General
- Target pushapp-ui-windows-latest.zip
- Size 7.6MB
- Sample261027-bchvwazzbw
- SHA256 fab589eeea3cb99d7c5d06f76087a9e2365eee8f186688e27d1d85925a530a5a
Score
7/10
Malware Config
Targets
-
- Target Push Tethered App-amd64_arm64-installer.exe
- Size 7.6MB
- SHA256 d9ec6186ba80cfffc65d57c90838fd2dd4b5da3467c1fa9b412c90fbe7986ac3
Score7/10-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
- Target $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 a778d3d9855d5c28a0ffcbc7d21c33a99beef4bf9587a7d7a65c65745801a29c
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 afe032f942e2ed0bf7494ec08ba813f5739fb522c640bde81d30ecaf9f894432
Score3/10 -
- Target $PLUGINSDIR/webview2bootstrapper/MicrosoftEdgeWebview2Setup.exe
- Size 1.7MB
- SHA256 7ebc4ce80143ef89cea86a61ea151502868db6caaa678b8b43660a66ace11c3a
Score6/10-
Event Triggered Execution: Image File Execution Options Injection
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
- Target Push Tethered App.exe
- Size 14.6MB
- SHA256 93ca0cd72ad20e0c5555cd9acd85a352ccc45ee0c8bc78471c3236bc2a6bbcdc
Score6/10-
Checks whether UAC is enabled
-
Network Share Discovery
Attempt to gather information on host network.
-
- Target libusb-1.0.dll
- Size 241KB
- SHA256 9858e2381221619e26a78a2824e5970c2a7ec48cdb75071c19eb7b61baa268e2
Score1/10
MITRE ATT&CK Enterprise v16
Persistence
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1