Overview

overview

8

Static

static

3

HorionInjector.exe

windows10-2004-x64

8

HorionInjector.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    298s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/09/2026, 04:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    HorionInjector.exe
  • Size 147KB
  • Sample260930-el34ysvgrc
  • SHA256 2d79af8e1ff3465703e1dc73d3ef2182fd269ea2609c8afabdf1b80693405c1d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarediscoveryspyware

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\HorionInjector.exe
    "C:\Users\Admin\AppData\Local\Temp\HorionInjector.exe"
    1⤵
    • Downloads MZ/PE file
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3468
    • C:\Windows\explorer.exe
      explorer.exe shell:appsFolder\Microsoft.MinecraftUWP_8wekyb3d8bbwe!App
      2⤵
        PID:4200
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Enumerates connected drives
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:3960

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/3468-0-0x0000024D0A700000-0x0000024D0A728000-memory.dmp
          Download

          memory/3468-1-0x0000024D0AB40000-0x0000024D0AB50000-memory.dmp
          Download

          memory/3468-2-0x0000024D26580000-0x0000024D2663A000-memory.dmp
          Download

          memory/3468-3-0x0000024D0AB40000-0x0000024D0AB50000-memory.dmp
          Download

          memory/3468-4-0x0000024D2A7F0000-0x0000024D2A7F8000-memory.dmp
          Download

          memory/3468-5-0x0000024D0AB40000-0x0000024D0AB50000-memory.dmp
          Download

          memory/3468-7-0x0000024D26AA0000-0x0000024D26AAE000-memory.dmp
          Download

          memory/3468-6-0x0000024D26AD0000-0x0000024D26B08000-memory.dmp
          Download

          memory/3468-8-0x0000024D0AB40000-0x0000024D0AB50000-memory.dmp
          Download

          memory/3468-9-0x0000024D0AB40000-0x0000024D0AB50000-memory.dmp
          Download

          memory/3468-11-0x0000024D0AB40000-0x0000024D0AB50000-memory.dmp
          Download

          memory/3468-15-0x0000024D26740000-0x0000024D2690E000-memory.dmp
          Download

          memory/3468-16-0x0000024D0AB40000-0x0000024D0AB50000-memory.dmp
          Download

          memory/3960-18-0x0000000004950000-0x00000000049A6000-memory.dmp
          Download

          memory/3960-23-0x0000000004950000-0x00000000049A6000-memory.dmp
          Download