General
- Target zpe-desktop-windows-installer.exe
- Size 12.7MB
- Sample260729-bl2pcadc96
- SHA256 ffda956b63a8bec81010f7a02ac4cbaa403b99a98ff80ed795f9929ac41829c6
Score
7/10
Malware Config
Targets
-
- Target zpe-desktop-windows-installer.exe
- Size 12.7MB
- SHA256 ffda956b63a8bec81010f7a02ac4cbaa403b99a98ff80ed795f9929ac41829c6
Score7/10-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
- Target $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 dd0d1a8c4511261333e90a94d9912000592c46731b615aa7a37cd2b3eb6a8d58
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
Score3/10 -
- Target $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 3a101fa91d4e8831dfb748a1e345ab74fd4a551e64254710bdf53972ba9b473c
Score3/10 -
- Target $PLUGINSDIR/webview2bootstrapper/MicrosoftEdgeWebview2Setup.exe
- Size 1.7MB
- SHA256 7ebc4ce80143ef89cea86a61ea151502868db6caaa678b8b43660a66ace11c3a
Score6/10-
Event Triggered Execution: Image File Execution Options Injection
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
- Target zpe-desktop.exe
- Size 30.6MB
- SHA256 a3363b0308ef2674ce09c6aba0c37a4821876937f0e93a4c63f45738c2e86c9f
Score6/10-
Checks whether UAC is enabled
-
Network Share Discovery
Attempt to gather information on host network.
MITRE ATT&CK Enterprise v16
Persistence
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1