File name:

IMG_Mia_Khalifa.zip

Full analysis: https://app.any.run/tasks/d01167d8-fec1-4c2c-8950-6d00290d25ff
Verdict: Malicious activity
Threats:

HijackLoader is a modular malware acting as a vehicle for distributing different types of malicious software on compromised systems. It gained prominence during the summer of 2023 and has since been used in multiple attacks against organizations from various sectors, including hospitality businesses.

Malware Trends Tracker     >>>
Analysis date: November 10, 2023, 17:44:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
hijackloader
loader
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

83E8A3D4FFB9C517D482D2E0A574DC4E

SHA1:

5D4ACF38CE428E7D58C11570459EA4A2704269F6

SHA256:

F2B6D7E5862FAB098697F153CE5BE6BF12B003DDACBBEAD00FF7CEB182A590E3

SSDEEP:

98304:5kkVyJZ2NJa8sGpnjyV04VbqcToFqTCcvKVrcZtVh3X1VLH3YznspUejhVGZJ7pN:qFo0o

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • IMG_Mia_Khalifa.exe (PID: 3372)

    • HIJACKLOADER has been detected (YARA)

      • IMG_Mia_Khalifa.exe (PID: 3660)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 3448)
      • IMG_Mia_Khalifa.exe (PID: 3372)

    • The process drops C-runtime libraries

      • IMG_Mia_Khalifa.exe (PID: 3372)

  • INFO

    • Reads the computer name

      • IMG_Mia_Khalifa.exe (PID: 3372)
      • IMG_Mia_Khalifa.exe (PID: 3512)
      • IMG_Mia_Khalifa.exe (PID: 3660)

    • Checks supported languages

      • IMG_Mia_Khalifa.exe (PID: 3372)
      • IMG_Mia_Khalifa.exe (PID: 3512)
      • IMG_Mia_Khalifa.exe (PID: 3660)

    • Creates files or folders in the user directory

      • IMG_Mia_Khalifa.exe (PID: 3372)

    • Manual execution by a user

      • IMG_Mia_Khalifa.exe (PID: 3660)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3448)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2023:11:09 18:28:28
ZipCRC: 0x250adb5e
ZipCompressedSize: 868366
ZipUncompressedSize: 895607
ZipFileName: agrarian.ods
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs img_mia_khalifa.exe img_mia_khalifa.exe #HIJACKLOADER img_mia_khalifa.exe

Process information

PID
CMD
Path
Indicators
Parent process
3372"C:\Users\admin\AppData\Local\Temp\Rar$EXa3448.26991\IMG_Mia_Khalifa.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3448.26991\IMG_Mia_Khalifa.exe
WinRAR.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Collaboration Synchronizer 10.0
Exit code:
3221225477
Version:
10.0.1.434
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3448.26991\img_mia_khalifa.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3448"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\IMG_Mia_Khalifa.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3512"C:\Users\admin\AppData\Local\Temp\Rar$EXa3448.27935\IMG_Mia_Khalifa.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3448.27935\IMG_Mia_Khalifa.exe
WinRAR.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Collaboration Synchronizer 10.0
Exit code:
3221225477
Version:
10.0.1.434
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3448.27935\img_mia_khalifa.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3660"C:\Users\admin\Desktop\IMG_Mia_Khalifa.exe" C:\Users\admin\Desktop\IMG_Mia_Khalifa.exe
explorer.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Collaboration Synchronizer 10.0
Exit code:
3221225477
Version:
10.0.1.434
Modules
Images
c:\users\admin\desktop\img_mia_khalifa.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
Total events
1 030
Read events
1 003
Write events
27
Delete events
0

Modification events

(PID) Process:(3448) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
23
Suspicious files
0
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
3448WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3448.26991\msvcp90.dllexecutable
MD5:90A32D8E07F7FB3D102EAB1DA28F0723
SHA256:004ED24507DC7307CEC1A3732FA57EABF19E918C3E1B54561E6CC01F554C0B77
3448WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3448.26991\IMG_Mia_Khalifa.exeexecutable
MD5:F778E9136AB0DB9DE9802A7043DE50A7
SHA256:90803A583E9F693DE5E7B8A196832436F6F648B27FB82E55904C256F30CC8B3A
3372IMG_Mia_Khalifa.exeC:\Users\admin\AppData\Roaming\Bxybrowser\msvcr90.dllexecutable
MD5:11D49148A302DE4104DED6A92B78B0ED
SHA256:CEB0947D898BC2A55A50F092F5ED3F7BE64AC1CD4661022EEFD3EDD4029213B0
3448WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3448.26991\msvcr90.dllexecutable
MD5:11D49148A302DE4104DED6A92B78B0ED
SHA256:CEB0947D898BC2A55A50F092F5ED3F7BE64AC1CD4661022EEFD3EDD4029213B0
3372IMG_Mia_Khalifa.exeC:\Users\admin\AppData\Roaming\Bxybrowser\msvcp90.dllexecutable
MD5:90A32D8E07F7FB3D102EAB1DA28F0723
SHA256:004ED24507DC7307CEC1A3732FA57EABF19E918C3E1B54561E6CC01F554C0B77
3372IMG_Mia_Khalifa.exeC:\Users\admin\AppData\Roaming\Bxybrowser\BIB.dllexecutable
MD5:759D71FC9442AB5A9B5749C0F6C0C263
SHA256:109647F58E7E8386A4C025F2C8175A4D638E5C0E62768953390764010EA22A2E
3448WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3448.27935\BIB.dllexecutable
MD5:759D71FC9442AB5A9B5749C0F6C0C263
SHA256:109647F58E7E8386A4C025F2C8175A4D638E5C0E62768953390764010EA22A2E
3372IMG_Mia_Khalifa.exeC:\Users\admin\AppData\Roaming\Bxybrowser\agrarian.odsimage
MD5:7D0A9CE28C4DB033C57A152F9FDECE05
SHA256:D1D63216B81D9F95D8C21C44412A3C950E01300D4549BBA29EF24B35BFEFE8A7
3372IMG_Mia_Khalifa.exeC:\Users\admin\AppData\Roaming\Bxybrowser\sqlite.dllexecutable
MD5:7BA069DD75BF6DFD45F1948D0147EA89
SHA256:5CB327BF50062F46F1F183CDE95FC36D0C9255778019A6CE2FF914B71EAE2464
3448WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3448.26991\BIB.dllexecutable
MD5:759D71FC9442AB5A9B5749C0F6C0C263
SHA256:109647F58E7E8386A4C025F2C8175A4D638E5C0E62768953390764010EA22A2E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
IMG_Mia_Khalifa.zip