Analysis
- max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
11/10/2026, 12:18
General
- Target pulse-installer.exe
- Size 13.9MB
- Sample261011-pgvxwsas5m
- SHA256 66cfbb0aaf99a4856547cca14d817bedf2ae48f6d3ece72dde556f89c0cebb19
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Loads dropped DLL 21 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 14 IoCs
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Kills process with taskkill 4 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\pulse-installer.exe"C:\Users\Admin\AppData\Local\Temp\pulse-installer.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM PULSE.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM pulse.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM pulse-watchdog.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM pulse-elevated-helper.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Program Files\PULSE\" -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Remove-MpPreference -ExclusionPath \"C:\ProgramData\\com.pulse.app\" -ErrorAction SilentlyContinue; Remove-MpPreference -ExclusionPath \"C:\ProgramData\\Temp\\pulse_update\" -ErrorAction SilentlyContinue"2⤵
- Hide Artifacts: Ignore Process Interrupts
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" /v DisableAutoExclusions /t REG_DWORD /d 0 /f2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files\PULSE" /t REG_DWORD /d 0 /f2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files\PULSE\pulse.exe" /t REG_DWORD /d 0 /f2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /TN "PULSE_AdminLaunch" /TR ""C:\Program Files\PULSE\pulse.exe"" /SC ONLOGON /RL HIGHEST /IT /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /TN "PULSE_Watchdog" /TR ""C:\Program Files\PULSE\pulse-watchdog.exe"" /SC ONLOGON /IT /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "@(\"C:\Users\Public\Desktop\PULSE.lnk\", \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PULSE.lnk\", \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PULSE\PULSE.lnk\") | ForEach-Object { if (Test-Path -LiteralPath $_) { try { $b = [System.IO.File]::ReadAllBytes($_); $b[21] = $b[21] -bor 0x20; [System.IO.File]::WriteAllBytes($_, $b) } catch {} } }"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
pulse.exe
PULSE.lnk
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_0dgbo1ot.ebf.ps1
LangDLL.dll
System.dll
modern-wizard.bmp
nsDialogs.dll
nsExec.dll
nsis_tauri_utils.dll
memory/368-154-0x0000000006660000-0x00000000066AC000-memory.dmp
memory/368-152-0x0000000005C70000-0x0000000005FC4000-memory.dmp
memory/368-155-0x0000000006900000-0x0000000006922000-memory.dmp
memory/368-156-0x0000000007C40000-0x00000000081E4000-memory.dmp
memory/1644-37-0x00000000053B0000-0x0000000005416000-memory.dmp
memory/1644-50-0x000000006F910000-0x000000006F95C000-memory.dmp
memory/1644-60-0x0000000007390000-0x0000000007A0A000-memory.dmp
memory/1644-61-0x0000000006D50000-0x0000000006D6A000-memory.dmp
memory/1644-62-0x0000000006DB0000-0x0000000006DBA000-memory.dmp
memory/1644-63-0x0000000006FE0000-0x0000000007076000-memory.dmp
memory/1644-64-0x0000000006F50000-0x0000000006F61000-memory.dmp
memory/1644-65-0x0000000006F90000-0x0000000006F9E000-memory.dmp
memory/1644-66-0x0000000006FA0000-0x0000000006FB4000-memory.dmp
memory/1644-67-0x0000000007080000-0x000000000709A000-memory.dmp
memory/1644-68-0x0000000006FD0000-0x0000000006FD8000-memory.dmp
memory/1644-59-0x0000000006C10000-0x0000000006CB3000-memory.dmp
memory/1644-34-0x0000000002120000-0x0000000002156000-memory.dmp
memory/1644-58-0x0000000006BE0000-0x0000000006BFE000-memory.dmp
memory/1644-35-0x0000000004D10000-0x0000000005338000-memory.dmp
memory/1644-49-0x0000000005FF0000-0x0000000006022000-memory.dmp
memory/1644-48-0x0000000005A60000-0x0000000005AAC000-memory.dmp
memory/1644-47-0x0000000005A20000-0x0000000005A3E000-memory.dmp
memory/1644-46-0x0000000005490000-0x00000000057E4000-memory.dmp
memory/1644-38-0x0000000005420000-0x0000000005486000-memory.dmp
memory/1644-36-0x0000000004A80000-0x0000000004AA2000-memory.dmp
memory/2980-84-0x000000006F910000-0x000000006F95C000-memory.dmp
memory/2980-82-0x0000000005670000-0x00000000059C4000-memory.dmp