{
  "family": "explorerhijack",
  "sample_count": 106,
  "category": "trojan",
  "description": "ExplorerHijack (monitored under behavioral detection signatures including Behavior:Win32/ExplorerHijack, Trojan:Win32/ExplorerHijack, and HackTool:Win32/ExplorerHijack) is a specialized class of Windows trojans and memory injection tools active since 2014. Rather than operating as an isolated binary, ExplorerHijack specifically targets the core Windows shell process (explorer.exe) using advanced process injection, reflective DLL loading, and process hollowing techniques. Because explorer.exe is a universally trusted, persistent operating system component with default network communications and high privileges, malware that injects into explorer.exe effectively cloaks outbound command-and-control beacons, bypasses host-based application firewalls, and eludes static disk-based security scans. ExplorerHijack payloads use native Windows APIs—including VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread—to allocate and execute shellcode within the address space of explorer.exe, subsequently deleting the initial on-disk dropper to maintain a pure in-memory footprint while executing secondary ransomware precursors, information stealers, or banking trojans.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Behavior:Win32/ExplorerHijack",
    "Trojan:Win32/ExplorerHijack",
    "HackTool:Win32/ExplorerHijack",
    "ProcessHijack.Explorer"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Behavior:Win32/ExplorerHijack detection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "ExplorerHijack detects malware that injects malicious code directly into the Windows explorer.exe shell process to hide operations."
      }
    },
    {
      "@type": "Question",
      "name": "Why do threat actors target the explorer.exe process for injection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Because explorer.exe always runs, possesses network access permissions, and blends in with legitimate system traffic to bypass defenses."
      }
    },
    {
      "@type": "Question",
      "name": "Which API calls indicate an explorer.exe hijacking attempt?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Threat hunters monitor for VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread or NtMapViewOfSection targeting explorer.exe."
      }
    },
    {
      "@type": "Question",
      "name": "What types of payloads utilize ExplorerHijack techniques?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is widely utilized by banking trojans, ransomware precursors, and advanced espionage backdoors for stealthy execution."
      }
    },
    {
      "@type": "Question",
      "name": "How do incident responders investigate an ExplorerHijack incident?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Capture a live memory image before rebooting, analyze unbacked executable memory regions in explorer.exe, and trace parent process trees."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1055.001",
    "T1055.002",
    "T1055",
    "T1106",
    "T1562.001",
    "T1027"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1055.001",
      "name": "Process Injection: Dynamic-link Library Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1055.002",
      "name": "Process Injection: Portable Executable Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1106",
      "name": "Native API",
      "tactic": "Execution"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Immediately isolate the affected endpoint from all internal and external networks to contain C2 communications.",
    "Do NOT restart the endpoint or terminate explorer.exe immediately; capture a volatile RAM dump to preserve injected modules.",
    "Utilize EDR memory inspection tools to identify unmapped or executable memory pages within the explorer.exe process context.",
    "Trace the parent process and disk execution artifacts to determine the initial vector that launched the injection dropper."
  ],
  "what_to_avoid": [
    "Do not kill the explorer.exe process before capturing a forensic memory image, as this destroys volatile payload evidence.",
    "Avoid relying only on standard file antivirus scans, as the primary payload is memory-resident and may have self-deleted on disk."
  ],
  "target_industries": [
    "Global / Opportunistic",
    "Enterprise Workstations",
    "Financial Sector"
  ],
  "motivation": "Defense Evasion",
  "threat_actors": [
    "Unknown / Cybercriminal",
    "Advanced Threat Groups"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "defense_evasion",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2014,
  "lineage": {
    "derived_from": [
      "Process Hollowing Techniques",
      "DLL Injection Frameworks"
    ],
    "variants": [
      "ExplorerHijack.A",
      "ExplorerInject.B"
    ]
  },
  "iocs": {
    "file_hashes": [
      "9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b",
      "0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c"
    ],
    "delivery": [
      "Secondary payload execution via weaponized Office macros and exploit kits",
      "Trojanized utility droppers self-deleting after injection"
    ],
    "persistence": [
      "Memory-resident threads inside explorer.exe",
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ExplorerSync"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Behavior:Win32/ExplorerHijack",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Behavior:Win32/ExplorerHijack"
    },
    {
      "name": "MITRE ATT&CK - Process Injection (T1055)",
      "url": "https://attack.mitre.org/techniques/T1055/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}