Analysis
- user interaction
yes - max time kernel
395s - max time network
396s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
08/08/2026, 16:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
hydrogen.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
hydrogen.exe
Resource
win11-20260513-en
windows11-21h2-x64
6 signatures
150 seconds
Errors
Reason
Machine shutdown
General
- Target hydrogen.exe
- Size 128KB
- Sample260808-thrn3shq5z
- SHA256 283f195bad35cac6e9452c2791eaeb90d9cd6d506aa16c6505247e5be74aabf0
- MD5 efdd98ae7ba8aa1a457d6938d554e5bb
- SHA1 5adc3d12792396b569bf024676636262bcd9c7ff
- SHA512 6c1e6adfcf7416c153b8f57149d232bd3caecda0806369cb00131e0877559953041017a641f910e7360ddeb059e568c4c4bbbbed28ed902f80221a68f1bafae9
- SSDEEP 3072:la0U9iSEZV1E2gK90lzIvJx1h9xgfHVpSIzM8ya9icI:lasSEZPEgGOFh9xgKIo
- TLSH T15ED36C27B3A534E8E9B68235C5511606E77378720B209FAF036046B95F376D0AE7BB70
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 hydrogen.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8" iexplore.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings hydrogen.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe Token: SeTakeOwnershipPrivilege 4332 hydrogen.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4332 wrote to memory of 4968 4332 hydrogen.exe 80 PID 4968 wrote to memory of 1284 4968 iexplore.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\hydrogen.exe"C:\Users\Admin\AppData\Local\Temp\hydrogen.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Windows\system32\@windows-hello-V4.1.gif2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4968 -s 7843⤵PID:1284
-
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:4444