General
- Target pulse-installer.exe
- Size 13.9MB
- Sample260826-bj3tmaxxhs
- SHA256 66cfbb0aaf99a4856547cca14d817bedf2ae48f6d3ece72dde556f89c0cebb19
Malware Config
Targets
-
- Target pulse-installer.exe
- Size 13.9MB
- SHA256 66cfbb0aaf99a4856547cca14d817bedf2ae48f6d3ece72dde556f89c0cebb19
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
- Target $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 4cf25411f28f639f72156c24b0f66ea42f5aee5973f6c137d901da6ae42d5b7e
Score3/10 -
- Target $PLUGINSDIR/NSISdl.dll
- Size 15KB
- SHA256 ddf40229dd9d6b268902d8dea88c8a04aacf1af218dd29f6dcd35babc54ac08d
Score3/10 -
- Target $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
Score3/10 -
- Target $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
Score3/10 -
- Target $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
Score3/10 -
- Target $PLUGINSDIR/nsis_tauri_utils.dll
- Size 33KB
- SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
Score3/10 -
- Target THIRD_PARTY_FULL.html
- Size 346KB
- SHA256 fdcde38c08b4f4493ca9da7f161d022b78ddbc8032282e1247299fe5ac961f31
Score3/10 -
- Target amd-lever-probe.exe
- Size 447KB
- SHA256 156a1fc594d0d401b06924a419ff0e0eb914cd7e3f0196ba994154d780bcbe00
Score1/10 -
- Target app-knowledge-export.exe
- Size 5.4MB
- SHA256 093c4cfa423821efd53e0b04e18845f5301a2fc93206429f3622a5f4a91a308b
Score6/10-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Modifies boot configuration data using bcdedit
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
- Target pulse-elevated-helper.exe
- Size 451KB
- SHA256 89ef9b93167fbf96ca0f03c0fc0175b3498d2475e37c5a996d1c9b53eaca3915
Score1/10 -
- Target pulse-watchdog.exe
- Size 442KB
- SHA256 ba3b2a594aa2552f255b1ce5b02ddd687374306c9657ed06a38c6d6d6338d441
Score5/10-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
- Target pulse.exe
- Size 40.1MB
- SHA256 a9af8b7f30369172fbc68daab97ecac167917a4b77d2286872b7cad80623041d
Score6/10-
Checks whether UAC is enabled
-
Network Share Discovery
Attempt to gather information on host network.
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
3Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Event Triggered Execution
1Netsh Helper DLL
1Power Settings
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1