Overview
overview
7Static
static
3Push Hack ...er.exe
windows10-2004-x64
7Push Hack ...er.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...up.exe
windows10-2004-x64
6$PLUGINSDI...up.exe
windows11-ltsc_2024-x64
6Push Hack ...er.exe
windows10-2004-x64
6Push Hack ...er.exe
windows11-ltsc_2024-x64
6Push Hack ...er.exe
windows10-2004-x64
7Push Hack ...er.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...up.exe
windows10-2004-x64
6$PLUGINSDI...up.exe
windows11-ltsc_2024-x64
6Push Hack ...er.exe
windows10-2004-x64
Push Hack ...er.exe
windows11-ltsc_2024-x64
Analysis
- max time kernel
150s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/10/2026, 01:00
Static task
static1
Behavioral task
behavioral1
Sample
Push Hack Installer-amd64-installer.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
Push Hack Installer-amd64-installer.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/webview2bootstrapper/MicrosoftEdgeWebview2Setup.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/webview2bootstrapper/MicrosoftEdgeWebview2Setup.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral9
Sample
Push Hack Installer.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral10
Sample
Push Hack Installer.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral11
Sample
Push Hack Installer-arm64-installer.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral12
Sample
Push Hack Installer-arm64-installer.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/webview2bootstrapper/MicrosoftEdgeWebview2Setup.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/webview2bootstrapper/MicrosoftEdgeWebview2Setup.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral19
Sample
Push Hack Installer.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral20
Sample
Push Hack Installer.exe
Resource
win11ltsc2024-20260911-en
General
- Target Push Hack Installer-amd64-installer.exe
- Size 12.0MB
- Sample261027-bc1exshw8s
- SHA256 5651a573fd41d20198b064649641ef607df552a471e93802604735febc22311d
- MD5 7bee1ed0a3f4952eef3a8b5d59d00f5e
- SHA1 70a5da87b8c33a8daa037be605709891216d978f
- SHA512 cec606151ed91ab96c565f9feb6d2567fb7f7362032598c9e151dabb0d18359c3a4a087cbba214db810d10b9a1d28bc3aae32cb61731a40b9562bea53a79a315
- SSDEEP 196608:j970yAyMGS9Y4J/l/G3pE48yEeAPsnv/uFNKaiL9tvYclIXPi1lIizSDTZh6nkLn:j2Ool/Ggdejv/uHKaWtPlIfi1lIizSDX
- TLSH T156C633FE8373AE78D868C5703E2871ACD5762CBE2ED41466310B27531F756FA8B92148
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
pid Process 5348 Push Hack Installer-amd64-installer.exe 5348 Push Hack Installer-amd64-installer.exe 5348 Push Hack Installer-amd64-installer.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\push-hack\Push Hack Installer\uninstall.exe Push Hack Installer-amd64-installer.exe File created C:\Program Files\push-hack\Push Hack Installer\Push Hack Installer.exe Push Hack Installer-amd64-installer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Push Hack Installer-amd64-installer.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\push-hack\Push Hack Installer\Push Hack Installer.exe
- Size 26.0MB
- SHA256 4928ee62a447e7831e1653121ee15a5933a3975d959067e5b270c75fad4d8427
- MD5 c5a29b2c864ea46c91a2c3aaf92fcb03
- SHA1 beda8a8af1da5dcf2ac102548b49d68cc0cd9edc
- SHA512 ea041574ee8b123af4fd584cbed0ba43861e5ad15d9408a1eff676be93d95b0ce8b82d813495d1bc79664e1e1f0ab034f75494537729e5664b041c809c170dda
- SSDEEP 196608:nyqo/drFW7/dHaTgD5EdlAciBvtF15ISFTV9ZzcDJsJUUaO:n5Udr0N2lwcKF15NFvNs2eO
- TLSH T142575A57FCA515E4C0AEC1348A629653BBB17C894B3123D32B50F6282F77BD0ADBA744
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsb6AE.tmp\InstallOptions.dll
- Size 15KB
- SHA256 a778d3d9855d5c28a0ffcbc7d21c33a99beef4bf9587a7d7a65c65745801a29c
- MD5 ca28ddf732c58331d10b840600b2e519
- SHA1 e18db6b0e858b2f3e6d1cb89df1ed973710f1f34
- SHA512 2d833fc745e8d7036a2ca500bc0a8274e61338382c4437700510b0361661202fdba36c1ade6fef7591ca4b591568cebbccdcb03830e32b00364eb3705d35420e
- SSDEEP 192:EMGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTT611929WtshLAzgSrX8:EMNt+4t7uJalUnGesY7Lt8nCT6/Yosa
- TLSH T102624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E4638565846D78311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsb6AE.tmp\System.dll
- Size 12KB
- SHA256 afe032f942e2ed0bf7494ec08ba813f5739fb522c640bde81d30ecaf9f894432
- MD5 564e01f2c6edfb8475573e1b809cb5eb
- SHA1 5d767e8f685449d86cd8d16c83a814ef8f7d6264
- SHA512 67486f8e996b29688cfb5a57ae4a7604fa0892ba0eeccdd55f514ca4bd9b79a6fe42bfab4fc85156c2258ae66539bdd9bb36a8b5f7f944f3007c2421f244c95c
- SSDEEP 192:rjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ80QPi:X/Qlt7wiij/lMRv/9V4b8r
- TLSH T1FD426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsb6AE.tmp\ioSpecial.ini
- Size 1KB
- SHA256 da00b80dfa57b093b16b4061d1c6c162c0e914a6b16ddb9dbf3e837c6e7e8da5
- MD5 4e1ee4a6ee254ab65e063cb21f735a07
- SHA1 c84ad86769b34e452c37bb2198dcd78332df8510
- SHA512 dbc6357293170f65d6604e929dea544f8ed4181781d9877d5a5fbae8030c1a8317b6a5fb6350b0e9ef786f2a2ad58933ad7fcd9fee0bbd9526def67efafb8aae
- TLSH T1D81181037EF95014E2BBBB58FFB5807947397852582DD90E91C10A0E48E5A808933BEB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsb6AE.tmp\ioSpecial.ini
- Size 1KB
- SHA256 ba6fe33d01f92184239f0422e123e0c0893d1371a5ae6c8168b4218994e67e9f
- MD5 360c99bb6ca10d82206b986395822f99
- SHA1 9aa7b8e73394819e23a660c37b90dd76149b56d0
- SHA512 461e3f9522a94afc4866bf00bd20952b2a3866c72efdc485d15b0199bc0a520a50848ad69af5c9862b0a8ecb6956fcb5a4f5ab749c1c3c19cf0b3ff63abc2f71
- TLSH T1F9115E137EF95018E2BBBB58FFF580755B397852582DD90E81C10A0F44E6A818973BEB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsb6AE.tmp\ioSpecial.ini
- Size 1KB
- SHA256 4371abadc1e4aa351bae26f08ec13169d98df6bc7c6541ecb9deeb0fce614c8b
- MD5 b0d71854169c33f2153d19e03bd87491
- SHA1 369f0a03de524ea72e514756a5c4e7fa6a84baa5
- SHA512 184587907e412122dd65c4c335ffa5141532b944defcdd9f98fd94d20120d838620e26c7a0ea9a9a0a859fd329c891d96379f0d958016481dd9cea59bf28eabe
- TLSH T17E319F437AF81514F2BBBB54FEB541798B3A7856A838DA0D51C00A0E08E5E408963BAB
- MD5 SHA1 SHA512 TLSH