Analysis
- user interaction
yes - max time kernel
154s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 04:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
HorionInjector.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
300 seconds
General
- Target HorionInjector.exe
- Size 147KB
- Sample260930-el34ysvgrc
- SHA256 2d79af8e1ff3465703e1dc73d3ef2182fd269ea2609c8afabdf1b80693405c1d
- MD5 6b5b6e625de774e5c285712b7c4a0da7
- SHA1 317099aef530afbe3a0c5d6a2743d51e04805267
- SHA512 104609adf666588af4e152ec7891cedafd89ad8d427063d03fb42a228babefc59428b0c8b1430cb3fc319a5014d2ee1083ff2b74fa585cab2d86cdad346e8b08
- SSDEEP 3072:ckgHqUGSCoEslON/q178+oO3BAE4T/DvueX:cNHqUGSCPBh+7VST/Ke
- TLSH T13DE3E6B0E397D428EC96473D8432BB528A27FD6B5CB0571C541EB13DA9B3316C1ADA0B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
flow pid Process 12 5620 HorionInjector.exe - Drops desktop.ini file(s) 3 IoCs
description ioc Process File opened for modification C:\Users\Admin\Pictures\desktop.ini explorer.exe File opened for modification C:\Users\Public\desktop.ini explorer.exe File opened for modification C:\Users\Public\Pictures\desktop.ini explorer.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain HorionInjector.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname HorionInjector.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe - Modifies registry class 49 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Rev = "0" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\NotificationData explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 14001f0005398e082303024b98265d99428e115f0000 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads" explorer.exe Key created \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f481cffcda87848be43b5fdf8091c1c60d0260001002600efbe110000005ec7f8ff4f42dd018fbe3651ba45dd018fbe3651ba45dd0114000000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "3" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Key created \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}" explorer.exe Key created \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616193" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" explorer.exe Key created \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656} explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616209" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" explorer.exe Key created \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 explorer.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3276 explorer.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe 5620 HorionInjector.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3276 explorer.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5620 HorionInjector.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3276 explorer.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 3276 explorer.exe 3276 explorer.exe 3276 explorer.exe 3276 explorer.exe 3276 explorer.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5620 wrote to memory of 2216 5620 HorionInjector.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\HorionInjector.exe"C:\Users\Admin\AppData\Local\Temp\HorionInjector.exe"1⤵
- Downloads MZ/PE file
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\Windows\explorer.exeexplorer.exe shell:appsFolder\Microsoft.MinecraftUWP_8wekyb3d8bbwe!App2⤵
- Modifies registry class
PID:2216
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3276
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5156