{
  "family": "hidcon",
  "sample_count": 1,
  "category": "ransomware",
  "description": "HackTool:Win32/Hidcon (Hidden Console) designates utilities designed specifically to execute command-line tools, batch files, or scripts silently, without displaying a visible command prompt (`cmd.exe`) window to the logged-in user. While there are legitimate administrative uses for such tools, threat actors heavily abuse them to execute malicious PowerShell, VBScript, or batch payloads invisibly during post-exploitation (`T1564.003`).<br><br><b>Understanding Hidcon (Execution Evasion)</b><br>To an end-user, the execution is completely invisible—no flashing black boxes. For a SOC analyst, the presence of a Hidcon utility indicates an attacker is actively attempting to evade visual detection while running scripts. It is a 'living off the land' enabler, allowing attackers to use native system tools quietly.<br><br><b>Execution and Evasion Mechanics</b><br>Attackers often drop a small utility (like `hstart.exe` or a custom VBScript wrapper) alongside their primary malicious script. Instead of running `powershell.exe -ExecutionPolicy Bypass -File payload.ps1` directly (which might flash a window), they use the Hidcon tool to launch the script in a hidden, background session (`T1059.001`). This ensures the user does not get suspicious and interrupt the execution of the ransomware encryptor or data exfiltration script.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends on the script being executed invisibly. Host-based IoCs are centered around process command-line arguments. EDR solutions will log the execution of the Hidcon wrapper, and more importantly, the arguments passed to it (which reveal the true malicious script). Look for unexpected parent-child relationships where an unknown executable spawns `cmd.exe` or `powershell.exe` with arguments designed to hide the window (e.g., `-WindowStyle Hidden`).",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1564.003",
    "T1059.003",
    "T1059.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1564.003",
      "name": "Hide Artifacts: Hidden Window (The primary function of the tool)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1059.001",
      "name": "Command and Scripting Interpreter: PowerShell (Often the target of the hidden execution)",
      "tactic": "Execution"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell (Executing batch files silently)",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Analyze EDR logs to determine exactly which script or command the Hidcon tool was instructed to run.",
    "If the hidden script was malicious (e.g., a reverse shell or encryptor), isolate the machine immediately.",
    "Search the network for the specific script that was executed to identify the scope of the lateral movement.",
    "Implement Application Control (AppLocker) to block the execution of known third-party hidden console utilities."
  ],
  "what_to_avoid": [
    "Do not ignore the alert just because the Hidcon tool itself isn't a virus; the script it executed almost certainly is.",
    "Avoid relying solely on user reports ('I saw a weird black box') to detect script execution, as Hidcon completely bypasses this."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}