Analysis
- max time kernel
149s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
27/10/2026, 04:48
General
- Target Pulse-Navisworks-Setup-v0.4.0.exe
- Size 25.7MB
- Sample261027-fe9tlabv5n
- SHA256 de0855780cb1ba65df5e2b1ea7b953254bb1f4ac407a6a99fabea7bcf18d3d8a
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Kills process with taskkill 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Pulse-Navisworks-Setup-v0.4.0.exe"C:\Users\Admin\AppData\Local\Temp\Pulse-Navisworks-Setup-v0.4.0.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-14JD607V1Q.tmp\Pulse-Navisworks-Setup-v0.4.0.tmp"C:\Users\Admin\AppData\Local\Temp\is-14JD607V1Q.tmp\Pulse-Navisworks-Setup-v0.4.0.tmp" /SL5="$60266,25712606,868352,C:\Users\Admin\AppData\Local\Temp\Pulse-Navisworks-Setup-v0.4.0.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /C taskkill /F /T /IM Pulse.Navisworks.Server.exe3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /T /IM Pulse.Navisworks.Server.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Roaming\.pulse\navisworks\install.ps1" -Silent3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\goils1fu\goils1fu.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7035.tmp" "c:\Users\Admin\AppData\Local\Temp\goils1fu\CSC80E09E37152D42B0BF92683C39446436.TMP"5⤵
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RES7035.tmp
__PSScriptPolicyTest_u4bakwt0.jxq.ps1
goils1fu.dll
Pulse-Navisworks-Setup-v0.4.0.tmp
INSTALL_NO_NAVISWORKS.flag
install.ps1
ClaudeConfig.ps1
CodexConfig.ps1
GitInstall.ps1
McpClientDetect.ps1
McpJsonConfig.ps1
NavisDeploy.ps1
OpenCodeConfig.ps1
PulseLocale.ps1
is-0QJISXHRN5.tmp
is-1FKJ0972T2.tmp
is-27N9Z8WRO0.tmp
is-4HOI79T0EF.tmp
is-5R7L55NIF6.tmp
is-65NSBD03KS.tmp
is-BLXNT2UBQK.tmp
is-BOY1HBS0V5.tmp
is-D18UNJHPKB.tmp
is-K0VYHD1JPL.tmp
is-K3STKKT6VN.tmp
is-K4SURJJRM7.tmp
is-OONG7483TD.tmp
is-Q2ER0JMRU5.tmp
is-QD0JRQ8M8H.tmp
is-W9IYCA0DZ1.tmp
is-KVE5CTQ5SA.tmp
is-PMSOHXW20B.tmp
is-Q6MBBAGCFN.tmp
is-PDHUB2EXLO.tmp
is-62MXPID2A3.tmp
CSC80E09E37152D42B0BF92683C39446436.TMP
goils1fu.0.cs
goils1fu.cmdline
memory/464-9-0x0000000000FF0000-0x0000000000FF1000-memory.dmp
memory/464-1152-0x00000000009F0000-0x0000000000E2E000-memory.dmp
memory/464-8-0x00000000009F0000-0x0000000000E2E000-memory.dmp
memory/464-1154-0x00000000009F0000-0x0000000000E2E000-memory.dmp
memory/464-11-0x00000000009F0000-0x0000000000E2E000-memory.dmp
memory/464-5-0x0000000000FF0000-0x0000000000FF1000-memory.dmp
memory/3308-1120-0x00000200BFB60000-0x00000200BFB82000-memory.dmp
memory/3308-1146-0x00000200DA2F0000-0x00000200DA2F8000-memory.dmp
memory/3308-1150-0x00000200D9D40000-0x00000200D9F5C000-memory.dmp
memory/3308-1115-0x00000200BF5B0000-0x00000200BF5C0000-memory.dmp
memory/3308-1116-0x00000200BF5B0000-0x00000200BF5C0000-memory.dmp
memory/4088-7-0x00000000008F0000-0x00000000009D2000-memory.dmp
memory/4088-0-0x00000000008F0000-0x00000000009D2000-memory.dmp
memory/4088-1155-0x00000000008F0000-0x00000000009D2000-memory.dmp