General
- Target zpe-desktop-windows-installer.exe
- Size 12.7MB
- Sample260728-rh17eahf77
- SHA256 4235f1f15db8e2a0e6813dcd62961fa37b23ef54d7ea7639c0234a404b9b16e1
Score
7/10
Malware Config
Targets
-
- Target zpe-desktop-windows-installer.exe
- Size 12.7MB
- SHA256 4235f1f15db8e2a0e6813dcd62961fa37b23ef54d7ea7639c0234a404b9b16e1
Score7/10-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
- Target $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 dd0d1a8c4511261333e90a94d9912000592c46731b615aa7a37cd2b3eb6a8d58
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
Score3/10 -
- Target $PLUGINSDIR/webview2bootstrapper/MicrosoftEdgeWebview2Setup.exe
- Size 1.7MB
- SHA256 7ebc4ce80143ef89cea86a61ea151502868db6caaa678b8b43660a66ace11c3a
Score6/10-
Event Triggered Execution: Image File Execution Options Injection
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
- Target zpe-desktop.exe
- Size 30.6MB
- SHA256 b7d715f92c32f6cb2dd41fdd47c9b47a370f8523c496eb0f808bcaa79ab7b093
Score6/10-
Checks whether UAC is enabled
-
Network Share Discovery
Attempt to gather information on host network.
MITRE ATT&CK Enterprise v16
Persistence
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1