{
  "family": "ulise",
  "sample_count": 1176,
  "category": "adware",
  "description": "Trojan:Win32/Ulise is a generic detection for a family of stealthy trojans and malicious downloaders targeting Windows operating systems.<br><br><b>Understanding the Threat</b><br>To the average user, an Ulise infection is invisible until the system begins to significantly slow down or display unwanted pop-ups. For security analysts, Ulise acts as a primary staging payload. Its core objective is to silently breach the endpoint, establish a secure command-and-control (C2) channel, and deploy secondary, often more devastating, malware.<br><br><b>Execution and TTPs</b><br>Ulise is heavily distributed via malicious spam (malspam) campaigns containing weaponized Office documents or PDF attachments. Upon execution, it utilizes process hollowing and API hooking to inject its malicious code into legitimate Windows processes, such as <code>svchost.exe</code> or <code>explorer.exe</code>. This technique allows it to evade basic signature-based antivirus detection. Once persistence is established via the Registry, Ulise reaches out to attacker-controlled domains to download its secondary payload, which frequently includes ransomware (like Cryptolocker), banking trojans, or cryptocurrency miners.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters investigating Ulise should look for unexpected network connections originating from standard system processes, anomalous registry key creations in <code>HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run</code>, and the presence of obfuscated binary files dropped in the <code>%AppData%</code> or <code>%Temp%</code> directories.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1071.001",
    "T1566.001",
    "T1055.012",
    "T1059.003",
    "T1105"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1055.012",
      "name": "Process Injection: Process Hollowing",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Immediately sever the endpoint's network connection to halt the downloading of secondary payloads (like ransomware).",
    "Perform live memory forensics (using tools like Volatility) to identify and dump the injected code from hollowed processes.",
    "Identify and block the remote Command-and-Control (C2) IP addresses and domains at the perimeter firewall.",
    "Conduct a full threat hunt across the environment using the identified file hashes and network Indicators of Compromise (IoCs)."
  ],
  "what_to_avoid": [
    "Do not simply reboot the machine and assume it is clean; Ulise's registry modifications ensure it will survive a reboot.",
    "Do not connect external backup drives to the infected machine, as secondary payloads (like ransomware) may encrypt them."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}