Explorerhijack

Overview

Behavior:Win32/ExplorerHijack is a critical heuristic detection for malware or attack frameworks that actively exploit 'Process Injection' techniques specifically targeting the `explorer.exe` process to hide malicious code, maintain persistence, and bypass endpoint firewalls.

Understanding Explorer Hijacking
For the end-user, this behavior is invisible—the Windows desktop operates normally. For an incident responder, an ExplorerHijack alert is a high-severity warning. `explorer.exe` is the Windows shell; it manages the desktop, taskbar, and file management. Because it is a universally trusted, fundamental operating system process that always runs and requires network access, it is the most common target for advanced malware seeking a place to hide. By injecting into `explorer.exe`, the malware's network traffic and file system access appear entirely legitimate to legacy security tools.

Execution and Evasion Strategies
This technique is utilized by almost all advanced malware, including ransomware, banking trojans (like Zeus or Trickbot), and state-sponsored RATs. The attacker drops a payload on disk, executes it, and the payload utilizes Windows APIs (like VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread) to allocate memory inside the running `explorer.exe` process. The malware writes its malicious code into that space and executes it. The original dropper on disk may then delete itself, leaving the malware entirely memory-resident within the trusted shell process.

Indicators of Compromise & Impact
The impact depends entirely on the injected payload, but the presence of this technique guarantees a sophisticated attacker. Incident responders must perform live memory forensics. EDR platforms detect this by monitoring for anomalous API calls targeting `explorer.exe` or identifying unusual network connections (like an outbound connection to a newly registered domain over port 443) originating directly from the `explorer.exe` process.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_EXPLORERHIJACK {
    meta:
        description = "Detects Explorerhijack (ransomware)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "explorerhijack" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Explorerhijack Activity
id: fe433f0b684d1b7f2164ca2286160f01
status: experimental
description: Detects generic indicators of the explorerhijack malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*explorerhijack*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately isolate the endpoint; process hijacking targeting explorer.exe is the hallmark of active, severe threats like ransomware precursors.
2. Do NOT reboot the machine. Capture a full forensic memory image (RAM dump) immediately to preserve the injected, memory-resident payload.
3. Utilize EDR to analyze the threads running within explorer.exe to identify the specific injected module communicating with the C2 server.
4. Assume the endpoint is severely compromised and perform a full OS rebuild after forensic evidence has been secured.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not kill the explorer.exe process without capturing memory first; killing the shell will crash the desktop and destroy the memory-resident payload.
2. Avoid relying on static disk scans to remediate the threat; the primary payload is often entirely memory-resident.

References & External Analysis

• Search "explorerhijack" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: ransomware)

Explore other malware families in the same category:

• Fantom
• Wavipeg
• Esaprof
• Badur
• Squarenet

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/explorerhijack.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.