPU/YjLLT3yeVCOh0O |
MALICIOUS
Bypass execution policy to execute commands
- powershell.exe (PID: 5116)
Generic archive extractor
- WinRAR.exe (PID: 6872)
GENERIC has been found (auto)
- powershell.exe (PID: 5116)
HIJACKLOADER has been detected (YARA)
- AMatrix_Electro16.exe (PID: 2240)
Executing a file with an untrusted certificate
- ZoneF86.exe (PID: 856)
- XPFix.exe (PID: 6228)
SUSPICIOUS
Converts a specified value to a byte (POWERSHELL)
- powershell.exe (PID: 5116)
Process drops legitimate windows executable
- AMatrix_Electro16.exe (PID: 2240)
- powershell.exe (PID: 5116)
Extracts files to a directory (POWERSHELL)
- powershell.exe (PID: 5116)
Executable content was dropped or overwritten
- powershell.exe (PID: 5116)
- AMatrix_Electro16.exe (PID: 2240)
The process drops C-runtime libraries
- powershell.exe (PID: 5116)
- AMatrix_Electro16.exe (PID: 2240)
Gets file extension (POWERSHELL)
- powershell.exe (PID: 5116)
INFO
Script raised an exception (POWERSHELL)
- powershell.exe (PID: 5116)
Manual execution by a user
- powershell.exe (PID: 5116)
Uses string replace method (POWERSHELL)
- powershell.exe (PID: 5116)
Gets data length (POWERSHELL)
- powershell.exe (PID: 5116)
Converts byte array into ASCII string (POWERSHELL)
- powershell.exe (PID: 5116)
Creates files in the program directory
- AMatrix_Electro16.exe (PID: 2240)
Reads the computer name
- AMatrix_Electro16.exe (PID: 2240)
The sample compiled with english language support
- AMatrix_Electro16.exe (PID: 2240)
- powershell.exe (PID: 5116)
Disables trace logs
- powershell.exe (PID: 5116)
Checks if a key exists in the options dictionary (POWERSHELL)
- powershell.exe (PID: 5116)
Checks supported languages
- AMatrix_Electro16.exe (PID: 2240)
Checks whether the specified file exists (POWERSHELL)
- powershell.exe (PID: 5116)
Create files in a temporary directory
- AMatrix_Electro16.exe (PID: 2240)
Creates files or folders in the user directory
- AMatrix_Electro16.exe (PID: 2240)
The sample compiled with chinese language support
- AMatrix_Electro16.exe (PID: 2240)
Checks proxy server information
- powershell.exe (PID: 5116)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 51 |
|---|---|
| ZipBitFlag: | 0x0003 |
| ZipCompression: | Unknown (99) |
| ZipModifyDate: | 2025:05:15 16:14:06 |
| ZipCRC: | 0x8355915b |
| ZipCompressedSize: | 12777 |
| ZipUncompressedSize: | 17777 |
| ZipFileName: | 0f6998c8df794ca2e22ac859bb5b5eabb30031e3f99510aa21a6352c220616a0.ps1 |
Total processes
127
Monitored processes
7
Malicious processes
2
Suspicious processes
2
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 856 | C:\Users\admin\AppData\Local\ZoneF86.exe | C:\Users\admin\AppData\Local\ZoneF86.exe | — | AMatrix_Electro16.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221225595 Modules
| |||||||||||||||
| 2240 | "C:\Users\admin\AppData\Roaming\AMatrix_Electro16.exe" | C:\Users\admin\AppData\Roaming\AMatrix_Electro16.exe | powershell.exe | ||||||||||||
User: admin Company: CheckMAL Inc. Integrity Level: MEDIUM Description: AppCheck Anti-Ransomware Exit code: 0 Version: 3.1.39.3 Modules
| |||||||||||||||
| 2984 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5116 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass C:\Users\admin\Desktop\0f6998c8df794ca2e22ac859bb5b5eabb30031e3f99510aa21a6352c220616a0.ps1 | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5800 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6228 | "C:\Users\admin\AppData\Roaming\writerUltra\XPFix.exe" "C:\Users\admin\AppData\Roaming\writerUltra\XPFix.exe" /update | C:\Users\admin\AppData\Roaming\writerUltra\XPFix.exe | — | AMatrix_Electro16.exe | |||||||||||
User: admin Company: 360.cn Integrity Level: MEDIUM Description: 360安全卫士 安全防护中心模块 Exit code: 0 Version: 1, 0, 0, 1013 Modules
| |||||||||||||||
| 6872 | "C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\lummaps1.zip | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
Total events
11 557
Read events
11 549
Write events
8
Delete events
0
Modification events
| (PID) Process: | (6872) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\preferences.zip | |||
| (PID) Process: | (6872) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\chromium_ext.zip | |||
| (PID) Process: | (6872) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (6872) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\lummaps1.zip | |||
| (PID) Process: | (6872) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (6872) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (6872) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (6872) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
Executable files
9
Suspicious files
12
Text files
4
Unknown types
1
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5116 | powershell.exe | C:\Users\admin\AppData\Roaming\Crort.hl | binary | |
MD5:CC600AEA5A7CE4508D0E553ACF3F3CDA | SHA256:46398A8E92B09C61D7859615EE9605009715C28CDBD64435532B5211A7556583 | |||
| 5116 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache | binary | |
MD5:3F95A05381C6D14195F6A1538F5FBADE | SHA256:0E753E9AD3EDE811C17D076B462F85321B8F559C2E462AF0990A1653573A525F | |||
| 5116 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_i2vhcti2.ajl.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 5116 | powershell.exe | C:\Users\admin\AppData\Roaming\Quickhad.iwpn | abr | |
MD5:F6CF6282BDD86CCC3CD4C4009632A0DA | SHA256:02B5E970698077A5A27162474E110132C267127EEEAC1876F56FDACD1FADA878 | |||
| 2240 | AMatrix_Electro16.exe | C:\ProgramData\writerUltra\msvcp140.dll | executable | |
MD5:9FF712C25312821B8AEC84C4F8782A34 | SHA256:517CD3AAC2177A357CCA6032F07AD7360EE8CA212A02DD6E1301BF6CFADE2094 | |||
| 5116 | powershell.exe | C:\Users\admin\AppData\Roaming\msvcp140.dll | executable | |
MD5:9FF712C25312821B8AEC84C4F8782A34 | SHA256:517CD3AAC2177A357CCA6032F07AD7360EE8CA212A02DD6E1301BF6CFADE2094 | |||
| 2240 | AMatrix_Electro16.exe | C:\Users\admin\AppData\Local\Temp\F78A324.tmp | — | |
MD5:— | SHA256:— | |||
| 5116 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms | binary | |
MD5:B5B94A98E44FF969E5F03DA26513E939 | SHA256:64EEA78A2943D2D994360B39BD051F35E30A26196BA5B12C1E77C248CCD0C143 | |||
| 5116 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive | binary | |
MD5:F87C5193E4A1E27AD73EF8B1C577BF57 | SHA256:88C9D3BA2B93AE0293C585317FE58F6291BB72B3B1B2F369AFEEFAF8BA7FFEDC | |||
| 2240 | AMatrix_Electro16.exe | C:\ProgramData\writerUltra\Quickhad.iwpn | binary | |
MD5:F6CF6282BDD86CCC3CD4C4009632A0DA | SHA256:02B5E970698077A5A27162474E110132C267127EEEAC1876F56FDACD1FADA878 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
47
DNS requests
16
Threats
3
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6028 | SIHClient.exe | GET | 200 | 2.16.168.114:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6028 | SIHClient.exe | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl | unknown | — | — | whitelisted |
6028 | SIHClient.exe | GET | 200 | 2.16.168.114:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl | unknown | — | — | whitelisted |
6028 | SIHClient.exe | GET | 200 | 2.16.168.114:80 | http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl | unknown | — | — | whitelisted |
6028 | SIHClient.exe | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
6028 | SIHClient.exe | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl | unknown | — | — | whitelisted |
6028 | SIHClient.exe | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl | unknown | — | — | whitelisted |
6028 | SIHClient.exe | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3216 | svchost.exe | 172.211.123.248:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
5116 | powershell.exe | 74.112.186.157:443 | app.box.com | GOOGLE-CLOUD-PLATFORM | US | whitelisted |
5116 | powershell.exe | 74.112.186.164:443 | public.boxcloud.com | GOOGLE-CLOUD-PLATFORM | US | whitelisted |
6028 | SIHClient.exe | 20.109.210.53:443 | slscr.update.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
6028 | SIHClient.exe | 2.16.168.114:80 | crl.microsoft.com | Akamai International B.V. | RU | whitelisted |
6028 | SIHClient.exe | 23.219.150.101:80 | www.microsoft.com | AKAMAI-AS | CL | whitelisted |
6028 | SIHClient.exe | 40.69.42.241:443 | fe3cr.delivery.mp.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
app.box.com |
| whitelisted |
public.boxcloud.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
activation-v2.sls.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |
— | — | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |
— | — | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |