PUP.Ypack.C

The detection of PUP.Ypack.C on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It is essential to understand the nature of this threat and take immediate action to remove it to prevent further damage.

What Is PUP.Ypack.C?

PUP.Ypack.C is a type of potentially unwanted program that can be installed on your system without your knowledge or consent. These programs are often bundled with other software or downloaded from untrusted sources, and they can cause a range of problems, including slowing down your computer, displaying unwanted advertisements, and potentially compromising your personal data. PUPs like PUP.Ypack.C can be difficult to remove, as they often disguise themselves as legitimate programs or hide in the background, making them hard to detect.

How PUP.Ypack.C Operates

PUP.Ypack.C, like other PUPs, operates by installing itself on your system and then executing its payload, which can include a range of malicious activities. This can include displaying unwanted advertisements, collecting your personal data, and slowing down your computer's performance. PUPs can also install additional malware or create backdoors for other malicious programs to exploit. The exact behavior of PUP.Ypack.C may vary, but its primary goal is to generate revenue for its creators, often at the expense of your computer's security and performance.

Symptoms of Infection

If your system is infected with PUP.Ypack.C, you may notice a range of symptoms, including slow computer performance, unwanted advertisements or pop-ups, and suspicious programs or toolbars installed on your system. You may also notice that your browser settings have been changed, or that your search results are being redirected to unwanted websites. In some cases, PUPs can also cause system crashes or freezes, making it difficult to use your computer.

• Unwanted advertisements or pop-ups
• Suspicious programs or toolbars installed on your system
• Changed browser settings or search results
• Slow computer performance
• System crashes or freezes

How to Remove PUP.Ypack.C

1. Boot your computer in Safe Mode with Networking to prevent PUP.Ypack.C from loading and to allow you to remove it more easily.
2. Use a reputable anti-malware tool, such as SpyHunter, to perform a full scan of your system and detect any malicious programs or files associated with PUP.Ypack.C.
3. Uninstall any suspicious programs or applications that you do not recognize or that were installed without your knowledge or consent.
4. Reset your browser settings to their default values, including Chrome, Firefox, and Edge, to remove any changes made by PUP.Ypack.C.
5. Reboot your computer and perform another scan with your anti-malware tool to ensure that PUP.Ypack.C has been completely removed.

Conclusion

Removing PUP.Ypack.C from your system is essential to prevent further damage and protect your personal data. By following the steps outlined above, you can remove this potentially unwanted program and restore your computer's performance and security. It is also essential to be cautious when downloading software or clicking on links from untrusted sources, as these are common ways that PUPs like PUP.Ypack.C are spread. By being vigilant and taking the necessary precautions, you can help protect your computer and your personal data from these types of threats.

Analysis Report

General information

Family Name:	PUP.Ypack.C
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 4633a9ac9ffc8601960e87824b032e68 SHA1: d931c615abac1425a0ab323111d4a41fccca4f50 SHA256: 539397DC1F8F22E004D7DEF49054AC20AB78BC89FCB3964D74E2F8DAD48A37FB File Size: 3.91 MB, 3908183 bytes

MD5: 6c68e007f4a406e6d47f81b0486194b2 SHA1: 28bc2d5baa0208d258271f7f3ba09261e0998f45 SHA256: E93398686679CCBAF5EE2B9A94DBE884B0B374DE43A73A04396EB7909431DD4D File Size: 9.24 MB, 9240392 bytes

MD5: 08cac0c6c0d3b0bb277aafcb75838ef2 SHA1: 3ad8822e28cdbc52d4dd2f6cd808f928a09b202b SHA256: 757ED820324C0F3E19AD2944D8C74CFB91503A417A8425B09B8D1E9A46FDE5D2 File Size: 1.74 MB, 1736777 bytes

MD5: 618d3fa8db657dff47c884879deaf0a8 SHA1: becd447942cb6de98a85b7385dcc138ea8ee2ac7 SHA256: 726D18CC8053E71F8D75D5529E05477D00747576F43660996DECCCEE00FA8C7C File Size: 1.81 MB, 1809604 bytes

MD5: 82e55ce37cec7bc97bd61c442a3552ef SHA1: 81e672bd407d1aa2c983522ef5bb8f0f544a8251 SHA256: 5838F46BF6B8379028B7D1F8FCB40C56596F49C4C4B527C920116840CD44153E File Size: 9.08 MB, 9079808 bytes

Show More

MD5: 3c76907611900033eb14a4ff44678ffe SHA1: 6cc62486f43b4289d8843725e64bfddd39a1fd4c SHA256: 17DF166D2891B8137E409B587F83198FF242767D52EBF51C4716BA571ADF558C File Size: 1.74 MB, 1739024 bytes

MD5: ac4e4704590a564d7f7992c9b16f12e8 SHA1: b30b8c65c46d8d57213318d7d6ffe6f8083c88b3 SHA256: F4CA189C11C88CE9E7C028870AAEED2DC5A2BB0D2EBEB85FF55CDA97028E7DBB File Size: 1.95 MB, 1948625 bytes

MD5: 87cbdc4d4bab55722b89a9f28703b2c1 SHA1: c39f270f4eea5915c861dea3a38cc1e511589a27 SHA256: D36016821B7FCFD309D89AEFE861458B17BDDEC405C9A09E359CE7E1D5B2E748 File Size: 2.82 MB, 2819860 bytes

MD5: 1b6358f140907f087d414c1c24f3abb0 SHA1: 435f086896436b435aea43c7ba7462014dcae44e SHA256: 219884599971C01D8E761781E5BEA966D4A073623E5197776202EDCF640A1574 File Size: 3.53 MB, 3526059 bytes

MD5: 856e8886804424c0512fbdc4a6ac586c SHA1: 594e45353b6c76dcd4ee1c9b78862431c60156bd SHA256: F627266BE4737595100F81A4785A4D59AD60E8A7F0D36AD760BE819955DC8032 File Size: 4.40 MB, 4396593 bytes

MD5: 593033bc34081daf03d63afcbb347154 SHA1: 46f0f2463bbc36de8af7b0f3ce90d174a2c54b70 SHA256: 2793EF7BD48BF1427EE2AF872D7AE0466025B0A4CB5475974ECB2D9A19BAD0C2 File Size: 477.88 KB, 477881 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have security information
• File has exports table
• File has TLS information
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)

Show More

• File is Native application (NOT .NET application)
• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Comments	This installation was built with Inno Setup.
Company Name	Andrew Zhezherun CheMax Team Disc Soft Ltd DT Soft DTSoft Ltd DT Soft Ltd. Kuzyakov Artur WestByte
Company Website	http://windjview.sourceforge.net
File Description	CheMax Rus Setup DAEMON Tools Lite Setup Daemon Tools Pro Advanced v5.3.0.0359 Daemon Tools Pro Advanced v5.5.0.0387 DAEMON Tools Pro Setup library Download Master v5.16.6.1371 DriverPack Solution Packer WinDjView Setup Классические часы с облаками Setup
File Version	5.16.6.1371 5.5.0.0387 5.3.0.0359 4.49.1.0356.0 4.49.1.0356 2.0.2 0.4
Internal Name	DAEMON Tools Lite4.49.1.0356.exe DRPSuPacker DT Yandex Setup.exe SetupHlp.dll
Legal Copyright	Copyright (C) 2004-2012 Copyright (C) 2004-2012 Andrew Zhezherun Copyright (C) 2011 Copyright © 2001-2016 CheMax Team Copyright © 2014 Kuzyakov Artur © 2000-2013 Disc Soft Ltd. © DT Soft Ltd. © WestByte
Original Filename	DAEMON Tools Lite4.49.1.0356.exe DRPSuPacker.exe SetupHlp.dll
Private Build	Mar 4, 2014
Product Name	CheMax Rus DAEMON Tools Lite DAEMON Tools Pro Daemon Tools Pro Advanced v5.3.0.0359 Daemon Tools Pro Advanced v5.5.0.0387 DAEMON Tools Toolbar Download Master v5.16.6.1371 DriverPack Solution WinDjView Setup Классические часы с облаками
Product Version	4.49.1.0356.0 4.49.1.0356 2.0.2 0.4

Digital Signatures

i

Digital Signatures

This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.

Signer	Root	Status
Disc Soft Ltd	GlobalSign CodeSigning CA - G2	Self Signed
Top Page, LLC	thawte Primary Root CA	Root Not Trusted

File Traits

• HighEntropy
• Installer Version
• x86

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\dpinst.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\dpinst.xml	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\driverpacksetup.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\driverpacksetup.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\drp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\drp\0100_1043.2.15.75	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\drp\0100_1043.2.15.75\2ksetup.ini	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\drp\0100_1043.2.15.75\2ksetup.ini	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\drp\0100_1043.2.15.75\atk0100.cat	Generic Write,Read Attributes

Show More

c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\drp\0100_1043.2.15.75\atk0100.cat	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\drp\0100_1043.2.15.75\atk0100.inf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\drp\0100_1043.2.15.75\atk0100.inf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\drp\0100_1043.2.15.75\atk64amd.sys	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\drp\0100_1043.2.15.75\atk64amd.sys	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\drp\0100_1043.2.15.75\pnpinst64.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\drp\0100_1043.2.15.75\pnpinst64.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\drp\11.5.0.32	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\drp\11.5.0.32\netw2.inf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\drp\11.5.0.32\netw2.inf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\drp\11.5.0.32\netw2v32.cat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\drp\11.5.0.32\netw2v32.cat	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\drp\11.5.0.32\netw2v32.sys	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\drp\11.5.0.32\netw2v32.sys	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\drp\11.5.0.32\netw4c32.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\drp\11.5.0.32\netw4c32.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\drp\11.5.0.32\netw4r32.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\drp\11.5.0.32\netw4r32.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\drp\11.5.0.32\netw4v32.cat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\drp\11.5.0.32\netw4v32.cat	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\drp\11.5.0.32\netw4v32.inf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\drp\11.5.0.32\netw4v32.inf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\drp\11.5.0.32\netw4v32.sys	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\drp\11.5.0.32\netw4v32.sys	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\drp\media	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\drp\media\intel(r) display audio	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\drp\media\intel(r) display audio\intcdaud.cat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\drp\media\intel(r) display audio\intcdaud.cat	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\drp\media\intel(r) display audio\intcdaud.sys	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\drp\media\intel(r) display audio\intcdaud.sys	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\drp\media\intel(r) display audio\oem2.inf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\drp\media\intel(r) display audio\oem2.inf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\drp\media\intel(r) display audio\restore.ini	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\drp\media\intel(r) display audio\restore.ini	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\setup.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\setup.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\setup64.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\setup64.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\tools	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\tools\drvupdater.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\tools\drvupdater.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\tools\eula-ru-todo.txt	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\tools\eula-ru-todo.txt	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\tools\eula-ru.txt	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\tools\eula-ru.txt	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\tools\eula.txt	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\tools\eula.txt	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\tools\icon.ico	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\tools\icon.ico	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\tools\left.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\tools\left.bmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\tools\run.cmd	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\tools\run.cmd	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\tools\run.vbs	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\tools\run.vbs	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\tools\ya-downloader.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\7zipsfx.000\drpsupacker\tools\ya-downloader.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\is-45qj1.tmp\_isetup\_setup64.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-45qj1.tmp\_isetup\_shfoldr.dll	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-45qj1.tmp\ocsetuphlp.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-45tk0.tmp\driverpacksetup.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-7j15g.tmp\_isetup\_setup64.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-7j15g.tmp\_isetup\_shfoldr.dll	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-7j15g.tmp\ocsetuphlp.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-9bahp.tmp\28bc2d5baa0208d258271f7f3ba09261e0998f45_0009240392.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-ikgjt.tmp\_isetup\_setup64.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-ikgjt.tmp\_isetup\_shfoldr.dll	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-ikgjt.tmp\ocsetuphlp.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-j9hv8.tmp\driverpacksetup.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-u0vgs.tmp\_isetup\_setup64.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-u0vgs.tmp\_isetup\_shfoldr.dll	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-u0vgs.tmp\yandex_browser_setup.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-ur2as.tmp\driverpacksetup.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsb51de.tmp\aero.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsb51de.tmp\dtsoftbus01.inf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsb51de.tmp\en.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsb51de.tmp\modern-header.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsb51de.tmp\nsdialogs.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsb51de.tmp\ru.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsb51de.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsb51de.tmp\ua.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsj259b.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\nsl51cd.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\nsz25ac.tmp\1.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsz25ac.tmp\2.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsz25ac.tmp\3.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsz25ac.tmp\4.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsz25ac.tmp\aero.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsz25ac.tmp\modern-header.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsz25ac.tmp\nsdialogs.dll	Generic Write,Read Attributes

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect		RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Process Manipulation Evasion	NtUnmapViewOfSection
Process Shell Execute	CreateProcess ShellExecuteEx
User Data Access	GetUserObjectInformation
Keyboard Access	GetKeyState
Anti Debug	NtQuerySystemInformation
Syscall Use	ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtClose ntdll.dll!NtCreateFile ntdll.dll!NtCreateSection ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtMapViewOfSection ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenProcessToken ntdll.dll!NtQueryAttributesFile Show More ntdll.dll!NtQueryDebugFilterState ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationToken ntdll.dll!NtQuerySystemInformationEx ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryVolumeInformationFile ntdll.dll!NtReadFile ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationFile ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtWriteFile

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

"C:\Users\Gazioyzl\AppData\Local\Temp\is-9BAHP.tmp\28bc2d5baa0208d258271f7f3ba09261e0998f45_0009240392.tmp" /SL5="$D0160,8732161,114176,c:\users\user\downloads\28bc2d5baa0208d258271f7f3ba09261e0998f45_0009240392"

(NULL) C:\Users\Ywtdczav\AppData\Local\Temp\7ZipSfx.000\DRPSuPacker\DriverPackSetup.exe

"C:\Users\Ywtdczav\AppData\Local\Temp\is-J9HV8.tmp\DriverPackSetup.tmp" /SL5="$1202D2,960526,118784,C:\Users\Ywtdczav\AppData\Local\Temp\7ZipSfx.000\DRPSuPacker\DriverPackSetup.exe"

RunDll32.exe "C:\Users\Ywtdczav\AppData\Local\Temp\is-45QJ1.tmp\OCSetupHlp.dll",_OCPRD858OpenCandy2@16 7416

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\6cc62486f43b4289d8843725e64bfddd39a1fd4c_0001739024.,LiQMAxHB

Show More

(NULL) C:\Users\Vakuggpf\AppData\Local\Temp\7ZipSfx.000\DRPSuPacker\DriverPackSetup.exe

"C:\Users\Vakuggpf\AppData\Local\Temp\is-45TK0.tmp\DriverPackSetup.tmp" /SL5="$3031A,960526,118784,C:\Users\Vakuggpf\AppData\Local\Temp\7ZipSfx.000\DRPSuPacker\DriverPackSetup.exe"

RunDll32.exe "C:\Users\Vakuggpf\AppData\Local\Temp\is-IKGJT.tmp\OCSetupHlp.dll",_OCPRD858OpenCandy2@16 1932

(NULL) C:\Users\Uxdhbwmu\AppData\Local\Temp\7ZipSfx.000\DRPSuPacker\DriverPackSetup.exe

"C:\Users\Uxdhbwmu\AppData\Local\Temp\is-UR2AS.tmp\DriverPackSetup.tmp" /SL5="$100184,960526,118784,C:\Users\Uxdhbwmu\AppData\Local\Temp\7ZipSfx.000\DRPSuPacker\DriverPackSetup.exe"

RunDll32.exe "C:\Users\Uxdhbwmu\AppData\Local\Temp\is-7J15G.tmp\OCSetupHlp.dll",_OCPRD858OpenCandy2@16 2000