PUP.Advance System Care

The detection of PUP.Advance System Care on your system indicates the presence of a potentially unwanted program (PUP) that may be compromising your computer's performance and security. This type of malware is designed to deceive users into installing it, often by masquerading as a legitimate system optimization tool. It's essential to understand the nature of this threat and take immediate action to remove it from your system.

What Is PUP.Advance System Care?

PUP.Advance System Care is a type of potentially unwanted program that is typically installed on a user's system without their full knowledge or consent. It may be bundled with other software or downloaded from the internet, often through deceptive advertising or fake alerts. Once installed, it can cause a range of problems, including slowing down your system, displaying unwanted advertisements, and potentially stealing personal data.

How PUP.Advance System Care Operates

PUPs like PUP.Advance System Care often operate by manipulating system settings, creating fake system alerts, and generating misleading scan results to convince users that their system is infected or in need of optimization. They may also install additional malware or unwanted software, further compromising the system's security and performance. In some cases, PUPs can even sell user data to third-party companies, putting personal information at risk.

Symptoms of Infection

Systems infected with PUP.Advance System Care may exhibit a range of symptoms, including slow system performance, unwanted pop-ups and advertisements, and fake system alerts. Users may also notice unfamiliar programs or icons on their desktop, or experience unexpected changes to their system settings. In some cases, the PUP may even prevent users from installing legitimate security software or updating their operating system.

• Unwanted advertisements and pop-ups
• Slow system performance
• Fake system alerts and warnings
• Unfamiliar programs or icons on the desktop
• Changes to system settings

How to Remove PUP.Advance System Care

1. Boot your system in Safe Mode with Networking to prevent the PUP from loading
2. Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter
3. Uninstall any suspicious programs or software that may be related to the PUP
4. Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings
5. Reboot your system and perform a follow-up scan to ensure the PUP has been fully removed

Conclusion

Removing PUP.Advance System Care from your system is crucial to preventing further damage and protecting your personal data. By following the steps outlined above and using reputable security software, you can effectively remove this PUP and restore your system to a safe and secure state. It's also essential to be cautious when installing software and to always read user agreements carefully to avoid inadvertently installing PUPs in the future. By staying vigilant and taking proactive steps to protect your system, you can minimize the risk of infection and keep your personal data safe.

Analysis Report

General information

Family Name:	PUP.Advance System Care
Signature status:	Self Signed

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 7bc499c82eedaecad3d5b8ea2d382762 SHA1: 56354e644c5b126a92b3d031ffcf427bbf485406 SHA256: D0C58212890E9CC10EE6A42533CE67734F31B39B6C40C86EBD3075E8B7270146 File Size: 4.65 MB, 4652720 bytes

MD5: ffc5e75abb799772ff31bdb89b307825 SHA1: f488ba2fefa846ad06b1debcd75411b7ea06bc85 SHA256: 02F32FDA16669C93C8B0AC500E492ADF4E588866D40A5816A74C9E3785C2232B File Size: 5.87 MB, 5872064 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File has TLS information
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed

Show More

• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Comments	This installation was built with Inno Setup.
Company Name	AdvancedPasswordManager.com globalpcworks.com
File Description	Advanced Password Manager System Care
File Version	System Care Advanced Password Ma
Product Name	Advanced Password Manager System Care
Product Version	1.0.0.11457 1.0.0.6807

Digital Signatures

i

Digital Signatures

This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.

Signer	Root	Status
Advanced PC Tools	COMODO RSA Code Signing CA	Self Signed
PC Speedup Tools	COMODO RSA Code Signing CA	Self Signed

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
c:\users\user\appdata\local\temp\is-4p7rf.tmp\56354e644c5b126a92b3d031ffcf427bbf485406_0004652720.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-bd92d.tmp\_isetup\_setup64.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-bd92d.tmp\_isetup\_shfoldr.dll	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-bd92d.tmp\isxdl.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-dr218.tmp\f488ba2fefa846ad06b1debcd75411b7ea06bc85_0005872064.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-o3bg8.tmp\_isetup\_iscrypt.dll	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-o3bg8.tmp\_isetup\_setup64.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-o3bg8.tmp\_isetup\_shfoldr.dll	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-o3bg8.tmp\isxdl.dll	Generic Write,Read Attributes

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect		RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe	ﰰ䕱ǜ	RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe	璜ⲯ喰ǜ	RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Process Manipulation Evasion	NtUnmapViewOfSection
Process Shell Execute	CreateProcess ShellExecuteEx WriteConsole
Syscall Use	ntdll.dll!NtAccessCheck ntdll.dll!NtAlertThreadByThreadId ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtApphelpCacheControl ntdll.dll!NtClearEvent ntdll.dll!NtClose ntdll.dll!NtConnectPort ntdll.dll!NtCreateEvent ntdll.dll!NtCreateFile ntdll.dll!NtCreateMutant Show More ntdll.dll!NtCreateSection ntdll.dll!NtCreateSemaphore ntdll.dll!NtDuplicateObject ntdll.dll!NtDuplicateToken ntdll.dll!NtEnumerateValueKey ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtMapViewOfSection ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenKeyEx ntdll.dll!NtOpenProcessToken ntdll.dll!NtOpenProcessTokenEx ntdll.dll!NtOpenSection ntdll.dll!NtOpenSemaphore ntdll.dll!NtOpenThreadTokenEx ntdll.dll!NtProtectVirtualMemory ntdll.dll!NtQueryAttributesFile ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationThread ntdll.dll!NtQueryInformationToken ntdll.dll!NtQueryKey ntdll.dll!NtQueryPerformanceCounter ntdll.dll!NtQuerySecurityAttributesToken ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryVolumeInformationFile ntdll.dll!NtQueryWnfStateData ntdll.dll!NtReleaseMutant ntdll.dll!NtReleaseSemaphore ntdll.dll!NtReleaseWorkerFactoryWorker ntdll.dll!NtRequestWaitReplyPort ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtSubscribeWnfStateChange ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtUnmapViewOfSectionEx ntdll.dll!NtWaitForAlertByThreadId ntdll.dll!NtWaitForSingleObject ntdll.dll!NtWaitForWorkViaWorkerFactory ntdll.dll!NtWaitLowEventPair ntdll.dll!NtWorkerFactoryWorkerReady ntdll.dll!NtWriteFile UNKNOWN
Anti Debug	IsDebuggerPresent
User Data Access	GetUserObjectInformation
Other Suspicious	AdjustTokenPrivileges
Process Terminate	TerminateProcess

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

"C:\Users\Ytrateso\AppData\Local\Temp\is-4P7RF.tmp\56354e644c5b126a92b3d031ffcf427bbf485406_0004652720.tmp" /SL5="$301FE,4145773,148992,c:\users\user\downloads\56354e644c5b126a92b3d031ffcf427bbf485406_0004652720"

open taskkill.exe /f /im "gpcw.exe"

WriteConsole: ERROR: The proce

open taskkill.exe /f /im "GPCWValidatorService.exe"

open taskkill.exe /f /im "appmanager.exe"

Show More

"C:\Users\Ywdaqstw\AppData\Local\Temp\is-DR218.tmp\f488ba2fefa846ad06b1debcd75411b7ea06bc85_0005872064.tmp" /SL5="$70068,5330239,180224,c:\users\user\downloads\f488ba2fefa846ad06b1debcd75411b7ea06bc85_0005872064"

open schtasks.exe /delete /tn "Advanced Password Manager_launcher" /f

open taskkill.exe /f /im "apmui.exe"