Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/08/2026, 10:44
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
HMW.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
HMW.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target HMW.exe
- Size 1.3MB
- Sample260822-msyf2stbrg
- SHA256 33d272ff75527f59369140018cac30a9c8fb24c176084e2f6536aa78f919c5bc
- MD5 9df067a541a29e692e63b81aa1f89e02
- SHA1 aaeb8743c179671e50ef5365ceab98409ae7e1fe
- SHA512 38ab02453e1e461e316fc1963ab55c2ef72fb4c9b494d77fab4148af80405fd7b25b1d4d55b700b0a48e853c6c86cbb86a3a0bb548149b9e94020e37f02198fe
- SSDEEP 24576:krORE29TTVx8aBRd1h1orq+GWE0Jc5bDTj1Vyv9TvagOGhb7/e:k2EYTb8atv1orq+pEiSDTj1VyvBaUh
- TLSH T1DD553B06636471B9FFF6F27A8526F9D6F6F47C0501E2891E07A3BE7A2E32320651D211
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HMW - Hide my Windows.lnk HMW.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\l: HMW.exe File opened (read-only) \??\s: HMW.exe File opened (read-only) \??\i: HMW.exe File opened (read-only) \??\p: HMW.exe File opened (read-only) \??\q: HMW.exe File opened (read-only) \??\y: HMW.exe File opened (read-only) \??\z: HMW.exe File opened (read-only) \??\d: HMW.exe File opened (read-only) \??\g: HMW.exe File opened (read-only) \??\n: HMW.exe File opened (read-only) \??\r: HMW.exe File opened (read-only) \??\t: HMW.exe File opened (read-only) \??\x: HMW.exe File opened (read-only) \??\a: HMW.exe File opened (read-only) \??\h: HMW.exe File opened (read-only) \??\m: HMW.exe File opened (read-only) \??\o: HMW.exe File opened (read-only) \??\u: HMW.exe File opened (read-only) \??\v: HMW.exe File opened (read-only) \??\w: HMW.exe File opened (read-only) \??\b: HMW.exe File opened (read-only) \??\j: HMW.exe File opened (read-only) \??\k: HMW.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3368 HMW.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe 3368 HMW.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3368 HMW.exe 3368 HMW.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\HMW.exe"C:\Users\Admin\AppData\Local\Temp\HMW.exe"1⤵
- Creates a file in the Startup directory
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3368
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\hmw.ini
- Size 236B
- SHA256 901f71d07098096f0a0aacf99bb3f2e957a77ddd0e9bc423d6d3c826f9b4360d
- MD5 64f349e5a41b064b5622efa1d6adc4d2
- SHA1 f0360eef31f68c97a6c404b6f517a5692a5aaa6e
- SHA512 d109db14505528d664ab52f17bd4ff0fea1467786cba749eaad5302e5a42e7269a87063ff6b3e270d815e9c95f75f4a96aa18e39a30b1612cbe0d9c999e62d41
- TLSH T18DD0E75637D5050AE5730B20D6E00073561ABC06643AE55951C30B5C55F74D30D69FAF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\hmw.ini
- Size 26B
- SHA256 64b92b073e9519d07676100c694c63207f45b561ce66594b8728eae023ba0705
- MD5 8af40c2a9db1af603163ed8b0e25a3d0
- SHA1 36db1a9baec9e7d6d17073529afff9df063e68d9
- SHA512 2662a09e1cd148cbb4ee1124e4fdac6561699f447c986992651ff8fb8e7d005803b74ce5c1bb65c6f916ab1407894fabd453735c10378a94d5c918b1fe66688d
- MD5 SHA1 SHA512