File name:

#ⱾS$et-U!ῥ-P͜aS$$_2324__☆!_FU!!LL.zip

Full analysis: https://app.any.run/tasks/9f15d6db-b9a9-4356-8cf9-56bab8492a5a
Verdict: Malicious activity
Threats:

HijackLoader is a modular malware acting as a vehicle for distributing different types of malicious software on compromised systems. It gained prominence during the summer of 2023 and has since been used in multiple attacks against organizations from various sectors, including hospitality businesses.

Malware Trends Tracker     >>>
Analysis date: October 11, 2024, 22:31:54
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
hijackloader
loader
lumma
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract, compression method=store
MD5:

68AF1FF3852E17BED27508637C7A69C3

SHA1:

E961A5ECEE089E0A304B0E12AF514474B4CB653E

SHA256:

66ACC7FF6E1B88EEBA7CE5762813BC05B9B38466BE964C48E57CED22B5159B47

SSDEEP:

98304:9Wc3gWonIKjHQFN5XJcvUlO20ZJXIMj9uw2w1LH8XQvrz1ROU7FemVgON0e5Cby7:TFBIatFsnAg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 6708)

    • LUMMA has been detected (YARA)

      • SearchIndexer.exe (PID: 6396)

    • HIJACKLOADER has been detected (YARA)

      • more.com (PID: 6712)

    • Changes powershell execution policy (Bypass)

      • SearchIndexer.exe (PID: 6396)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 3532)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 2928)
      • Setup.exe (PID: 6300)

    • Starts application with an unusual extension

      • Setup.exe (PID: 6300)

    • The process drops C-runtime libraries

      • Setup.exe (PID: 6300)

    • Executable content was dropped or overwritten

      • Setup.exe (PID: 6300)

    • Starts POWERSHELL.EXE for commands execution

      • SearchIndexer.exe (PID: 6396)

    • The process executes Powershell scripts

      • SearchIndexer.exe (PID: 6396)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2928)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 2928)

    • Manual execution by a user

      • WinRAR.exe (PID: 2928)
      • Setup.exe (PID: 6300)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: 0x0800
ZipCompression: None
ZipModifyDate: 2024:10:09 00:28:28
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: #ⱾS$et-U!ῥ-P͜aS$$_2324__☆!_FU!!LL/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
10
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe rundll32.exe no specs setup.exe strcmp.exe no specs #HIJACKLOADER more.com no specs conhost.exe no specs #LUMMA searchindexer.exe powershell.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1196C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
2928"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\#ⱾS$et-U!ῥ-P͜aS$$_2324__☆!_FU!!LL.zip" "?\"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3532powershell -exec bypass -f "C:\Users\admin\AppData\Local\Temp\B6HX7K310HBH4D8BP.ps1"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—SearchIndexer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
5592\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5920\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—more.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6300"C:\Users\admin\Desktop\#ⱾS$et-U!ῥ-P͜aS$$_2324__☆!_FU!!LL\#ⱾS$et-U!ῥ-P͜aS$$_2324__☆!_FU!!LL\Setup.exe" C:\Users\admin\Desktop\#ⱾS$et-U!ῥ-P͜aS$$_2324__☆!_FU!!LL\#ⱾS$et-U!ῥ-P͜aS$$_2324__☆!_FU!!LL\Setup.exe
explorer.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
HIGH
Description:
VirtualBox Interface
Exit code:
1
Version:
4.2.18.88780
Modules
Images
c:\users\admin\desktop\#ȿs$et-u!ῥ-p͜as$$_2324__☆!_fu!!ll\#ȿs$et-u!ῥ-p͜as$$_2324__☆!_fu!!ll\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\psapi.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
6396C:\WINDOWS\SysWOW64\SearchIndexer.exeC:\Windows\SysWOW64\SearchIndexer.exe
more.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Windows Search Indexer
Exit code:
0
Version:
7.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\wsffghncaqnum
c:\windows\syswow64\searchindexer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
6572C:\ProgramData\uepl\IDUMCIVECOSHAYKNRLFME\StrCmp.exeC:\ProgramData\uepl\IDUMCIVECOSHAYKNRLFME\StrCmp.exe—Setup.exe
User:
admin
Company:
aaa
Integrity Level:
HIGH
Exit code:
0
Version:
1.00
Modules
Images
c:\programdata\uepl\idumcivecoshayknrlfme\strcmp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
6708"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\#ⱾS$et-U!ῥ-P͜aS$_2324__☆!_FU!!LL.zipC:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
1
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
6712C:\WINDOWS\SysWOW64\more.comC:\Windows\SysWOW64\more.com
Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
More Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\more.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
10 754
Read events
10 721
Write events
19
Delete events
14

Modification events

(PID) Process:(6708) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6708) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6708) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6708) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6708) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General\Toolbar\Layout
Operation:writeName:Band76_0
Value:
4C000000730100000402000000000000F0F0F00000000000000000000000000000000000000000004202040000000000000000003B000000B402000000000000000000000000000001000000
(PID) Process:(6708) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General\Toolbar\Layout
Operation:writeName:Band76_1
Value:
4C000000730100000500000000000000F0F0F0000000000000000000000000000000000000000000E40204000000000000000000180000002A00000000000000000000000000000002000000
(PID) Process:(6708) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General\Toolbar\Layout
Operation:writeName:Band76_2
Value:
4C000000730100000400000000000000F0F0F0000000000000000000000000000000000000000000F20207000000000000000000180000006400000000000000000000000000000003000000
(PID) Process:(2928) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
(PID) Process:(2928) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:14
Value:
(PID) Process:(2928) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:13
Value:
Executable files
10
Suspicious files
6
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
6712more.comC:\Users\admin\AppData\Local\Temp\wsffghncaqnum —
MD5:—
SHA256:—
2928WinRAR.exeC:\Users\admin\Desktop\#ⱾS$et-U!ῥ-P͜aS$$_2324__☆!_FU!!LL\#ⱾS$et-U!ῥ-P͜aS$$_2324__☆!_FU!!LL\hidboybinary
MD5:FDE218EEBED4F70105540A3B2B42AAC5
SHA256:B60D53A6E2FFAB09CBBBDF2014458FF854B3852D667ED5B711DBBBB997B3C019
2928WinRAR.exeC:\Users\admin\Desktop\#ⱾS$et-U!ῥ-P͜aS$$_2324__☆!_FU!!LL\#ⱾS$et-U!ῥ-P͜aS$$_2324__☆!_FU!!LL\msvcp100.dllexecutable
MD5:D029339C0F59CF662094EDDF8C42B2B5
SHA256:934D882EFD3C0F3F1EFBC238EF87708F3879F5BB456D30AF62F3368D58B6AA4C
2928WinRAR.exeC:\Users\admin\Desktop\#ⱾS$et-U!ῥ-P͜aS$$_2324__☆!_FU!!LL\#ⱾS$et-U!ῥ-P͜aS$$_2324__☆!_FU!!LL\Setup.exeexecutable
MD5:C8A2DE7077F97D4BCE1A44317B49EF41
SHA256:448402C129A721812FA1C5F279F5CA906B9C8BBCA652A91655D144D20CE5E6B4
2928WinRAR.exeC:\Users\admin\Desktop\#ⱾS$et-U!ῥ-P͜aS$$_2324__☆!_FU!!LL\#ⱾS$et-U!ῥ-P͜aS$$_2324__☆!_FU!!LL\msvcr100.dllexecutable
MD5:366FD6F3A451351B5DF2D7C4ECF4C73A
SHA256:AE3CB6C6AFBA9A4AA5C85F66023C35338CA579B30326DD02918F9D55259503D5
2928WinRAR.exeC:\Users\admin\Desktop\#ⱾS$et-U!ῥ-P͜aS$$_2324__☆!_FU!!LL\#ⱾS$et-U!ῥ-P͜aS$$_2324__☆!_FU!!LL\fkiibinary
MD5:ED4F8F21A73EF78B8021F615A24DE244
SHA256:D3F20044186292867E7502C915A4E2C26E97CEEB705082ED67C9888B89304DBD
6300Setup.exeC:\ProgramData\uepl\fkiibinary
MD5:ED4F8F21A73EF78B8021F615A24DE244
SHA256:D3F20044186292867E7502C915A4E2C26E97CEEB705082ED67C9888B89304DBD
6300Setup.exeC:\ProgramData\uepl\VBoxDDU.dllexecutable
MD5:496DF6AD1A158ED5037138E397713EF0
SHA256:07C04290F53AAAAA7DF6B6EA3A53103B6E3EF8FF658D8097617A9C48DFC6E90A
6300Setup.exeC:\ProgramData\uepl\msvcr100.dllexecutable
MD5:366FD6F3A451351B5DF2D7C4ECF4C73A
SHA256:AE3CB6C6AFBA9A4AA5C85F66023C35338CA579B30326DD02918F9D55259503D5
6300Setup.exeC:\ProgramData\uepl\hidboybinary
MD5:FDE218EEBED4F70105540A3B2B42AAC5
SHA256:B60D53A6E2FFAB09CBBBDF2014458FF854B3852D667ED5B711DBBBB997B3C019
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
62
DNS requests
26
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5488
MoUsoCoreWorker.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6132
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
7028
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5236
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5236
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
6944
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1764
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4360
SearchApp.exe
104.126.37.147:443
www.bing.com
Akamai International B.V.
DE
whitelisted
5488
MoUsoCoreWorker.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4360
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
5488
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4020
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
whitelisted
www.bing.com
  • 104.126.37.147
  • 104.126.37.131
  • 104.126.37.171
  • 104.126.37.130
  • 104.126.37.163
  • 104.126.37.176
  • 104.126.37.145
  • 104.126.37.170
  • 104.126.37.139
  • 104.126.37.179
  • 104.126.37.144
  • 104.126.37.186
  • 104.126.37.123
  • 104.126.37.146
  • 104.126.37.184
  • 104.126.37.136
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 142.250.186.78
whitelisted
login.live.com
  • 40.126.32.140
  • 40.126.32.133
  • 20.190.160.14
  • 20.190.160.22
  • 40.126.32.138
  • 40.126.32.76
  • 40.126.32.68
  • 40.126.32.72
whitelisted
th.bing.com
  • 104.126.37.144
  • 104.126.37.186
  • 104.126.37.123
  • 104.126.37.146
  • 104.126.37.184
  • 104.126.37.136
  • 104.126.37.131
  • 104.126.37.139
  • 104.126.37.179
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted

Threats

PID
Process
Class
Message
2172
svchost.exe
Misc activity
ET INFO Pastebin Service Domain in DNS Lookup (rentry .co)
6396
SearchIndexer.exe
Misc activity
ET INFO Observed Pastebin Service Domain (rentry .co in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
#ⱾS$et-U!ῥ-P͜aS$$_2324__☆!_FU!!LL.zip