Analysis
- max time kernel
150s - max time network
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/07/2026, 04:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Hdsfgr.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Hdsfgr.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target Hdsfgr.exe
- Size 144KB
- Sample260711-eylensbv4j
- SHA256 659ebcbbba3b5f42b3b458bf9d881b325c7ad6d6bc75afcb49c235d8eb32e438
- MD5 ed0ebe496187cb0ec209b25c925b232e
- SHA1 0af8f490112660871579f55798309c7e1fd97d96
- SHA512 aa08346dd8be792effc49734f8de5af01a9dd3131a04a6c23b1f11310ff29c3363ebea45526840baebe5ff279f2efc5941525d7be091318863734f0a554a3a1f
- SSDEEP 3072:PUAyvIDSIsa600iwo5F2x1zqA/zAewpu4wEiM8AkAg:PUA/sa60DwoP41ZLAejoo
- TLSH T123E35B1BB3A631F9E177823989624605F7B3B43117609FEF03A442756F236C5AD3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Windows\\System32\\winlogon32.exe" Hdsfgr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\winlogon32.exe" winlogon32.exe - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon32.exe Hdsfgr.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon32.exe winlogon32.exe - Executes dropped EXE 1 IoCs
pid Process 1044 winlogon32.exe - Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\winlogon32 Hdsfgr.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\winlogon32 winlogon32.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityUpdate = "C:\\Windows\\System32\\winlogon32.exe" Hdsfgr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityUpdate = "C:\\Windows\\System32\\winlogon32.exe" Hdsfgr.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\winlogon32.exe" winlogon32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\winlogon32.exe" winlogon32.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\System32\winlogon32.exe Hdsfgr.exe File created C:\Windows\System32\winlogon32.exe winlogon32.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe 460 Hdsfgr.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 460 Hdsfgr.exe 1044 winlogon32.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4224 wrote to memory of 3944 4224 userinit.exe 88 PID 4224 wrote to memory of 1044 4224 userinit.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\Hdsfgr.exe"C:\Users\Admin\AppData\Local\Temp\Hdsfgr.exe"1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:460
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵PID:3944
-
-
C:\Windows\System32\winlogon32.exeC:\Windows\System32\winlogon32.exe2⤵
- Modifies WinLogon for persistence
- Drops startup file
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1044
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\System32\winlogon32.exe
- Size 144KB
- SHA256 659ebcbbba3b5f42b3b458bf9d881b325c7ad6d6bc75afcb49c235d8eb32e438
- MD5 ed0ebe496187cb0ec209b25c925b232e
- SHA1 0af8f490112660871579f55798309c7e1fd97d96
- SHA512 aa08346dd8be792effc49734f8de5af01a9dd3131a04a6c23b1f11310ff29c3363ebea45526840baebe5ff279f2efc5941525d7be091318863734f0a554a3a1f
- SSDEEP 3072:PUAyvIDSIsa600iwo5F2x1zqA/zAewpu4wEiM8AkAg:PUA/sa60DwoP41ZLAejoo
- TLSH T123E35B1BB3A631F9E177823989624605F7B3B43117609FEF03A442756F236C5AD3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH