Adware.AdAgent.JC

The detection of Adware.AdAgent.JC on your system indicates the presence of a potentially unwanted program that may be causing disruptions to your online experience. This type of software is designed to display advertisements and collect user data, often without the user's knowledge or consent. In this report, we will provide an overview of Adware.AdAgent.JC, its operating methods, symptoms of infection, and steps to remove it from your system.

What Is Adware.AdAgent.JC?

Adware.AdAgent.JC is a type of adware program that is designed to display unwanted advertisements on a user's computer. The name itself does not indicate a specific malware family, but rather a detection category. Adware programs like Adware.AdAgent.JC can be bundled with free software downloads or installed through exploits in web browsers. Once installed, they can collect user data, such as browsing history and search queries, and use it to display targeted advertisements.

How Adware.AdAgent.JC Operates

Adware.AdAgent.JC operates by installing itself on a user's computer and then connecting to a remote server to download advertisements. These advertisements can take many forms, including pop-ups, banners, and sponsored search results. The program may also collect user data, such as browsing history and search queries, and use it to display targeted advertisements. In some cases, adware programs like Adware.AdAgent.JC can also install additional software or modify system settings to further compromise the user's experience.

Symptoms of Infection

Symptoms of Adware.AdAgent.JC infection can include an increase in unwanted advertisements, slow system performance, and changes to browser settings. Users may also notice that their search results are being redirected to unfamiliar websites or that their browser homepage has been changed. In some cases, adware programs like Adware.AdAgent.JC can also cause system crashes or freezes, particularly if they are consuming large amounts of system resources.

• Unwanted advertisements, such as pop-ups or banners
• Slow system performance or freezes
• Changes to browser settings, such as a new homepage or search engine
• Redirected search results or unfamiliar websites

How to Remove Adware.AdAgent.JC

1. Boot your computer in Safe Mode with Networking to prevent the adware program from loading
2. Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove any malicious software
3. Uninstall any suspicious programs or software that may be related to the adware infection
4. Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any changes made by the adware program
5. Reboot your computer and perform a follow-up scan to ensure that the adware program has been completely removed

Conclusion

Removing Adware.AdAgent.JC from your system requires a combination of technical knowledge and the right tools. By following the steps outlined in this report, you can help to ensure that your system is free from this potentially unwanted program and that your online experience is protected. It is also important to take steps to prevent future infections, such as avoiding suspicious downloads and keeping your operating system and software up to date. By staying vigilant and taking proactive measures, you can help to protect your system and your personal data from the threats posed by adware programs like Adware.AdAgent.JC.

Analysis Report

General information

Family Name:	Adware.AdAgent.JC
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 81f34ced60b7043fdbfb058a8c91e6de SHA1: 22f2893222e0a6df8e1b31dc19f41345eae393be SHA256: 03B4437B1B292EC152851F0EB35E5FAB34D0FEA7DF008A6AEDEF280F921E48B7 File Size: 3.00 MB, 3002368 bytes

MD5: 7141ad8e2c24843ba155b347f3b996ec SHA1: f0afeaaecdbf2dc4699e0248fc29f1fa721cc978 SHA256: 9724BDDBEC3C86832650687EDE3D9FFECD9A9FA4BEE64897E2B07B7228426A9A File Size: 2.39 MB, 2392064 bytes

MD5: 1fed374a6aa1f8a3e12d760e7416375b SHA1: 985532efa88ea14238948bb9d2e9fc6a210e8aef SHA256: FB975B1CB361C5D92EC46F515D4D3B43E0BB3685DE7E2731BD120E8864B9D490 File Size: 2.33 MB, 2326528 bytes

MD5: eb5dd64a862ae58b72eb0254bbc11a87 SHA1: 1991193961ef2610fd092c7e6adb944d9dc514dd SHA256: 203ED6A14CD7708C08EF34849D43195CF9E93D99DC0BD0F8006AEB8AEE8C614C File Size: 3.14 MB, 3141982 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have security information
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed

Show More

• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Company Name	Intel(R) Corporation Intel Corporation Intel® Corporation Microsoft
File Description	Installer Intel® Chipset Device Software installer
File Version	1.00 1, 2, 0, 7 1, 1, 47, 0 1, 1, 5, 0
Internal Name	Chipset MPGUtilities Win
Legal Copyright	Copyright (C) 2007-2010, Intel Corporation Copyright © 2006 Copyright © 2011
Legal Trademarks	Intel Corporation
Original Filename	Setup.exe Win.exe
Product Name	Intel(R) MPG Validation Utilities Installer Intel® Chipset Device Software Win
Product Version	1.00 1, 2, 0, 7 1, 1, 47, 0 1, 1, 5, 0

File Traits

• 2+ executable sections
• HighEntropy
• Installer Manifest
• Installer Version
• SusSec
• x86

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
\device\namedpipe\gmdasllogger	Generic Write,Read Attributes
c:\intel\logs\intelchipset.log	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\2008s4el.cat	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\2008s4el.cat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\2008s4el.cat	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\2008s4el.inf	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\2008s4el.inf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\2008s4el.inf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\5000xzvp.cat	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\5000xzvp.cat	Generic Write,Read Attributes

Show More

c:\users\user\appdata\local\temp\ipmx2\all\5000xzvp.cat	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\5000xzvp.inf	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\5000xzvp.inf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\5000xzvp.inf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\5400.cat	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\5400.cat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\5400.cat	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\5400.inf	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\5400.inf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\5400.inf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\852.cat	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\852.cat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\852.cat	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\852.inf	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\852.inf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\852.inf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\855.cat	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\855.cat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\855.cat	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\855.inf	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\855.inf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\855.inf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\865.cat	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\865.cat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\865.cat	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\865.inf	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\865.inf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\865.inf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\915.cat	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\915.cat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\915.cat	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\915.inf	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\915.inf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\915.inf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\915m.cat	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\915m.cat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\915m.cat	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\915m.inf	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\915m.inf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\915m.inf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\945.cat	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\945.cat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\945.cat	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\945.inf	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\945.inf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\945.inf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\945gm.cat	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\945gm.cat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\945gm.cat	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\945gm.inf	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\945gm.inf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\945gm.inf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\965g.cat	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\965g.cat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\965g.cat	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\965g.inf	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\965g.inf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\965g.inf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\965m.cat	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\965m.cat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\965m.cat	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\965m.inf	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\965m.inf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\965m.inf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\cdvcore.cat	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\cdvcore.cat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\cdvcore.cat	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\cdvcore.inf	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\cdvcore.inf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\cdvcore.inf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\cougahci.cat	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\cougahci.cat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\cougahci.cat	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\cougahci.inf	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\cougahci.inf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\cougahci.inf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\cougcore.cat	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\cougcore.cat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\cougcore.cat	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\cougcore.inf	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\cougcore.inf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\cougcore.inf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\coughaud.cat	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\coughaud.cat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\coughaud.cat	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\coughaud.inf	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\coughaud.inf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\coughaud.inf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\cougheci.cat	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\cougheci.cat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\cougheci.cat	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\cougheci.inf	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\cougheci.inf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\cougheci.inf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\cougide.cat	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\cougide.cat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\cougide.cat	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\cougide.inf	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\cougide.inf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\cougide.inf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\cougme.cat	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\cougme.cat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\cougme.cat	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\cougme.inf	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\cougme.inf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\cougme.inf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\cougsmb.cat	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\cougsmb.cat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\cougsmb.cat	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\cougsmb.inf	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\cougsmb.inf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\cougsmb.inf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\cougusb.cat	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\cougusb.cat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\cougusb.cat	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\cougusb.inf	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\cougusb.inf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\cougusb.inf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\couide2.cat	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\couide2.cat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\couide2.cat	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\couide2.inf	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\couide2.inf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\couide2.inf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\crestln.cat	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\crestln.cat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\crestln.cat	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\dh89xxcc-ahci.cat	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\dh89xxcc-ahci.cat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\dh89xxcc-ahci.cat	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\dh89xxcc-ahci.inf	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\dh89xxcc-ahci.inf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\dh89xxcc-ahci.inf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\dh89xxcc-cor.cat	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\dh89xxcc-cor.cat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\dh89xxcc-cor.cat	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\dh89xxcc-cor.inf	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\dh89xxcc-cor.inf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\dh89xxcc-cor.inf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\dh89xxcc-id2.cat	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\dh89xxcc-id2.cat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\dh89xxcc-id2.cat	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\dh89xxcc-id2.inf	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\dh89xxcc-id2.inf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\dh89xxcc-id2.inf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\dh89xxcc-ide.cat	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\dh89xxcc-ide.cat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\dh89xxcc-ide.cat	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\dh89xxcc-ide.inf	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\dh89xxcc-ide.inf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\dh89xxcc-ide.inf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\dh89xxcc-smb.cat	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\dh89xxcc-smb.cat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\dh89xxcc-smb.cat	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\dh89xxcc-smb.inf	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\dh89xxcc-smb.inf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\dh89xxcc-smb.inf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\dh89xxcc-usb.cat	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\dh89xxcc-usb.cat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\dh89xxcc-usb.cat	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\dh89xxcc-usb.inf	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\dh89xxcc-usb.inf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\dh89xxcc-usb.inf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\dmi_pci.cat	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\dmi_pci.cat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\dmi_pci.cat	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\dmi_pci.inf	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\dmi_pci.inf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\dmi_pci.inf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\e5100.cat	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\e5100.cat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\e5100.cat	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\e5100.inf	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\e5100.inf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\e5100.inf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\e7220.cat	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\e7220.cat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\e7220.cat	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\e7220.inf	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\e7220.inf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\e7220.inf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\e7230.cat	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\e7230.cat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\e7230.cat	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\e7230.inf	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\e7230.inf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\e7230.inf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ipmx2\all\e7300.cat	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ipmx2\all\e7300.cat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ipmx2\all\e7300.cat	Synchronize,Write Attributes

1111 additional files are not displayed above.

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKCU\software\microsoft\windows nt\currentversion\appcompatflags::{0783a2de-b4f4-46f7-b242-61fb12f8d07e}		RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	sk �8�jg�B �� �6 �v�� 7� �� �� ۀ ���T�B�������% ��Bx�< ���! #�� $kF $��%� &� &�-'�! (�(X�(� ) ; )E )�`*J*9 *�" ,=�-!R0P% 1`1�1HO5,]5�G>��@V�@�* A��B B��E�mF Fy�G�IH[u	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\explorer\advanced::hidden		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center::antivirusoverride		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center::antivirusdisablenotify		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center::firewalldisablenotify		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center::firewalloverride		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center::updatesdisablenotify		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center::uacdisablenotify		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center\svc::antivirusoverride		RegNtPreCreateKey

Show More

HKLM\software\wow6432node\microsoft\security center\svc::antivirusdisablenotify		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center\svc::firewalldisablenotify		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center\svc::firewalloverride		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center\svc::updatesdisablenotify		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center\svc::uacdisablenotify		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings::globaluseroffline		RegNtPreCreateKey
HKLM\software\microsoft\windows\currentversion\policies\system::enablelua		RegNtPreCreateKey
HKLM\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile::enablefirewall		RegNtPreCreateKey
HKLM\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile::donotallowexceptions		RegNtPreCreateKey
HKLM\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile::disablenotifications		RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Process Manipulation Evasion	NtUnmapViewOfSection
Process Shell Execute	CreateProcess
Service Control	OpenSCManager
Anti Debug	IsDebuggerPresent OutputDebugString
User Data Access	GetUserObjectInformation
Syscall Use	ntdll.dll!NtAddAtomEx ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtApphelpCacheControl ntdll.dll!NtClearEvent ntdll.dll!NtClose ntdll.dll!NtConnectPort ntdll.dll!NtCreateEvent ntdll.dll!NtCreateMutant ntdll.dll!NtCreateSection ntdll.dll!NtCreateSemaphore Show More ntdll.dll!NtCreateThreadEx ntdll.dll!NtDeviceIoControlFile ntdll.dll!NtEnumerateKey ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtMapViewOfSection ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenKeyEx ntdll.dll!NtOpenSection ntdll.dll!NtOpenSemaphore ntdll.dll!NtProtectVirtualMemory ntdll.dll!NtQueryAttributesFile ntdll.dll!NtQueryInformationFile ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationThread ntdll.dll!NtQueryInformationToken ntdll.dll!NtQueryKey ntdll.dll!NtQueryLicenseValue ntdll.dll!NtQueryPerformanceCounter ntdll.dll!NtQuerySecurityAttributesToken ntdll.dll!NtQuerySystemInformation ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryVolumeInformationFile ntdll.dll!NtQueryWnfStateData ntdll.dll!NtReleaseMutant ntdll.dll!NtReleaseSemaphore ntdll.dll!NtReleaseWorkerFactoryWorker ntdll.dll!NtRequestWaitReplyPort ntdll.dll!NtResumeThread ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationThread ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtSetValueKey ntdll.dll!NtSubscribeWnfStateChange ntdll.dll!NtTerminateProcess ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtUnmapViewOfSectionEx ntdll.dll!NtUpdateWnfStateData ntdll.dll!NtWaitForMultipleObjects ntdll.dll!NtWaitForSingleObject ntdll.dll!NtWaitForWorkViaWorkerFactory ntdll.dll!NtWaitLowEventPair ntdll.dll!NtWriteFile UNKNOWN
Other Suspicious	SetWindowsHookEx

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

C:\Users\Lekitjye\AppData\Local\Temp\IPMx2\setup.exe

C:\Users\Fghvxwyg\AppData\Local\Temp\IPMx2\setup.exe

C:\Users\Iwzlypxr\AppData\Local\Temp\IPMx2\setup.exe