{
  "family": "explorerhijack",
  "sample_count": 106,
  "category": "ransomware",
  "description": "Behavior:Win32/ExplorerHijack is a critical heuristic detection for malware or attack frameworks that actively exploit 'Process Injection' techniques specifically targeting the `explorer.exe` process to hide malicious code, maintain persistence, and bypass endpoint firewalls.<br><br><b>Understanding Explorer Hijacking</b><br>For the end-user, this behavior is invisible—the Windows desktop operates normally. For an incident responder, an ExplorerHijack alert is a high-severity warning. `explorer.exe` is the Windows shell; it manages the desktop, taskbar, and file management. Because it is a universally trusted, fundamental operating system process that always runs and requires network access, it is the most common target for advanced malware seeking a place to hide. By injecting into `explorer.exe`, the malware's network traffic and file system access appear entirely legitimate to legacy security tools.<br><br><b>Execution and Evasion Strategies</b><br>This technique is utilized by almost all advanced malware, including ransomware, banking trojans (like Zeus or Trickbot), and state-sponsored RATs. The attacker drops a payload on disk, executes it, and the payload utilizes Windows APIs (like <code>VirtualAllocEx</code>, <code>WriteProcessMemory</code>, and <code>CreateRemoteThread</code>) to allocate memory inside the running `explorer.exe` process. The malware writes its malicious code into that space and executes it. The original dropper on disk may then delete itself, leaving the malware entirely memory-resident within the trusted shell process.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the injected payload, but the presence of this technique guarantees a sophisticated attacker. Incident responders must perform live memory forensics. EDR platforms detect this by monitoring for anomalous API calls targeting `explorer.exe` or identifying unusual network connections (like an outbound connection to a newly registered domain over port 443) originating directly from the `explorer.exe` process.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1055.002",
    "T1562.001",
    "T1055",
    "T1055.001",
    "T1106"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1055.001",
      "name": "Process Injection: Dynamic-link Library Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1055.002",
      "name": "Process Injection: Portable Executable Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1106",
      "name": "Native API",
      "tactic": "Execution"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint; process hijacking targeting explorer.exe is the hallmark of active, severe threats like ransomware precursors.",
    "Do NOT reboot the machine. Capture a full forensic memory image (RAM dump) immediately to preserve the injected, memory-resident payload.",
    "Utilize EDR to analyze the threads running within explorer.exe to identify the specific injected module communicating with the C2 server.",
    "Assume the endpoint is severely compromised and perform a full OS rebuild after forensic evidence has been secured."
  ],
  "what_to_avoid": [
    "Do not kill the explorer.exe process without capturing memory first; killing the shell will crash the desktop and destroy the memory-resident payload.",
    "Avoid relying on static disk scans to remediate the threat; the primary payload is often entirely memory-resident."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}