Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16/10/2024, 19:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
HorionInjector.exe
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
HorionInjector.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
HorionInjector.exe
-
Size
147KB
-
MD5
6b5b6e625de774e5c285712b7c4a0da7
-
SHA1
317099aef530afbe3a0c5d6a2743d51e04805267
-
SHA256
2d79af8e1ff3465703e1dc73d3ef2182fd269ea2609c8afabdf1b80693405c1d
-
SHA512
104609adf666588af4e152ec7891cedafd89ad8d427063d03fb42a228babefc59428b0c8b1430cb3fc319a5014d2ee1083ff2b74fa585cab2d86cdad346e8b08
-
SSDEEP
3072:ckgHqUGSCoEslON/q178+oO3BAE4T/DvueX:cNHqUGSCPBh+7VST/Ke
Score
8/10
Malware Config
Signatures
-
Downloads MZ/PE file
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe -
Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" explorer.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2908 explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe 4820 HorionInjector.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4820 HorionInjector.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2908 explorer.exe 2908 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4820 wrote to memory of 3644 4820 HorionInjector.exe 100 PID 4820 wrote to memory of 3644 4820 HorionInjector.exe 100 PID 3436 wrote to memory of 4332 3436 msedge.exe 122 PID 3436 wrote to memory of 4332 3436 msedge.exe 122 PID 3436 wrote to memory of 620 3436 msedge.exe 123 PID 3436 wrote to memory of 620 3436 msedge.exe 123 PID 3436 wrote to memory of 620 3436 msedge.exe 123 PID 3436 wrote to memory of 620 3436 msedge.exe 123 PID 3436 wrote to memory of 620 3436 msedge.exe 123 PID 3436 wrote to memory of 620 3436 msedge.exe 123 PID 3436 wrote to memory of 620 3436 msedge.exe 123 PID 3436 wrote to memory of 620 3436 msedge.exe 123 PID 3436 wrote to memory of 620 3436 msedge.exe 123 PID 3436 wrote to memory of 620 3436 msedge.exe 123 PID 3436 wrote to memory of 620 3436 msedge.exe 123 PID 3436 wrote to memory of 620 3436 msedge.exe 123 PID 3436 wrote to memory of 620 3436 msedge.exe 123 PID 3436 wrote to memory of 620 3436 msedge.exe 123 PID 3436 wrote to memory of 620 3436 msedge.exe 123 PID 3436 wrote to memory of 620 3436 msedge.exe 123 PID 3436 wrote to memory of 620 3436 msedge.exe 123 PID 3436 wrote to memory of 620 3436 msedge.exe 123 PID 3436 wrote to memory of 620 3436 msedge.exe 123 PID 3436 wrote to memory of 620 3436 msedge.exe 123 PID 3436 wrote to memory of 620 3436 msedge.exe 123 PID 3436 wrote to memory of 620 3436 msedge.exe 123 PID 3436 wrote to memory of 620 3436 msedge.exe 123 PID 3436 wrote to memory of 620 3436 msedge.exe 123 PID 3436 wrote to memory of 620 3436 msedge.exe 123 PID 3436 wrote to memory of 620 3436 msedge.exe 123 PID 3436 wrote to memory of 620 3436 msedge.exe 123 PID 3436 wrote to memory of 620 3436 msedge.exe 123 PID 3436 wrote to memory of 620 3436 msedge.exe 123 PID 3436 wrote to memory of 620 3436 msedge.exe 123 PID 3436 wrote to memory of 620 3436 msedge.exe 123 PID 3436 wrote to memory of 620 3436 msedge.exe 123 PID 3436 wrote to memory of 620 3436 msedge.exe 123 PID 3436 wrote to memory of 620 3436 msedge.exe 123 PID 3436 wrote to memory of 620 3436 msedge.exe 123 PID 3436 wrote to memory of 620 3436 msedge.exe 123 PID 3436 wrote to memory of 620 3436 msedge.exe 123 PID 3436 wrote to memory of 620 3436 msedge.exe 123 PID 3436 wrote to memory of 620 3436 msedge.exe 123 PID 3436 wrote to memory of 620 3436 msedge.exe 123 PID 3436 wrote to memory of 5088 3436 msedge.exe 124 PID 3436 wrote to memory of 5088 3436 msedge.exe 124 PID 3436 wrote to memory of 5136 3436 msedge.exe 125 PID 3436 wrote to memory of 5136 3436 msedge.exe 125 PID 3436 wrote to memory of 5136 3436 msedge.exe 125 PID 3436 wrote to memory of 5136 3436 msedge.exe 125 PID 3436 wrote to memory of 5136 3436 msedge.exe 125 PID 3436 wrote to memory of 5136 3436 msedge.exe 125 PID 3436 wrote to memory of 5136 3436 msedge.exe 125 PID 3436 wrote to memory of 5136 3436 msedge.exe 125 PID 3436 wrote to memory of 5136 3436 msedge.exe 125 PID 3436 wrote to memory of 5136 3436 msedge.exe 125 PID 3436 wrote to memory of 5136 3436 msedge.exe 125 PID 3436 wrote to memory of 5136 3436 msedge.exe 125 PID 3436 wrote to memory of 5136 3436 msedge.exe 125 PID 3436 wrote to memory of 5136 3436 msedge.exe 125 PID 3436 wrote to memory of 5136 3436 msedge.exe 125 PID 3436 wrote to memory of 5136 3436 msedge.exe 125 PID 3436 wrote to memory of 5136 3436 msedge.exe 125 PID 3436 wrote to memory of 5136 3436 msedge.exe 125
Processes
-
C:\Users\Admin\AppData\Local\Temp\HorionInjector.exe"C:\Users\Admin\AppData\Local\Temp\HorionInjector.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\explorer.exeexplorer.exe shell:appsFolder\Microsoft.MinecraftUWP_8wekyb3d8bbwe!App2⤵PID:3644
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2908
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault70131a8bh4232h4e54hbe8eha4e533c328fb1⤵
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff91d6f46f8,0x7ff91d6f4708,0x7ff91d6f47182⤵PID:4332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,16359808821647147811,9794710379816929930,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:22⤵PID:620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,16359808821647147811,9794710379816929930,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:32⤵PID:5088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,16359808821647147811,9794710379816929930,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:82⤵PID:5136
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5312
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5360
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5d22073dea53e79d9b824f27ac5e9813e
SHA16d8a7281241248431a1571e6ddc55798b01fa961
SHA25686713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6
SHA51297152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413
-
Filesize
6KB
MD5b230e0a92f6d6a6d11aef90d0aaf5d77
SHA1b8e57affe11fb470a19c9931caf18cae563226e6
SHA256f4ff601f19226945fa77054c321b6cfbe1de1446549f77359b2c8b94b28bbb70
SHA51201f4917067b8e5f6f26520df3d3681f4d01a40ea0c493178cb6b75b762b572b60e6438e22d3a944227c751d46651a99d4d0338f80ae4a739b937316a4172f0cc
-
Filesize
8KB
MD53ff870c8984640dbd41cbd5c71726a4e
SHA17be64c825b73bafcb1e28c59e2b44d7b4a3599ca
SHA256a51adb75f58c5b82bacf9ae4592650e222a35fa0f8837180085d422de3997771
SHA512395c2d75fbeb597e0409f70b855e0dcc8556234386f8cc1bdb2284b54a0beb97701728e4dd0372c67c0bd9cc34b066eba33a269ab631ef39ee6b90bee827e2af