Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Code Store Database\Distribution Units\{8E375A63-C616-46F1-AC77-59DF78F3A826}\DownloadInformation] 'CODEBASE' = 'https://pulsesecure.net/dana-cached/sc/Pu...
- [<HKLM>\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{583C990C-2D38-410c-9A4A-0932D66A754F}\DownloadInformation] 'CODEBASE' = 'https://pulsesecure.net/dana-cached/sc/PulseSetupClie...
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Code Store Database\Distribution Units\{E5F5D008-DD2C-4D32-977D-1A0ADF03058B}\DownloadInformation] 'CODEBASE' = 'https://juniper.net/dana-cached/setup/Jun...
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\PulseSecureService] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\PulseSecureService] 'ImagePath' = '"%CommonProgramFiles(x86)%\Pulse Secure\JUNS\PulseSecureService.exe"'
- [<HKLM>\System\CurrentControlSet\Services\dsNcAdpt] 'ImagePath' = 'system32\DRIVERS\dsNcAdpt.sys'
Creates the following services
- 'PulseSecureService' "%CommonProgramFiles(x86)%\Pulse Secure\JUNS\PulseSecureService.exe"
- 'PulseSecureService' %CommonProgramFiles(x86)%\Pulse Secure\JUNS\PulseSecureService.exe
- 'dsNcAdpt' system32\DRIVERS\dsNcAdpt.sys
Modifies file system
Creates the following files
- %TEMP%\aut9b62.tmp
- %CommonProgramFiles(x86)%\pulse secure\juns\pulsesecureserviceps.dll
- %CommonProgramFiles(x86)%\pulse secure\juns\pulsesecureservice.exe
- %CommonProgramFiles(x86)%\pulse secure\juns\netmonitor.dll
- %CommonProgramFiles(x86)%\pulse secure\juns\messagecatalogcommon_zh-cn.txt
- %CommonProgramFiles(x86)%\pulse secure\juns\messagecatalogcommon_zh.txt
- %CommonProgramFiles(x86)%\pulse secure\juns\messagecatalogcommon_pl.txt
- %CommonProgramFiles(x86)%\pulse secure\juns\messagecatalogcommon_ko.txt
- %CommonProgramFiles(x86)%\pulse secure\juns\messagecatalogcommon_ja.txt
- %CommonProgramFiles(x86)%\pulse secure\juns\messagecatalogcommon_it.txt
- %CommonProgramFiles(x86)%\pulse secure\juns\messagecatalogcommon_fr.txt
- %CommonProgramFiles(x86)%\pulse secure\juns\messagecatalogcommon_es.txt
- %CommonProgramFiles(x86)%\pulse secure\juns\messagecatalogcommon_en.txt
- %CommonProgramFiles(x86)%\pulse secure\juns\messagecatalogcommon_de.txt
- %CommonProgramFiles(x86)%\pulse secure\juns\dslogservice.dll
- %CommonProgramFiles(x86)%\pulse secure\juns\dsipc.dll
- %CommonProgramFiles(x86)%\pulse secure\juns\dsinstallerserviceps.dll
- %CommonProgramFiles(x86)%\pulse secure\juns\dsinstallerservice.dll
- %CommonProgramFiles(x86)%\pulse secure\juns\accessmethodps.dll
- %TEMP%\psinstallerservice.log
- %TEMP%\nstbcd7.tmp\userinfo.dll
- %TEMP%\nstbcd7.tmp\simplesc.dll
- %TEMP%\pulsesecureinstallerservice.msi
- %TEMP%\verifyandinstall.exe
- %TEMP%\dsipc.dll
- %TEMP%\dsinstallerclientlegacy.dll
- %TEMP%\dsinstallerclient.dll
- %TEMP%\dslogservice.dll
- %CommonProgramFiles(x86)%\pulse secure\juns\pulsesecureserviceps64.dll
- %CommonProgramFiles(x86)%\pulse secure\juns\access.ini
- <SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
- %CommonProgramFiles(x86)%\pulse secure\juns\versioninfo.ini
- %TEMP%\{1c5fd6dd-f653-4633-9042-564991cbea2e}\set729a.tmp
- %TEMP%\{1c5fd6dd-f653-4633-9042-564991cbea2e}\set7122.tmp
- %TEMP%\{1c5fd6dd-f653-4633-9042-564991cbea2e}\set6f8b.tmp
- %TEMP%\dsncadpt.cat
- %TEMP%\dsncadpt.inf
- %TEMP%\dsncadpt.sys
- %TEMP%\dsncinst64.exe
- %ProgramFiles(x86)%\pulse secure\network connect 8.3\install.log
- %TEMP%\dsncadmin_inst.dll
- %TEMP%\nsz4b5a.tmp
- %WINDIR%\downloaded program files\string_zh_cn.properties
- %WINDIR%\downloaded program files\string_zh.properties
- %WINDIR%\downloaded program files\string_ko.properties
- %WINDIR%\downloaded program files\string_ja.properties
- %WINDIR%\downloaded program files\string_fr.properties
- %WINDIR%\downloaded program files\string_es.properties
- %WINDIR%\downloaded program files\string_en.properties
- %WINDIR%\downloaded program files\string_de.properties
- %WINDIR%\downloaded program files\junipersetup.ocx
- %WINDIR%\downloaded program files\junipersetup.inf
- %WINDIR%\downloaded program files\pulsesetupclientctrluninstaller64.exe
- %WINDIR%\downloaded program files\pulseext64.exe
- %WINDIR%\downloaded program files\pulsesetupclient64.ocx
- %TEMP%\nsa337d.tmp\system.dll
- %WINDIR%\downloaded program files\pulsesetupclient64.inf
- %CommonProgramFiles(x86)%\pulse secure\juns\accessrecovery.ini
- %PROGRAMDATA%\pulse secure\logging\debuglog.log
- %TEMP%\install.log
- %ProgramFiles(x86)%\pulse secure\installer service\versioninfo.ini
- %TEMP%\nscba07.tmp
- %APPDATA%\pulse secure\host checker\dsinstallerclient.dll
- %APPDATA%\pulse secure\host checker\dshostcheckerproxy.exe
- %APPDATA%\pulse secure\host checker\dshostchecker.exe
- %APPDATA%\pulse secure\host checker\dshostcheckerresource_zh_cn.dll
- %APPDATA%\pulse secure\host checker\dshostcheckerresource_zh.dll
- %APPDATA%\pulse secure\host checker\dshostcheckerresource_ko.dll
- %APPDATA%\pulse secure\host checker\dshostcheckerresource_ja.dll
- %APPDATA%\pulse secure\host checker\dshostcheckerresource_fr.dll
- %APPDATA%\pulse secure\host checker\dshostcheckerresource_es.dll
- %APPDATA%\pulse secure\host checker\dshostcheckerresource_de.dll
- %APPDATA%\pulse secure\host checker\dshostcheckerresource_en.dll
- %APPDATA%\pulse secure\host checker\dswinclientresource_zh_cn.dll
- %APPDATA%\pulse secure\host checker\dswinclientresource_zh.dll
- %APPDATA%\pulse secure\host checker\dswinclientresource_ko.dll
- %APPDATA%\pulse secure\host checker\dswinclientresource_ja.dll
- %APPDATA%\pulse secure\host checker\dswinclientresource_fr.dll
- %APPDATA%\pulse secure\host checker\dswinclientresource_es.dll
- %APPDATA%\pulse secure\host checker\dswinclientresource_de.dll
- %APPDATA%\pulse secure\host checker\dswinclientresource_en.dll
- %APPDATA%\pulse secure\host checker\ssleay32.dll
- %APPDATA%\pulse secure\host checker\libeay32.dll
- %APPDATA%\pulse secure\host checker\dsopenssl.dll
- %APPDATA%\pulse secure\host checker\salib_ossl.dll
- %APPDATA%\pulse secure\host checker\dswinclient.dll
- %APPDATA%\pulse secure\host checker\dsnsisdll.dll
- %APPDATA%\pulse secure\host checker\install.log
- %TEMP%\nsm9fa9.tmp\system.dll
- %TEMP%\standalonehttpnarinstall.exe
- %APPDATA%\pulse secure\host checker\epcheck.dll
- %APPDATA%\pulse secure\host checker\versioninfo.ini
- %TEMP%\autb5f3.tmp
- %APPDATA%\pulse secure\host checker\tnc_config
- %TEMP%\x86_microsoft.vc80.crtp_8.0.50727.762.exe
- %TEMP%\autb556.tmp
- %TEMP%\ncinst64.exe
- %TEMP%\autb370.tmp
- %TEMP%\ncinst.exe
- %TEMP%\autb18b.tmp
- %WINDIR%\downloaded program files\pulsesetupclientctrluninstaller.exe
- %WINDIR%\downloaded program files\pulseext.exe
- %WINDIR%\downloaded program files\pulsesetupclient.ocx
- %WINDIR%\downloaded program files\pulsesetupclient.inf
- %WINDIR%\downloaded program files\install.log
- %APPDATA%\pulse secure\host checker\pulsesetupclientocx.exe
- %APPDATA%\pulse secure\host checker\microsoft.vc80.crt\msvcp80.dll
- %APPDATA%\pulse secure\host checker\microsoft.vc80.crt\msvcr80.dll
- %APPDATA%\pulse secure\host checker\microsoft.vc80.crt\microsoft.vc80.crt.manifest
- %APPDATA%\microsoft\windows\start menu\programs\pulse secure\host checker\uninstall host checker.lnk
- %APPDATA%\pulse secure\host checker\uninstall.exe
- %APPDATA%\pulse secure\host checker\hcutils.dll
- %APPDATA%\pulse secure\host checker\advancedimc.dll
- %APPDATA%\pulse secure\host checker\sohimc.dll
- %APPDATA%\pulse secure\host checker\opswatimc.dll
- %APPDATA%\pulse secure\host checker\certauthimc.dll
- %APPDATA%\pulse secure\host checker\jsystemimc.dll
- %APPDATA%\pulse secure\host checker\hcimc.dll
- %APPDATA%\pulse secure\host checker\restore_win98.txt
- %APPDATA%\pulse secure\host checker\restore_win2k.txt
- %APPDATA%\pulse secure\host checker\msvcp60.dll
- %TEMP%\pulsesecureinstallerservice.exe
- %WINDIR%\temp\uddddf4.tmp
Sets the 'hidden' attribute to the following files
- <SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
Deletes the following files
- %TEMP%\aut9b62.tmp
- %TEMP%\{1c5fd6dd-f653-4633-9042-564991cbea2e}\dsncadpt.inf
- %TEMP%\{1c5fd6dd-f653-4633-9042-564991cbea2e}\dsncadpt.cat
- %TEMP%\nstbcd7.tmp\userinfo.dll
- %TEMP%\nstbcd7.tmp\simplesc.dll
- %TEMP%\verifyandinstall.exe
- %TEMP%\dsipc.dll
- %TEMP%\dslogservice.dll
- %TEMP%\{1c5fd6dd-f653-4633-9042-564991cbea2e}\dsncadpt.sys
- %TEMP%\dsinstallerclient.dll
- %WINDIR%\downloaded program files\pulseext.exe.old
- %WINDIR%\downloaded program files\pulsesetupclient.ocx.old
- %TEMP%\autb5f3.tmp
- %TEMP%\autb556.tmp
- %TEMP%\autb370.tmp
- %TEMP%\autb18b.tmp
- %TEMP%\nsm9fa9.tmp\system.dll
- %TEMP%\nsa337d.tmp\system.dll
- %WINDIR%\temp\uddddf4.tmp
Moves the following files
- from %WINDIR%\downloaded program files\pulsesetupclient.ocx to %WINDIR%\downloaded program files\pulsesetupclient.ocx.old
- from %WINDIR%\downloaded program files\pulseext.exe to %WINDIR%\downloaded program files\pulseext.exe.old
- from %TEMP%\{1c5fd6dd-f653-4633-9042-564991cbea2e}\set6f8b.tmp to %TEMP%\{1c5fd6dd-f653-4633-9042-564991cbea2e}\dsncadpt.cat
- from %TEMP%\{1c5fd6dd-f653-4633-9042-564991cbea2e}\set7122.tmp to %TEMP%\{1c5fd6dd-f653-4633-9042-564991cbea2e}\dsncadpt.inf
- from %TEMP%\{1c5fd6dd-f653-4633-9042-564991cbea2e}\set729a.tmp to %TEMP%\{1c5fd6dd-f653-4633-9042-564991cbea2e}\dsncadpt.sys
Substitutes the following files
- %WINDIR%\downloaded program files\pulsesetupclient.ocx
- %WINDIR%\downloaded program files\pulseext.exe
Miscellaneous
Searches for the following windows
- ClassName: 'BUTTON' WindowName: ''
- ClassName: 'Neoteris Setup Class' WindowName: ''
Creates and executes the following
- '%TEMP%\standalonehttpnarinstall.exe' -s
- '%APPDATA%\pulse secure\host checker\pulsesetupclientocx.exe'
- '%TEMP%\pulsesecureinstallerservice.exe' -s
- '%CommonProgramFiles(x86)%\pulse secure\juns\pulsesecureservice.exe'
- '%CommonProgramFiles(x86)%\pulse secure\juns\pulsesecureservice.exe' -start
- '%WINDIR%\installer\msi2e56.tmp' /S
- '%WINDIR%\installer\msi327d.tmp' /S
- '%WINDIR%\installer\msi38d7.tmp' /S
- '%TEMP%\ncinst64.exe' -s
- '%TEMP%\dsncinst64.exe' install
- '%WINDIR%\syswow64\cmd.exe' /c StandAloneHttpNarInstall.exe -s' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c PulseSecureInstallerService.exe -s' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c NCInst64.exe -s' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c StandAloneHttpNarInstall.exe -s
- '%WINDIR%\syswow64\cmd.exe' /c PulseSecureInstallerService.exe -s
- '%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\PulseSecureInstallerService.msi" /l*v "%TEMP%\PSInstallerService.log"
- '<SYSTEM32>\msiexec.exe' /Y "%CommonProgramFiles(x86)%\Pulse Secure\JUNS\PulseSecureServicePS64.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%WINDIR%\Downloaded Program Files\PulseSetupClient64.ocx"
- '%WINDIR%\syswow64\cmd.exe' /c NCInst64.exe -s
