Analysis
- max time kernel
72s - max time network
76s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
20/06/2026, 07:40
Static task
static1
Behavioral task
behavioral1
Sample
HidHide_1.5.230_x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
HidHide_1.5.230_x64.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
HidHide_1.5.230_x64.exe
Resource
win11-20260513-en
windows11-21h2-x64
7 signatures
150 seconds
Behavioral task
behavioral4
Sample
HidHide_1.5.230_x64.exe
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target HidHide_1.5.230_x64.exe
- Size 7.7MB
- Sample260620-jhp55se141
- SHA256 f4bbbcb82e6258641b887c74bc81c4c5f66e4aa811808dfc304347687b7605f6
- MD5 705173711090d36275d62ca7b111bfc3
- SHA1 f7de49272cbd8a8912f511c3a11471be05b44e2a
- SHA512 d535b8a7ad3d72c2e9b602c59b68ca265c41d500294a7d56d94d8c188277f7f69b8526f5c9a57af3f5bceec18560cb3622aa767e4571c724a299733e78c1f1bc
- SSDEEP 196608:fWFsTuRN2zahf1Y7EcnGf7a+JJIlAmnVTvQf2bu:OFsTuRN2zsmEzRJJPm2ebu
- TLSH T19286D030765EC52AD56205F0592CAB9B911CAE3D0B61E4C7B3CC6D6F2B744CB0636E2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: HidHide_1.5.230_x64.exe File opened (read-only) \??\R: HidHide_1.5.230_x64.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\B: HidHide_1.5.230_x64.exe File opened (read-only) \??\S: HidHide_1.5.230_x64.exe File opened (read-only) \??\X: HidHide_1.5.230_x64.exe File opened (read-only) \??\Y: HidHide_1.5.230_x64.exe File opened (read-only) \??\Z: HidHide_1.5.230_x64.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\P: HidHide_1.5.230_x64.exe File opened (read-only) \??\T: HidHide_1.5.230_x64.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: HidHide_1.5.230_x64.exe File opened (read-only) \??\I: HidHide_1.5.230_x64.exe File opened (read-only) \??\W: HidHide_1.5.230_x64.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\O: HidHide_1.5.230_x64.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: HidHide_1.5.230_x64.exe File opened (read-only) \??\D: HidHide_1.5.230_x64.exe File opened (read-only) \??\K: HidHide_1.5.230_x64.exe File opened (read-only) \??\N: HidHide_1.5.230_x64.exe File opened (read-only) \??\U: HidHide_1.5.230_x64.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: HidHide_1.5.230_x64.exe File opened (read-only) \??\M: HidHide_1.5.230_x64.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: HidHide_1.5.230_x64.exe File opened (read-only) \??\L: HidHide_1.5.230_x64.exe File opened (read-only) \??\V: HidHide_1.5.230_x64.exe - Loads dropped DLL 11 IoCs
pid Process 3084 MsiExec.exe 3084 MsiExec.exe 3084 MsiExec.exe 3084 MsiExec.exe 3084 MsiExec.exe 3084 MsiExec.exe 3084 MsiExec.exe 3084 MsiExec.exe 3084 MsiExec.exe 3084 MsiExec.exe 3084 MsiExec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HidHide_1.5.230_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 3952 msiexec.exe Token: SeCreateTokenPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeAssignPrimaryTokenPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeLockMemoryPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeIncreaseQuotaPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeMachineAccountPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeTcbPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeSecurityPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeTakeOwnershipPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeLoadDriverPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeSystemProfilePrivilege 4908 HidHide_1.5.230_x64.exe Token: SeSystemtimePrivilege 4908 HidHide_1.5.230_x64.exe Token: SeProfSingleProcessPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeIncBasePriorityPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeCreatePagefilePrivilege 4908 HidHide_1.5.230_x64.exe Token: SeCreatePermanentPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeBackupPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeRestorePrivilege 4908 HidHide_1.5.230_x64.exe Token: SeShutdownPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeDebugPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeAuditPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeSystemEnvironmentPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeChangeNotifyPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeRemoteShutdownPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeUndockPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeSyncAgentPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeEnableDelegationPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeManageVolumePrivilege 4908 HidHide_1.5.230_x64.exe Token: SeImpersonatePrivilege 4908 HidHide_1.5.230_x64.exe Token: SeCreateGlobalPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeCreateTokenPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeAssignPrimaryTokenPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeLockMemoryPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeIncreaseQuotaPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeMachineAccountPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeTcbPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeSecurityPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeTakeOwnershipPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeLoadDriverPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeSystemProfilePrivilege 4908 HidHide_1.5.230_x64.exe Token: SeSystemtimePrivilege 4908 HidHide_1.5.230_x64.exe Token: SeProfSingleProcessPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeIncBasePriorityPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeCreatePagefilePrivilege 4908 HidHide_1.5.230_x64.exe Token: SeCreatePermanentPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeBackupPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeRestorePrivilege 4908 HidHide_1.5.230_x64.exe Token: SeShutdownPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeDebugPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeAuditPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeSystemEnvironmentPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeChangeNotifyPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeRemoteShutdownPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeUndockPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeSyncAgentPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeEnableDelegationPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeManageVolumePrivilege 4908 HidHide_1.5.230_x64.exe Token: SeImpersonatePrivilege 4908 HidHide_1.5.230_x64.exe Token: SeCreateGlobalPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeCreateTokenPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeAssignPrimaryTokenPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeLockMemoryPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeIncreaseQuotaPrivilege 4908 HidHide_1.5.230_x64.exe Token: SeMachineAccountPrivilege 4908 HidHide_1.5.230_x64.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4908 HidHide_1.5.230_x64.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3952 wrote to memory of 3084 3952 msiexec.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\HidHide_1.5.230_x64.exe"C:\Users\Admin\AppData\Local\Temp\HidHide_1.5.230_x64.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4908
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6181F72AF726E4EADD81009F3F5CA385 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3084
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Nefarius Software Solutions\HidHide 1.5.230\install\4F26DAF\HidHide.msi
- Size 3.8MB
- SHA256 974f2f56bb9d87e760ffdc757bbaa1ad94cefb57431d73b1e5e209f262b8c9f7
- MD5 9e5dbbdee6cac280e53c684e2d540697
- SHA1 0096e11462d29fa00f45bd49fffcc3b57d6d813b
- SHA512 de8c2d7f87d39b354c2522b84d669e91dda77265d89eccea3cecc3fdae3b652db3f226d5ed05322ea375519bc4f2f0c2a6a1ab8557c8bbbafead28064ea496c4
- SSDEEP 49152:28EleHBG5q7vaU4BPMPT58fGu9CKGQBrlpVYnaQhOSn2XQxnw5oDp/xHd3P9zmHk:Mlehb4BPBrk2gBDrpPr
- TLSH T16B068C217ACBC03AE56E0172667DEF6B903DBE370B3040D763E47A6A58788C25635B17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4908\banner.jpg
- Size 4KB
- SHA256 be83c8592906fd9651634b0823a2f45abe96aae082674568944c639b5b4a95dc
- MD5 d5a55a78cd38f45256807c7851619b7d
- SHA1 9d8269120d1d096e9ab0192348f3b8f81f5f73d9
- SHA512 959e7410e3006cfef9d14315e8741e34b6e81c4f9160c5d66f3abd77ce72f55f907ab3a0e500780b5c0e0e017e8639f135cc258976b4ab4b9d1aaed6242ce9f1
- SSDEEP 96:gf2mCSVa8l5M3QXr1yFk1Erk/Sp3ErJE97KT6Avg+y5rls/Xx:I88oAXQk1Erk/Sp3ErcAvBy/wh
- TLSH T10D916E7FBAC02317E9C6CA6A3DAE8017561108F168F0E63508CFCDD3D93919B596A1E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4908\dialog.jpg
- Size 12KB
- SHA256 36d9bab35d1e4b50045bf902f5d42b6f865488c75f6e60fc00a6cd6f69034ab0
- MD5 5f6253cff5a8b031bfb3b161079d0d86
- SHA1 7645b13610583fb67247c74cf5af08ff848079e7
- SHA512 d1fdc364bedf931512000fbf05e854d5aceccb48abb9ec49e68476a5dc2907267490290d92acbb267ffb7bdba9b7a1c88f1eb77830cf953443f4624995dabdc3
- SSDEEP 192:zBi8rcWUMevBUahRXMHd0q3vkf6kx2DJIQ4EALOCwTx5D+CM96qdGi131:48IzMiBUaEHdp3vkCXuQ4pnH1dGiz
- TLSH T1E8429E6D0FAAF167D61123F061F3AFFF2F677E020A9000915DC6E593EB501A10D6C182
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI4C09.tmp
- Size 738KB
- SHA256 8d3e94c47af3da706a9fe9e4428b2fefd5e9e6c7145e96927fffdf3dd5e472b8
- MD5 36cd2870d577ff917ba93c9f50f86374
- SHA1 e51baf257f5a3c3cd7b68690e36945fa3284e710
- SHA512 426fe493a25e99ca9630ad4706ca5ac062445391ab2087793637339f3742a5e1af2cedb4682babc0c4e7f9e06fed0b4ed543ddeb6f4e6f75c50349c0354aceda
- SSDEEP 12288:z0WEPSjIw3my6hFWRZGdTph0lhSMXleaGv5PCcuvk:zxkuf3T6hFWXKh0lhSMXlxG5q7vk
- TLSH T15DF46D2139C9C02AD56D01B12AFDDA6B912EBD7A4B7144CBA3D8AD7B19F14C29334F13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI4CA8.tmp
- Size 870KB
- SHA256 80c5e769470bb98c5b1ec3be0a9a51f0821c67e9adc7e3e254bbc41183ceb76f
- MD5 65b853552e16654c53ab4d16920a9182
- SHA1 9f8182ef1b58d0d52f4faf1688d4f4e9dd8af5c5
- SHA512 b56c00e78ca901738a4a067709c772cfbdf10d3a049af4e7eb6bd7a0cb0629472d7798dabb0eb82958ae90cd71acc79e5cbc3d26b0f42d3cc7cc8ec2236aa54a
- SSDEEP 24576:G5hLE6v9NAjxcOoBFNMxMh0lhSMXlD5P+5fGu9CKGS:GU4BPMPT58fGu9CKGS
- TLSH T134155B33259EC026F27D02B0363D8B7BA52D6A770FB154DB63E4AE2A65344D21631E1F
- MD5 SHA1 SHA512 SSDEEP TLSH