File name:

mal4.7z

Full analysis: https://app.any.run/tasks/c2766196-f7cd-40ad-aba1-277f1545357c
Verdict: Malicious activity
Threats:

HijackLoader is a modular malware acting as a vehicle for distributing different types of malicious software on compromised systems. It gained prominence during the summer of 2023 and has since been used in multiple attacks against organizations from various sectors, including hospitality businesses.

Malware Trends Tracker     >>>
Analysis date: December 05, 2024, 14:46:32
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
autoit
pastebin
lumma
susp-powershell
hijackloader
loader
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

88387FAB6193E342974A48E3D5D2EC82

SHA1:

BD8334C94412568C4A8040E063D59B053D3CC7C7

SHA256:

CB0C82F8E8DA2785D1E338C3EE9226483FEF6F4460F788FEE05C3278400AC5DB

SSDEEP:

196608:UdFJFY/QgmJsq3cGnKHHi9MFNozDiDr6Zw:CJFYT+sqsGgi922DuW2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • Setup.exe (PID: 2412)

    • LUMMA has been detected (YARA)

      • Emma.com (PID: 5920)

    • Changes powershell execution policy (Bypass)

      • Emma.com (PID: 5920)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 3436)
      • powershell.exe (PID: 5472)

    • Known privilege escalation attack

      • dllhost.exe (PID: 1576)

    • HIJACKLOADER has been detected (YARA)

      • ImApp.exe (PID: 6688)

  • SUSPICIOUS

    • Starts application with an unusual extension

      • Setup.exe (PID: 2412)
      • more.com (PID: 4872)
      • ImApp.exe (PID: 6688)
      • ImApp.exe (PID: 2796)

    • Executable content was dropped or overwritten

      • Setup.exe (PID: 2412)
      • more.com (PID: 4872)
      • powershell.exe (PID: 5472)
      • ImApp.exe (PID: 1416)

    • Starts the AutoIt3 executable file

      • more.com (PID: 4872)

    • The process executes Powershell scripts

      • Emma.com (PID: 5920)

    • BASE64 encoded PowerShell command has been detected

      • Emma.com (PID: 5920)

    • Base64-obfuscated command line is found

      • Emma.com (PID: 5920)

    • Starts POWERSHELL.EXE for commands execution

      • Emma.com (PID: 5920)

    • Process drops legitimate windows executable

      • powershell.exe (PID: 5472)
      • ImApp.exe (PID: 1416)

    • The process drops C-runtime libraries

      • ImApp.exe (PID: 1416)
      • powershell.exe (PID: 5472)

    • Starts itself from another location

      • ImApp.exe (PID: 1416)

  • INFO

    • The process uses the downloaded file

      • WinRAR.exe (PID: 6876)

    • Manual execution by a user

      • Setup.exe (PID: 2412)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6876)

    • Found Base64 encoded network access via PowerShell (YARA)

      • powershell.exe (PID: 5472)

    • Found Base64 encoded file access via PowerShell (YARA)

      • powershell.exe (PID: 5472)

    • The executable file from the user directory is run by the Powershell process

      • ImApp.exe (PID: 6688)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
ModifyDate: 2024:12:05 13:49:29+00:00
ArchivedFileName: mal4
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
144
Monitored processes
20
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe rundll32.exe no specs setup.exe caller.exe no specs more.com conhost.exe no specs #LUMMA emma.com powershell.exe no specs conhost.exe no specs powershell.exe conhost.exe no specs #HIJACKLOADER imapp.exe no specs more.com no specs conhost.exe no specs CMSTPLUA imapp.exe imapp.exe no specs more.com no specs conhost.exe no specs explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1140C:\Users\admin\AppData\Roaming\tamd64\ADAGWPURBMFJFYPHSWSYOBBX\Caller.exeC:\Users\admin\AppData\Roaming\tamd64\ADAGWPURBMFJFYPHSWSYOBBX\Caller.exe—Setup.exe
User:
admin
Company:
Custom Solutions of Maryland
Integrity Level:
MEDIUM
Exit code:
1
Version:
4.2.0.0
Modules
Images
c:\users\admin\appdata\roaming\tamd64\adagwpurbmfjfyphswsyobbx\caller.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1416"C:\Users\admin\AppData\Local\4727b00c-1718-4271-b23c-c5704a46cb32\ImApp.exe" C:\Users\admin\AppData\Local\4727b00c-1718-4271-b23c-c5704a46cb32\ImApp.exe
dllhost.exe
User:
admin
Company:
IncrediMail, Ltd.
Integrity Level:
HIGH
Description:
IncrediMail Tray Application
Exit code:
0
Version:
6, 3, 9, 5274
Modules
Images
c:\users\admin\appdata\local\4727b00c-1718-4271-b23c-c5704a46cb32\imapp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1576C:\WINDOWS\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}C:\Windows\SysWOW64\dllhost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ucrtbase.dll
c:\windows\syswow64\combase.dll
2412"C:\Users\admin\Desktop\mal4\Setup.exe" C:\Users\admin\Desktop\mal4\Setup.exe
explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Mozilla Thunderbird
Exit code:
1
Version:
1.8.1.19: 2008120920
Modules
Images
c:\users\admin\desktop\mal4\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
2796C:\Users\admin\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exeC:\Users\admin\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe—ImApp.exe
User:
admin
Company:
IncrediMail, Ltd.
Integrity Level:
HIGH
Description:
IncrediMail Tray Application
Exit code:
1
Version:
6, 3, 9, 5274
Modules
Images
c:\users\admin\appdata\roaming\amd64_4c10eeff886a3251\imapp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
3416C:\WINDOWS\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe—more.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Explorer
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\cna
c:\windows\syswow64\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
3436powershell -exec bypass -f "C:\Users\admin\AppData\Local\Temp\VV5EKW6OKPEVEAF6OB4.ps1"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—Emma.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
3744\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—more.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4136\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4872C:\WINDOWS\SysWOW64\more.comC:\Windows\SysWOW64\more.com
Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
More Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\more.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
15 949
Read events
15 922
Write events
27
Delete events
0

Modification events

(PID) Process:(6876) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6876) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6876) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6876) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\mal4.7z
(PID) Process:(6876) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6876) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6876) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6876) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5472) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5472) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
Executable files
57
Suspicious files
10
Text files
11
Unknown types
0

Dropped files

PID
Process
Filename
Type
6876WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6876.33046\mal4\nss3.dllexecutable
MD5:0E845C5A84427B1AF9B577C122BC4E23
SHA256:F9E1F2A9A88A5D5CA748A84784D56A65D5E611785AA1D3638C07E9B36624BC73
6876WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6876.33046\mal4\irikygbinary
MD5:BC28369723889A65E0CD37F4BCFF732C
SHA256:5B948A608E39D2E7DA540482C03B6F3158C7E58339DD36A46AFE6ABB75C2B8A1
6876WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6876.33046\mal4\softokn3.dllexecutable
MD5:DA7C7F8681BC177CC5CC1A5564BD6CE5
SHA256:656D3FFB58F3F75F0506595D5D818CECC59AA51DE492B21665ECAA0FF8966CE0
6876WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6876.33046\mal4\nsldappr32v50.dllexecutable
MD5:B8019E6A4DCF1037AB4FB3EA74FFF91D
SHA256:8377A1BABBDB38611C7BBBAF05AC5108C1C6539104B160CB1DBFCBB7638F3AE8
2412Setup.exeC:\Users\admin\AppData\Roaming\tamd64\nss3.dllexecutable
MD5:0E845C5A84427B1AF9B577C122BC4E23
SHA256:F9E1F2A9A88A5D5CA748A84784D56A65D5E611785AA1D3638C07E9B36624BC73
6876WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6876.33046\mal4\plc4.dllexecutable
MD5:9ED02E151C4F5417C10594A19EEEB034
SHA256:FA4BEBED44856339E1D65A670ECBCE8487EC95851B1CF278D40B442E5E118F71
6876WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6876.33046\mal4\plds4.dllexecutable
MD5:5D35EE582ED616947ADE1002F25682CA
SHA256:ED79346AF0BD7276039E011D72B7C817E2015EDDF91224E08DAF3B2A041CA5AD
6876WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6876.33046\mal4\smime3.dllexecutable
MD5:05FF877978A22599F8675344AFF7E9AC
SHA256:B8F3022392E3BD755B4D3BAE4011303EEA6ACAF5369AE987F33F654A30AEB5C2
6876WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6876.33046\mal4\ssl3.dllexecutable
MD5:FDF29B3A596524ADCC11C6031E682E16
SHA256:F5B17B9122EA779DA6E1C303F7D2D16096970E840A5FE072A65371FCFC9A8D34
6876WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6876.33046\mal4\xpcom_compat.dllexecutable
MD5:DD03A9F6BD3652FEEBC5B8E21F8F4379
SHA256:0E561CC712E9B2ECA7080B24E5B0B8CEAB09FB3406880A85EDCBCCD8F5B4988D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
45
DNS requests
27
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
2.16.164.98:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1684
svchost.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6400
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
2844
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2844
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
2.16.164.98:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
1684
svchost.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
2.23.209.132:443
www.bing.com
Akamai International B.V.
GB
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1176
svchost.exe
40.126.32.138:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 2.16.164.98
  • 2.16.164.18
  • 2.16.164.9
  • 2.16.164.26
  • 2.16.164.114
  • 2.16.164.27
  • 2.16.164.122
  • 2.16.164.97
  • 2.16.164.90
whitelisted
www.microsoft.com
  • 88.221.169.152
  • 69.192.161.161
whitelisted
google.com
  • 216.58.206.46
whitelisted
www.bing.com
  • 2.23.209.132
  • 2.23.209.140
  • 2.23.209.137
  • 2.23.209.135
  • 2.23.209.142
  • 2.23.209.143
  • 2.23.209.144
  • 2.23.209.133
  • 2.23.209.141
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.138
  • 20.190.160.20
  • 40.126.32.68
  • 40.126.32.140
  • 40.126.32.136
  • 20.190.160.22
  • 40.126.32.134
  • 40.126.32.72
whitelisted
go.microsoft.com
  • 23.32.186.57
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted

Threats

PID
Process
Class
Message
2192
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Online Pastebin Text Storage
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
mal4.7z