General
- Target PulseSecureInstallerService.exe
- Size 4.9MB
- Sample261102-pej3lsvy5p
- SHA256 844237486a2191881bbb319759e7d0fbf46579b97a13e9c1e5cd6243b541b68b
Malware Config
Targets
-
- Target PulseSecureInstallerService.exe
- Size 4.9MB
- SHA256 844237486a2191881bbb319759e7d0fbf46579b97a13e9c1e5cd6243b541b68b
Score7/10-
Modifies file permissions
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
- Target $PLUGINSDIR/SimpleSC.dll
- Size 59KB
- SHA256 f41f1173b9d367bb6a085ff0b19d1273fc0b7dad32fedbb69b07240cfc9950c8
Score3/10 -
- Target $PLUGINSDIR/UserInfo.dll
- Size 4KB
- SHA256 11adf8916947b5a20a071b494fa034cf62769dcc6293a1340b29a5bb29ac8e87
Score3/10 -
- Target PulseSecureInstallerService.msi
- Size 4.9MB
- SHA256 fa7af9acdf6985bf8f4c42818f11c5c695f503af4d69928fa06c7778f1470031
Score7/10-
Modifies file permissions
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
- Target VerifyAndInstall.exe
- Size 181KB
- SHA256 0bda0b08b9d289dbf7272bd67ea5f3c6e5203c88b0806c540ba6485f8d7ddb9f
Score3/10 -
- Target dsInstallerClient.dll
- Size 269KB
- SHA256 8a1cca716f3ddb240ada4b83b17c6c89728679851aad8a173ef23c4c57042600
Score3/10 -
- Target dsIpc.dll
- Size 936KB
- SHA256 9d3041541fcd79d5df912971d12ff975466afde6c4f368b76802f170eaeba064
Score3/10 -
- Target dsLogService.dll
- Size 199KB
- SHA256 98cf69d7ca80336e67759f9c5404f1f06256fb3bbe616e7c32b5fbeabce9510a
Score3/10 -
- Target msvcp140.dll
- Size 443KB
- SHA256 d7446822c53cf6b9e31d5610d838ebf26ed08bf7497a3e022c47ff193ccde0be
Score3/10 -
- Target vcruntime140.dll
- Size 81KB
- SHA256 ad1b0992b890bfe88ef52d0a830873acc0aecc9bd6e4fc22397dbccf4d2b4e37
Score3/10
MITRE ATT&CK Enterprise v16
Persistence
Event Triggered Execution
2Component Object Model Hijacking
1Installer Packages
1Privilege Escalation
Event Triggered Execution
2Component Object Model Hijacking
1Installer Packages
1Defense Evasion
File and Directory Permissions Modification
1System Binary Proxy Execution
1Msiexec
1