Trojan.MulDrop11.16135

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8E375A63-C616-46F1-AC77-59DF78F3A826}\DownloadInformation] 'CODEBASE' = 'https://pulsesecure.net/dana-cached/sc/PulseSetupClie...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...

Creates the following services

[<HKLM>\System\CurrentControlSet\Services\dsNcAdpt] 'ImagePath' = 'system32\DRIVERS\dsNcAdpt.sys'

Modifies file system

Creates the following files

%TEMP%\aut1.tmp
<SYSTEM32>\dsncsmartcardprov.dll
<SYSTEM32>\dsnccredprov.dll
%ProgramFiles%\pulse secure\network connect 8.3\libeay32.dll
%ProgramFiles%\pulse secure\network connect 8.3\dsncsmartcardprov.dll
%ProgramFiles%\pulse secure\network connect 8.3\dsnccredprov.dll
%ProgramFiles%\pulse secure\network connect 8.3\uninstall.exe
%ProgramFiles%\pulse secure\network connect 8.3\nclauncher.exe
%ProgramFiles%\pulse secure\network connect 8.3\dsncginacompatible.txt
%ProgramFiles%\pulse secure\network connect 8.3\setproxy.html
%ProgramFiles%\pulse secure\network connect 8.3\versioninfo.ini
%ProgramFiles%\pulse secure\network connect 8.3\dsncdiag.dll
%ProgramFiles%\pulse secure\network connect 8.3\dsnetworkconnect.exe
%ProgramFiles%\pulse secure\network connect 8.3\dsncadmin.dll
<SYSTEM32>\dsginaloader.dll
<DRIVERS>\set16.tmp
%ProgramFiles%\pulse secure\network connect 8.3\dsncresource_en.dll
%WINDIR%\inf\oem0.pnf
%WINDIR%\inf\oem0.inf
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem0.cat
%TEMP%\dsncadpt.sys
%TEMP%\dsncadpt.cat
%TEMP%\dsncadpt.inf
%ALLUSERSPROFILE%\application data\pulse secure\logging\debuglog.log
%ProgramFiles%\pulse secure\network connect 8.3\install.log
%TEMP%\dsncadmin_inst.dll
%TEMP%\nsu13.tmp
%TEMP%\psinstallerservice.log
%TEMP%\nseb.tmp\userinfo.dll
%TEMP%\nseb.tmp\simplesc.dll
%ProgramFiles%\pulse secure\common files\dsncservice.exe
%WINDIR%\downloaded program files\pulsesetupclient.inf
%ProgramFiles%\pulse secure\network connect 8.3\dsncresource_de.dll
%ProgramFiles%\pulse secure\network connect 8.3\microsoft.vc80.atl\atl80.dll
%TEMP%\nsc1f.tmp\system.dll
%ProgramFiles%\pulse secure\common files\microsoft.vc80.crt\msvcp80.dll
%TEMP%\nsv1d.tmp\system.dll
%ProgramFiles%\pulse secure\common files\microsoft.vc80.crt\microsoft.vc80.crt.manifest
%ProgramFiles%\pulse secure\common files\microsoft.vc80.crt\msvcr80.dll
%TEMP%\nso1b.tmp\system.dll
%ProgramFiles%\pulse secure\network connect 8.3\microsoft.vc80.crt\msvcp80.dll
%TEMP%\nsb19.tmp\system.dll
%ProgramFiles%\pulse secure\network connect 8.3\microsoft.vc80.crt\microsoft.vc80.crt.manifest
%ProgramFiles%\pulse secure\network connect 8.3\microsoft.vc80.crt\msvcr80.dll
%ProgramFiles%\pulse secure\common files\x86_microsoft.vc80.atl_8.0.50727.762.exe
%ProgramFiles%\pulse secure\common files\x86_microsoft.vc80.crtp_8.0.50727.762.exe
%ProgramFiles%\pulse secure\common files\x86_microsoft.vc80.crtr_8.0.50727.762.exe
%TEMP%\pulsesecureinstallerservice.msi
%ProgramFiles%\pulse secure\network connect 8.3\dsncgina.dll
%APPDATA%\pulse secure\network connect 8.3\versioninfo.ini
%ProgramFiles%\pulse secure\network connect 8.3\dswinclientresource_zh_cn.dll
%ProgramFiles%\pulse secure\network connect 8.3\dswinclientresource_zh.dll
%ProgramFiles%\pulse secure\network connect 8.3\dswinclientresource_ja.dll
%ProgramFiles%\pulse secure\network connect 8.3\dswinclientresource_ko.dll
%ProgramFiles%\pulse secure\network connect 8.3\dswinclientresource_fr.dll
%ProgramFiles%\pulse secure\network connect 8.3\dswinclientresource_es.dll
%ProgramFiles%\pulse secure\network connect 8.3\dswinclientresource_en.dll
%ProgramFiles%\pulse secure\network connect 8.3\dswinclientresource_de.dll
%ProgramFiles%\pulse secure\network connect 8.3\dsncresource_zh_cn.dll
%ProgramFiles%\pulse secure\network connect 8.3\dsncresource_zh.dll
%ProgramFiles%\pulse secure\network connect 8.3\dsncresource_ko.dll
%ProgramFiles%\pulse secure\network connect 8.3\dsncresource_ja.dll
%ProgramFiles%\pulse secure\network connect 8.3\dsncresource_fr.dll
%ProgramFiles%\pulse secure\common files\libeay32.dll
%ProgramFiles%\pulse secure\network connect 8.3\dsncresource_es.dll
%TEMP%\verifyandinstall.exe
%TEMP%\dsipc.dll
%TEMP%\dsinstallerclientlegacy.dll
%APPDATA%\pulse secure\host checker\dswinclientresource_ko.dll
%APPDATA%\pulse secure\host checker\dsinstallerclient.dll
%APPDATA%\pulse secure\host checker\epcheck.dll
%APPDATA%\pulse secure\host checker\dshostcheckerproxy.exe
%APPDATA%\pulse secure\host checker\dshostchecker.exe
%APPDATA%\pulse secure\host checker\dshostcheckerresource_zh_cn.dll
%APPDATA%\pulse secure\host checker\dshostcheckerresource_zh.dll
%APPDATA%\pulse secure\host checker\dshostcheckerresource_ko.dll
%APPDATA%\pulse secure\host checker\dshostcheckerresource_ja.dll
%APPDATA%\pulse secure\host checker\dshostcheckerresource_fr.dll
%APPDATA%\pulse secure\host checker\dshostcheckerresource_es.dll
%APPDATA%\pulse secure\host checker\dshostcheckerresource_de.dll
%APPDATA%\pulse secure\host checker\dshostcheckerresource_en.dll
%APPDATA%\pulse secure\host checker\dswinclientresource_zh_cn.dll
%ProgramFiles%\pulse secure\network connect 8.3\microsoft.vc80.atl\microsoft.vc80.atl.manifest
%APPDATA%\pulse secure\host checker\tnc_config
%APPDATA%\pulse secure\host checker\dswinclientresource_ja.dll
%APPDATA%\pulse secure\host checker\dswinclientresource_fr.dll
%APPDATA%\pulse secure\host checker\dswinclientresource_es.dll
%APPDATA%\pulse secure\host checker\dswinclientresource_de.dll
%APPDATA%\pulse secure\host checker\dswinclientresource_en.dll
%APPDATA%\pulse secure\host checker\ssleay32.dll
%APPDATA%\pulse secure\host checker\libeay32.dll
%APPDATA%\pulse secure\host checker\dsopenssl.dll
%APPDATA%\pulse secure\host checker\salib_ossl.dll
%APPDATA%\pulse secure\host checker\dswinclient.dll
%APPDATA%\pulse secure\host checker\dsnsisdll.dll
%APPDATA%\pulse secure\host checker\install.log
%TEMP%\nso3.tmp\system.dll
%TEMP%\standalonehttpnarinstall.exe
%APPDATA%\pulse secure\host checker\dswinclientresource_zh.dll
%ProgramFiles%\pulse secure\common files\pulsesetupclientocx.exe
%APPDATA%\pulse secure\host checker\msvcp60.dll
%APPDATA%\pulse secure\host checker\hcimc.dll
%APPDATA%\pulse secure\host checker\restore_win2k.txt
%TEMP%\dsinstallerclient.dll
%TEMP%\dslogservice.dll
%TEMP%\install.log
%TEMP%\nsxa.tmp
%TEMP%\pulsesecureinstallerservice.exe
%TEMP%\aut8.tmp
%TEMP%\x86_microsoft.vc80.crtp_8.0.50727.762.exe
%TEMP%\aut7.tmp
%TEMP%\ncinst64.exe
%TEMP%\aut6.tmp
%TEMP%\ncinst.exe
%TEMP%\aut5.tmp
%WINDIR%\downloaded program files\pulsesetupclientctrluninstaller.exe
%APPDATA%\pulse secure\host checker\restore_win98.txt
%WINDIR%\downloaded program files\pulseext.exe
%APPDATA%\pulse secure\host checker\versioninfo.ini
%WINDIR%\downloaded program files\install.log
%APPDATA%\pulse secure\host checker\pulsesetupclientocx.exe
%APPDATA%\pulse secure\host checker\microsoft.vc80.crt\msvcp80.dll
%APPDATA%\pulse secure\host checker\microsoft.vc80.crt\msvcr80.dll
%APPDATA%\pulse secure\host checker\microsoft.vc80.crt\microsoft.vc80.crt.manifest
%HOMEPATH%\start menu\programs\pulse secure\host checker\uninstall host checker.lnk
%APPDATA%\pulse secure\host checker\uninstall.exe
%APPDATA%\pulse secure\host checker\hcutils.dll
%APPDATA%\pulse secure\host checker\advancedimc.dll
%APPDATA%\pulse secure\host checker\sohimc.dll
%APPDATA%\pulse secure\host checker\opswatimc.dll
%APPDATA%\pulse secure\host checker\certauthimc.dll
%APPDATA%\pulse secure\host checker\jsystemimc.dll
%WINDIR%\downloaded program files\pulsesetupclient.ocx
%TEMP%\nsv21.tmp\system.dll

Sets the 'hidden' attribute to the following files

<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem0.cat

Deletes the following files

%TEMP%\aut1.tmp
%TEMP%\dsncadpt.cat
%TEMP%\dsncadpt.sys
%TEMP%\nsv21.tmp\system.dll
%TEMP%\nsc1f.tmp\system.dll
%TEMP%\nsv1d.tmp\system.dll
%TEMP%\nso1b.tmp\system.dll
%TEMP%\nsb19.tmp\system.dll
%WINDIR%\downloaded program files\pulseext.exe.old
%WINDIR%\downloaded program files\pulsesetupclient.ocx.old
%TEMP%\nseb.tmp\userinfo.dll
%TEMP%\nseb.tmp\simplesc.dll
%TEMP%\verifyandinstall.exe
%TEMP%\dsipc.dll
%TEMP%\dslogservice.dll
%TEMP%\dsinstallerclient.dll
%TEMP%\pulsesecureinstallerservice.msi
%TEMP%\aut8.tmp
%TEMP%\aut7.tmp
%TEMP%\aut6.tmp
%TEMP%\aut5.tmp
%TEMP%\nso3.tmp\system.dll
%TEMP%\dsncadpt.inf
%TEMP%\dsncadmin_inst.dll

Moves the following files

from <DRIVERS>\set16.tmp to <DRIVERS>\dsncadpt.sys
from %WINDIR%\downloaded program files\pulsesetupclient.ocx to %WINDIR%\downloaded program files\pulsesetupclient.ocx.old
from %WINDIR%\downloaded program files\pulseext.exe to %WINDIR%\downloaded program files\pulseext.exe.old

Substitutes the following files

%WINDIR%\downloaded program files\pulsesetupclient.ocx
%WINDIR%\downloaded program files\pulseext.exe

Miscellaneous

Searches for the following windows

ClassName: 'BUTTON' WindowName: ''
ClassName: 'Neoteris Setup Class' WindowName: ''

Creates and executes the following

'%TEMP%\standalonehttpnarinstall.exe' -s
'%APPDATA%\pulse secure\host checker\pulsesetupclientocx.exe'
'%TEMP%\pulsesecureinstallerservice.exe' -s
'%TEMP%\ncinst.exe' -s
'%ProgramFiles%\pulse secure\common files\pulsesetupclientocx.exe'
'%ProgramFiles%\pulse secure\common files\x86_microsoft.vc80.crtr_8.0.50727.762.exe' %ProgramFiles%\Pulse Secure\Network Connect 8.3
'%TEMP%\x86_microsoft.vc80.crtp_8.0.50727.762.exe' %ProgramFiles%\Pulse Secure\Network Connect 8.3
'%ProgramFiles%\pulse secure\common files\x86_microsoft.vc80.crtr_8.0.50727.762.exe' %ProgramFiles%\Pulse Secure\Common Files
'%TEMP%\x86_microsoft.vc80.crtp_8.0.50727.762.exe' %ProgramFiles%\Pulse Secure\Common Files
'%ProgramFiles%\pulse secure\common files\x86_microsoft.vc80.atl_8.0.50727.762.exe' %ProgramFiles%\Pulse Secure\Network Connect 8.3
'%TEMP%\x86_microsoft.vc80.crtp_8.0.50727.762.exe'
'<SYSTEM32>\cmd.exe' /c StandAloneHttpNarInstall.exe -s' (with hidden window)
'<SYSTEM32>\cmd.exe' /c PulseSecureInstallerService.exe -s' (with hidden window)
'<SYSTEM32>\cmd.exe' /c NCInst.exe -s' (with hidden window)
'<SYSTEM32>\cmd.exe' /c x86_Microsoft.VC80.CRTP_8.0.50727.762.exe' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c StandAloneHttpNarInstall.exe -s
'<SYSTEM32>\cmd.exe' /c PulseSecureInstallerService.exe -s
'<SYSTEM32>\msiexec.exe' /i "%TEMP%\PulseSecureInstallerService.msi" /l*v "%TEMP%\PSInstallerService.log"
'<SYSTEM32>\cmd.exe' /c NCInst.exe -s
'<SYSTEM32>\runonce.exe' -r
'<SYSTEM32>\cmd.exe' /c x86_Microsoft.VC80.CRTP_8.0.50727.762.exe

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial