General
- Target pushapp-ui-windows-latest.zip
- Size 7.6MB
- Sample261027-bct8xaav9p
- SHA256 cd7d3df584d711c95e2af2741e877ddc418ef3817713ad2da079e0bf36057bec
Score
7/10
Malware Config
Targets
-
- Target Push Tethered App-amd64_arm64-installer.exe
- Size 7.6MB
- SHA256 2dcdfc469a0d92983dbffa2f9c0f3a61f4b37d021e46f68763e1a7f36d38627a
Score7/10Loads dropped DLL
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
- Target $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 a778d3d9855d5c28a0ffcbc7d21c33a99beef4bf9587a7d7a65c65745801a29c
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 afe032f942e2ed0bf7494ec08ba813f5739fb522c640bde81d30ecaf9f894432
Score3/10 -
- Target $PLUGINSDIR/webview2bootstrapper/MicrosoftEdgeWebview2Setup.exe
- Size 1.7MB
- SHA256 7ebc4ce80143ef89cea86a61ea151502868db6caaa678b8b43660a66ace11c3a
Score6/10Event Triggered Execution: Image File Execution Options Injection
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
- Target Push Tethered App.exe
- Size 14.5MB
- SHA256 2d8926f55d7615a821f56f31d4f6888968beccac621027286c6d45002c2bc0b4
Score6/10Checks whether UAC is enabled
Network Share Discovery
Attempt to gather information on host network.
-
- Target libusb-1.0.dll
- Size 241KB
- SHA256 9858e2381221619e26a78a2824e5970c2a7ec48cdb75071c19eb7b61baa268e2
Score1/10
MITRE ATT&CK Enterprise v16
Persistence
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1