Overview
overview
7Static
static
3Installer/Setup.exe
windows10-2004-x64
7Installer/Setup.exe
windows11-ltsc_2024-x64
7Installer/...64.exe
windows10-2004-x64
6Installer/...64.exe
windows11-ltsc_2024-x64
6Installer/...64.exe
windows10-2004-x64
4Installer/...64.exe
windows11-ltsc_2024-x64
4Installer/...64.exe
windows10-2004-x64
6Installer/...64.exe
windows11-ltsc_2024-x64
6Installer/...64.exe
windows10-2004-x64
4Installer/...64.exe
windows11-ltsc_2024-x64
4Installer/...64.exe
windows10-2004-x64
4Installer/...64.exe
windows11-ltsc_2024-x64
4Analysis
- max time kernel
149s - max time network
168s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
15/08/2026, 15:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Installer/Setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Installer/Setup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
Installer/utils/HidHide_1.5.230_x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral4
Sample
Installer/utils/HidHide_1.5.230_x64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
Behavioral task
behavioral5
Sample
Installer/utils/VC_redist.x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral6
Sample
Installer/utils/VC_redist.x64.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral7
Sample
Installer/utils/ViGEmBus_1.22.0_x64_x86_arm64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral8
Sample
Installer/utils/ViGEmBus_1.22.0_x64_x86_arm64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
Behavioral task
behavioral9
Sample
Installer/utils/dotnet-sdk-9.0.301-win-x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral10
Sample
Installer/utils/dotnet-sdk-9.0.301-win-x64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral11
Sample
Installer/utils/windowsdesktop-runtime-8.0.3-win-x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral12
Sample
Installer/utils/windowsdesktop-runtime-8.0.3-win-x64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target Installer/utils/HidHide_1.5.230_x64.exe
- Size 7.7MB
- Sample260815-svs71adn3y
- SHA256 f4bbbcb82e6258641b887c74bc81c4c5f66e4aa811808dfc304347687b7605f6
- MD5 705173711090d36275d62ca7b111bfc3
- SHA1 f7de49272cbd8a8912f511c3a11471be05b44e2a
- SHA512 d535b8a7ad3d72c2e9b602c59b68ca265c41d500294a7d56d94d8c188277f7f69b8526f5c9a57af3f5bceec18560cb3622aa767e4571c724a299733e78c1f1bc
- SSDEEP 196608:fWFsTuRN2zahf1Y7EcnGf7a+JJIlAmnVTvQf2bu:OFsTuRN2zsmEzRJJPm2ebu
- TLSH T19286D030765EC52AD56205F0592CAB9B911CAE3D0B61E4C7B3CC6D6F2B744CB0636E2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: HidHide_1.5.230_x64.exe File opened (read-only) \??\M: HidHide_1.5.230_x64.exe File opened (read-only) \??\O: HidHide_1.5.230_x64.exe File opened (read-only) \??\V: HidHide_1.5.230_x64.exe File opened (read-only) \??\Z: HidHide_1.5.230_x64.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\N: HidHide_1.5.230_x64.exe File opened (read-only) \??\T: HidHide_1.5.230_x64.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: HidHide_1.5.230_x64.exe File opened (read-only) \??\R: HidHide_1.5.230_x64.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: HidHide_1.5.230_x64.exe File opened (read-only) \??\H: HidHide_1.5.230_x64.exe File opened (read-only) \??\I: HidHide_1.5.230_x64.exe File opened (read-only) \??\J: HidHide_1.5.230_x64.exe File opened (read-only) \??\W: HidHide_1.5.230_x64.exe File opened (read-only) \??\X: HidHide_1.5.230_x64.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: HidHide_1.5.230_x64.exe File opened (read-only) \??\S: HidHide_1.5.230_x64.exe File opened (read-only) \??\Y: HidHide_1.5.230_x64.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\U: HidHide_1.5.230_x64.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: HidHide_1.5.230_x64.exe File opened (read-only) \??\K: HidHide_1.5.230_x64.exe File opened (read-only) \??\P: HidHide_1.5.230_x64.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: HidHide_1.5.230_x64.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe - Loads dropped DLL 11 IoCs
pid Process 4712 MsiExec.exe 4712 MsiExec.exe 4712 MsiExec.exe 4712 MsiExec.exe 4712 MsiExec.exe 4712 MsiExec.exe 4712 MsiExec.exe 4712 MsiExec.exe 4712 MsiExec.exe 4712 MsiExec.exe 4712 MsiExec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HidHide_1.5.230_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 3952 msiexec.exe Token: SeCreateTokenPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeAssignPrimaryTokenPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeLockMemoryPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeIncreaseQuotaPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeMachineAccountPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeTcbPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeSecurityPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeTakeOwnershipPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeLoadDriverPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeSystemProfilePrivilege 1540 HidHide_1.5.230_x64.exe Token: SeSystemtimePrivilege 1540 HidHide_1.5.230_x64.exe Token: SeProfSingleProcessPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeIncBasePriorityPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeCreatePagefilePrivilege 1540 HidHide_1.5.230_x64.exe Token: SeCreatePermanentPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeBackupPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeRestorePrivilege 1540 HidHide_1.5.230_x64.exe Token: SeShutdownPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeDebugPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeAuditPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeSystemEnvironmentPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeChangeNotifyPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeRemoteShutdownPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeUndockPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeSyncAgentPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeEnableDelegationPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeManageVolumePrivilege 1540 HidHide_1.5.230_x64.exe Token: SeImpersonatePrivilege 1540 HidHide_1.5.230_x64.exe Token: SeCreateGlobalPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeCreateTokenPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeAssignPrimaryTokenPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeLockMemoryPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeIncreaseQuotaPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeMachineAccountPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeTcbPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeSecurityPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeTakeOwnershipPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeLoadDriverPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeSystemProfilePrivilege 1540 HidHide_1.5.230_x64.exe Token: SeSystemtimePrivilege 1540 HidHide_1.5.230_x64.exe Token: SeProfSingleProcessPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeIncBasePriorityPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeCreatePagefilePrivilege 1540 HidHide_1.5.230_x64.exe Token: SeCreatePermanentPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeBackupPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeRestorePrivilege 1540 HidHide_1.5.230_x64.exe Token: SeShutdownPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeDebugPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeAuditPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeSystemEnvironmentPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeChangeNotifyPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeRemoteShutdownPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeUndockPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeSyncAgentPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeEnableDelegationPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeManageVolumePrivilege 1540 HidHide_1.5.230_x64.exe Token: SeImpersonatePrivilege 1540 HidHide_1.5.230_x64.exe Token: SeCreateGlobalPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeCreateTokenPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeAssignPrimaryTokenPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeLockMemoryPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeIncreaseQuotaPrivilege 1540 HidHide_1.5.230_x64.exe Token: SeMachineAccountPrivilege 1540 HidHide_1.5.230_x64.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1540 HidHide_1.5.230_x64.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3952 wrote to memory of 4712 3952 msiexec.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\Installer\utils\HidHide_1.5.230_x64.exe"C:\Users\Admin\AppData\Local\Temp\Installer\utils\HidHide_1.5.230_x64.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1540
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 27E61AF429DE1B90B78D649FAD2CA53A C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4712
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Nefarius Software Solutions\HidHide 1.5.230\install\4F26DAF\HidHide.msi
- Size 3.8MB
- SHA256 974f2f56bb9d87e760ffdc757bbaa1ad94cefb57431d73b1e5e209f262b8c9f7
- MD5 9e5dbbdee6cac280e53c684e2d540697
- SHA1 0096e11462d29fa00f45bd49fffcc3b57d6d813b
- SHA512 de8c2d7f87d39b354c2522b84d669e91dda77265d89eccea3cecc3fdae3b652db3f226d5ed05322ea375519bc4f2f0c2a6a1ab8557c8bbbafead28064ea496c4
- SSDEEP 49152:28EleHBG5q7vaU4BPMPT58fGu9CKGQBrlpVYnaQhOSn2XQxnw5oDp/xHd3P9zmHk:Mlehb4BPBrk2gBDrpPr
- TLSH T16B068C217ACBC03AE56E0172667DEF6B903DBE370B3040D763E47A6A58788C25635B17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_1540\banner.jpg
- Size 4KB
- SHA256 be83c8592906fd9651634b0823a2f45abe96aae082674568944c639b5b4a95dc
- MD5 d5a55a78cd38f45256807c7851619b7d
- SHA1 9d8269120d1d096e9ab0192348f3b8f81f5f73d9
- SHA512 959e7410e3006cfef9d14315e8741e34b6e81c4f9160c5d66f3abd77ce72f55f907ab3a0e500780b5c0e0e017e8639f135cc258976b4ab4b9d1aaed6242ce9f1
- SSDEEP 96:gf2mCSVa8l5M3QXr1yFk1Erk/Sp3ErJE97KT6Avg+y5rls/Xx:I88oAXQk1Erk/Sp3ErcAvBy/wh
- TLSH T10D916E7FBAC02317E9C6CA6A3DAE8017561108F168F0E63508CFCDD3D93919B596A1E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_1540\dialog.jpg
- Size 12KB
- SHA256 36d9bab35d1e4b50045bf902f5d42b6f865488c75f6e60fc00a6cd6f69034ab0
- MD5 5f6253cff5a8b031bfb3b161079d0d86
- SHA1 7645b13610583fb67247c74cf5af08ff848079e7
- SHA512 d1fdc364bedf931512000fbf05e854d5aceccb48abb9ec49e68476a5dc2907267490290d92acbb267ffb7bdba9b7a1c88f1eb77830cf953443f4624995dabdc3
- SSDEEP 192:zBi8rcWUMevBUahRXMHd0q3vkf6kx2DJIQ4EALOCwTx5D+CM96qdGi131:48IzMiBUaEHdp3vkCXuQ4pnH1dGiz
- TLSH T1E8429E6D0FAAF167D61123F061F3AFFF2F677E020A9000915DC6E593EB501A10D6C182
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIE348.tmp
- Size 738KB
- SHA256 8d3e94c47af3da706a9fe9e4428b2fefd5e9e6c7145e96927fffdf3dd5e472b8
- MD5 36cd2870d577ff917ba93c9f50f86374
- SHA1 e51baf257f5a3c3cd7b68690e36945fa3284e710
- SHA512 426fe493a25e99ca9630ad4706ca5ac062445391ab2087793637339f3742a5e1af2cedb4682babc0c4e7f9e06fed0b4ed543ddeb6f4e6f75c50349c0354aceda
- SSDEEP 12288:z0WEPSjIw3my6hFWRZGdTph0lhSMXleaGv5PCcuvk:zxkuf3T6hFWXKh0lhSMXlxG5q7vk
- TLSH T15DF46D2139C9C02AD56D01B12AFDDA6B912EBD7A4B7144CBA3D8AD7B19F14C29334F13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIE56D.tmp
- Size 870KB
- SHA256 80c5e769470bb98c5b1ec3be0a9a51f0821c67e9adc7e3e254bbc41183ceb76f
- MD5 65b853552e16654c53ab4d16920a9182
- SHA1 9f8182ef1b58d0d52f4faf1688d4f4e9dd8af5c5
- SHA512 b56c00e78ca901738a4a067709c772cfbdf10d3a049af4e7eb6bd7a0cb0629472d7798dabb0eb82958ae90cd71acc79e5cbc3d26b0f42d3cc7cc8ec2236aa54a
- SSDEEP 24576:G5hLE6v9NAjxcOoBFNMxMh0lhSMXlD5P+5fGu9CKGS:GU4BPMPT58fGu9CKGS
- TLSH T134155B33259EC026F27D02B0363D8B7BA52D6A770FB154DB63E4AE2A65344D21631E1F
- MD5 SHA1 SHA512 SSDEEP TLSH