PUP.Crack.BC

The detection of PUP.Crack.BC on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It's essential to understand the nature of this threat and take immediate action to remove it and prevent further damage.

What Is PUP.Crack.BC?

PUP.Crack.BC is a type of potentially unwanted program that may have been installed on your system without your knowledge or consent. PUPs are often bundled with other software or downloaded from untrusted sources, and they can cause a range of problems, including slowing down your computer, displaying unwanted ads, and potentially leading to more severe malware infections.

How PUP.Crack.BC Operates

PUP.Crack.BC, like other PUPs, operates by exploiting vulnerabilities in your system's security or by using social engineering tactics to trick you into installing it. Once installed, it may start to display unwanted ads, collect your personal data, or even install additional malware on your system. PUPs can also modify your system's settings, such as changing your default search engine or homepage, and may even interfere with your antivirus software's ability to detect and remove threats.

Symptoms of Infection

If your system is infected with PUP.Crack.BC, you may notice a range of symptoms, including slow system performance, unwanted ads or pop-ups, and changes to your system's settings. You may also notice that your antivirus software is unable to detect or remove the threat, or that your system is crashing or freezing frequently. Additionally, you may see suspicious programs or processes running in the background, or find unfamiliar icons or shortcuts on your desktop.

• Unwanted ads or pop-ups
• Slow system performance
• Changes to system settings
• Suspicious programs or processes
• Unfamiliar icons or shortcuts

How to Remove PUP.Crack.BC

To remove PUP.Crack.BC from your system, follow these steps:

1. Boot your system in Safe Mode with Networking to prevent the PUP from loading and to allow you to download and install removal tools.
2. Download and install a reputable anti-malware tool, such as SpyHunter, and run a full scan of your system to detect and remove the PUP and any associated malware.
3. Uninstall any suspicious programs or applications that may be associated with the PUP.
4. Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any changes made by the PUP.
5. Reboot your system and run another scan with your anti-malware tool to ensure that the PUP has been completely removed.

Conclusion

Removing PUP.Crack.BC from your system requires careful attention to detail and a thorough understanding of the threat. By following the steps outlined above and using reputable removal tools, you can effectively remove the PUP and prevent further damage to your system. It's also essential to take steps to prevent future infections, such as being cautious when downloading software, avoiding untrusted sources, and keeping your antivirus software up to date. By taking these precautions, you can help protect your system and your personal data from potentially unwanted programs like PUP.Crack.BC.

Analysis Report

General information

Family Name:	PUP.Crack.BC
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 24f910dee205820e79018dd323fa3703 SHA1: d28b211bc0c40e50fb81ec1f029efa710ce19fca File Size: 6.43 MB, 6431457 bytes

MD5: 32a31431dbfdceea6ae480baf5bd64ff SHA1: 12750e150e08096bdb651f5a56bfbd1fe6162cfa SHA256: D55A6ECEAECD63C84C880924C0F089EEF785E0FE6D6F77110775D7462CE8C745 File Size: 6.49 MB, 6485914 bytes

MD5: 99e7c9516544d039553a0a922f80426c SHA1: 515f82e92693ac379bfc18f89dfa7e83420e0cb0 SHA256: 2FBDD2E8E977BF4E83EA768563EFFC53A105C6A4B0BDC17C06CD63E9133F7335 File Size: 3.76 MB, 3763462 bytes

MD5: 47244c297d36e7db57dc493789127dfd SHA1: 930706b9743390c39c0f5fd6d7481b8aca5eb312 SHA256: BECEC89EFD1C49207EAB74BD56EFCD71E9BE1A7BE6CA5A0FCE74A8AD0197BA70 File Size: 5.78 MB, 5783973 bytes

MD5: d949bbe3e042906c1eea2793ec6e4ae2 SHA1: 28792a84e264bab5b15ade0957abc67363934ec4 SHA256: 8EABB9EE62AB60650D2A21D645034D021A14D8B91477894D648F3C19D3234473 File Size: 6.48 MB, 6480963 bytes

Show More

MD5: 4e8cd13141289525df81a2166350afc0 SHA1: ccfbc5c0250b8ad3ed7310d95fe4516107f2cd74 SHA256: 7BB8326604BE591A587B83FA12166D50BB2D419278843B5723A02C72602BB033 File Size: 3.76 MB, 3758338 bytes

MD5: 8be43019d9e025381fab03e17d8b89c7 SHA1: 47c20cc64a021f1aede01a8048a490b0cba8fef1 SHA256: B8B441E6BED5A4F10A6DB71E6F03699E0F0020D293015DEE98640008996F2B21 File Size: 6.10 MB, 6101627 bytes

MD5: 1174eb8e392f33fa68b6eb88aa09f470 SHA1: 30fce39cc6560901299f6ea1d9ec53785ea4cf5c SHA256: 9620A613F181485D2FF68ED9E375825CBE447882222B10F753ABAE24F9A0004F File Size: 14.34 KB, 14336 bytes

MD5: b57aba9d52777a81c3d26c126543c2e9 SHA1: caeee38d7f29011d39ba43f98247d037b19f767f SHA256: 1B3DDD0C56707A6F9F87273232D9A58D58526F4D66FD29DEAE462B99B553CC06 File Size: 6.38 MB, 6380559 bytes

MD5: 05c26554d40a292f1118d4b87510c9a4 SHA1: 3294c2fbd2ba40b62024e37ae7f0b692bfc51e55 SHA256: FD4B8F0AD90CF9B561936202F4CBBF3495B4ADE39F917FBCE45453866F36F986 File Size: 6.45 MB, 6449066 bytes

MD5: c1efa18aca77e70a064a73f86653944c SHA1: 525c0acb43303b3bc28606224f99000f2d4a6e4a SHA256: FAC563D8015C5519E31DB6B25E09A26FA0D1C34DB8178F1DC824C0AF76CEE121 File Size: 4.39 MB, 4391063 bytes

MD5: c981c9811ee23cb361eea06f33d6bf3b SHA1: a4ef18e14ca5233f32c4312136b8d59efe1eabdd SHA256: C7992E4BCE92496765ACF56E19FC55C026A775A0719E4B011C06A1C2F1876772 File Size: 6.44 MB, 6441367 bytes

MD5: 62a803008c1ae8aa5d843afa9fc0ae3d SHA1: 88116a0dc3b03e9abc151ef018e767d0564192b3 SHA256: 4BE6A4F70D504E37795FC952DA6A6E0ED29395BB72C04C6DFEC31EB55906EF86 File Size: 4.22 MB, 4217187 bytes

MD5: 1e9d8595fed3d67d982b5f309e610a95 SHA1: 457962c8c2e41f219285a44fe488e660e09c4646 SHA256: 213E0432606E57578A4991DC7F02D7A53D918FA7B582A14A38E4421BBB4D2F4E File Size: 3.75 MB, 3745963 bytes

MD5: 581182bc19e5ceb8d3dc147915d82409 SHA1: fa1cc59b2ff46ed0e64f242be960af70518007b6 SHA256: 3D123C63D4593E1AA774D94BC2114A139349F0FC1B405EDE827D8764C7FD7BB2 File Size: 4.19 MB, 4191671 bytes

MD5: f1be5c05823feab9c63458ef95cf1d0e SHA1: 8836cbb69094214f0f86d6900e196d0dd99aa43b SHA256: AD223BA751E04F07C19EBD3957F108887694004F9E964746B7C9790B9F8B07F9 File Size: 3.76 MB, 3760428 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have security information
• File has exports table
• File has TLS information
• File is 32-bit executable
• File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
• File is either console or GUI application

Show More

• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Comments	SolidShare.Net Unattended Installer This installation was built with Inno Setup.
Company Name	LR lrepacks.net Microsoft Microsoft Corporation SolidShare www.startisback.com
File Description	GDIEXT Client DLL SolidShare.Net Unattended Installer StartAllBack v3.9.2 StartAllBack v3.9.14 StartAllBack v3.9.15 StartAllBack v3.9.19 StartBack Setup
File Version	30.10.20.24 30.06.20.24 7.08.20.24 6.3.9600.17415 (winblue_r4.141028-1500) 3.9.19.0 3.9.15.0 3.9.14.0 3.9.2.0 1.00 1.0.127.0 Show More 1.0.125.0 1.0.117.3.0 1.0.115.1.0 1.0.96.0 1.0.93.0 1.0.55.0
Internal Name	gdiext Win
Legal Copyright	Copyright 2007-2022 LRepacks Copyright 2007-2024 LRepacks Copyright 2007-2025 LRepacks © 2024 By KiNGHaZe © Microsoft Corporation. All rights reserved. © www.startisback.com
Original Filename	gdiext Win.exe
Product Name	Microsoft® Windows® Operating System StartAllBack v3.9.2 StartAllBack v3.9.14 StartAllBack v3.9.15 StartAllBack v3.9.19 StartBack StartIsBack AIO Win
Product Version	30.10.20.24 30.06.20.24 7.08.20.24 6.3.9600.17415 1.00 1.0.127 1.0.125 1.0.117.3 1.0.115.1 1.0.96 Show More 1.0.93 1.0.55

File Traits

• 2+ executable sections
• dll
• WriteProcessMemory
• x86

Block Information

i

Block Information

During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.

Similar Families

i

Similar Families

This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.

• Chapak.U
• Crack.BC

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
c:\kinghaze	Synchronize,Write Attributes
c:\kinghaze\kur.exe	Generic Write,Read Attributes
c:\kinghaze\kur.exe	Synchronize,Write Attributes
c:\kinghaze\w10_1	Synchronize,Write Attributes
c:\kinghaze\w10_1\orbs	Synchronize,Write Attributes
c:\kinghaze\w10_1\orbs\shamrock.orb	Generic Write,Read Attributes
c:\kinghaze\w10_1\orbs\shamrock.orb	Synchronize,Write Attributes
c:\kinghaze\w10_1\orbs\start3.bmp	Generic Write,Read Attributes
c:\kinghaze\w10_1\orbs\start3.bmp	Synchronize,Write Attributes
c:\kinghaze\w10_1\orbs\startisback_ei8htorb_v2_by_painter.bmp	Generic Write,Read Attributes

Show More

c:\kinghaze\w10_1\orbs\startisback_ei8htorb_v2_by_painter.bmp	Synchronize,Write Attributes
c:\kinghaze\w10_1\orbs\windows 7.orb	Generic Write,Read Attributes
c:\kinghaze\w10_1\orbs\windows 7.orb	Synchronize,Write Attributes
c:\kinghaze\w10_1\startisback32.dll	Generic Write,Read Attributes
c:\kinghaze\w10_1\startisback32.dll	Synchronize,Write Attributes
c:\kinghaze\w10_1\startisback64.dll	Generic Write,Read Attributes
c:\kinghaze\w10_1\startisback64.dll	Synchronize,Write Attributes
c:\kinghaze\w10_1\startisbackcfg.exe	Generic Write,Read Attributes
c:\kinghaze\w10_1\startisbackcfg.exe	Synchronize,Write Attributes
c:\kinghaze\w10_1\startscreen.exe	Generic Write,Read Attributes
c:\kinghaze\w10_1\startscreen.exe	Synchronize,Write Attributes
c:\kinghaze\w10_1\styles	Synchronize,Write Attributes
c:\kinghaze\w10_1\styles\plain10.msstyles	Generic Write,Read Attributes
c:\kinghaze\w10_1\styles\plain10.msstyles	Synchronize,Write Attributes
c:\kinghaze\w10_1\styles\plain8.msstyles	Generic Write,Read Attributes
c:\kinghaze\w10_1\styles\plain8.msstyles	Synchronize,Write Attributes
c:\kinghaze\w10_1\styles\windows 7.msstyles	Generic Write,Read Attributes
c:\kinghaze\w10_1\styles\windows 7.msstyles	Synchronize,Write Attributes
c:\kinghaze\w10_1\updatecheck.exe	Generic Write,Read Attributes
c:\kinghaze\w10_1\updatecheck.exe	Synchronize,Write Attributes
c:\kinghaze\w10_2	Synchronize,Write Attributes
c:\kinghaze\w10_2\orbs	Synchronize,Write Attributes
c:\kinghaze\w10_2\orbs\shamrock.orb	Generic Write,Read Attributes
c:\kinghaze\w10_2\orbs\shamrock.orb	Synchronize,Write Attributes
c:\kinghaze\w10_2\orbs\startisback_ei8htorb_v2_by_painter.bmp	Generic Write,Read Attributes
c:\kinghaze\w10_2\orbs\startisback_ei8htorb_v2_by_painter.bmp	Synchronize,Write Attributes
c:\kinghaze\w10_2\orbs\windows 7.orb	Generic Write,Read Attributes
c:\kinghaze\w10_2\orbs\windows 7.orb	Synchronize,Write Attributes
c:\kinghaze\w10_2\startisback32.dll	Generic Write,Read Attributes
c:\kinghaze\w10_2\startisback32.dll	Synchronize,Write Attributes
c:\kinghaze\w10_2\startisback64.dll	Generic Write,Read Attributes
c:\kinghaze\w10_2\startisback64.dll	Synchronize,Write Attributes
c:\kinghaze\w10_2\startisbackcfg.exe	Generic Write,Read Attributes
c:\kinghaze\w10_2\startisbackcfg.exe	Synchronize,Write Attributes
c:\kinghaze\w10_2\startscreen.exe	Generic Write,Read Attributes
c:\kinghaze\w10_2\startscreen.exe	Synchronize,Write Attributes
c:\kinghaze\w10_2\styles	Synchronize,Write Attributes
c:\kinghaze\w10_2\styles\plain10.msstyles	Generic Write,Read Attributes
c:\kinghaze\w10_2\styles\plain10.msstyles	Synchronize,Write Attributes
c:\kinghaze\w10_2\styles\plain8.msstyles	Generic Write,Read Attributes
c:\kinghaze\w10_2\styles\plain8.msstyles	Synchronize,Write Attributes
c:\kinghaze\w10_2\styles\windows 7.msstyles	Generic Write,Read Attributes
c:\kinghaze\w10_2\styles\windows 7.msstyles	Synchronize,Write Attributes
c:\kinghaze\w10_2\updatecheck.exe	Generic Write,Read Attributes
c:\kinghaze\w10_2\updatecheck.exe	Synchronize,Write Attributes
c:\kinghaze\w11	Synchronize,Write Attributes
c:\kinghaze\w11\darkmagicloaderx64.exe	Generic Write,Read Attributes
c:\kinghaze\w11\darkmagicloaderx64.exe	Synchronize,Write Attributes
c:\kinghaze\w11\darkmagicloaderx86.exe	Generic Write,Read Attributes
c:\kinghaze\w11\darkmagicloaderx86.exe	Synchronize,Write Attributes
c:\kinghaze\w11\darkmagicx64.dll	Generic Write,Read Attributes
c:\kinghaze\w11\darkmagicx64.dll	Synchronize,Write Attributes
c:\kinghaze\w11\darkmagicx86.dll	Generic Write,Read Attributes
c:\kinghaze\w11\darkmagicx86.dll	Synchronize,Write Attributes
c:\kinghaze\w11\orbs	Synchronize,Write Attributes
c:\kinghaze\w11\orbs\clover.svg	Generic Write,Read Attributes
c:\kinghaze\w11\orbs\clover.svg	Synchronize,Write Attributes
c:\kinghaze\w11\orbs\e1evenorb-pr.png	Generic Write,Read Attributes
c:\kinghaze\w11\orbs\e1evenorb-pr.png	Synchronize,Write Attributes
c:\kinghaze\w11\orbs\w8logo.svg	Generic Write,Read Attributes
c:\kinghaze\w11\orbs\w8logo.svg	Synchronize,Write Attributes
c:\kinghaze\w11\orbs\windows 7.orb	Generic Write,Read Attributes
c:\kinghaze\w11\orbs\windows 7.orb	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-dark	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-dark\accessmedia.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-dark\accessmedia.svg	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-dark\easyaccess.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-dark\easyaccess.svg	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-dark\windows.addremoveprograms.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-dark\windows.addremoveprograms.svg	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-dark\windows.computer.manage.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-dark\windows.computer.manage.svg	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-dark\windows.copytomenu.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-dark\windows.copytomenu.svg	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-dark\windows.folderoptions.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-dark\windows.folderoptions.svg	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-dark\windows.help.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-dark\windows.help.svg	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-dark\windows.hideselected.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-dark\windows.hideselected.svg	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-dark\windows.layout.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-dark\windows.layout.svg	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-dark\windows.movetomenu.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-dark\windows.movetomenu.svg	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-dark\windows.multiverb.cmd.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-dark\windows.multiverb.cmd.svg	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-dark\windows.multiverb.cmdpromptasadministrator.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-dark\windows.multiverb.cmdpromptasadministrator.svg	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-dark\windows.open.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-dark\windows.open.svg	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-dark\windows.opencontrolpanel.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-dark\windows.opencontrolpanel.svg	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-dark\windows.pastelink.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-dark\windows.pastelink.svg	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-dark\windows.removeproperties.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-dark\windows.removeproperties.svg	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-dark\windows.ribbonpermissionsdialog.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-dark\windows.ribbonpermissionsdialog.svg	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-dark\windows.shareprivate.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-dark\windows.shareprivate.svg	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-dark\windows.slideshow.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-dark\windows.slideshow.svg	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-dark\windows.systemproperties.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-dark\windows.systemproperties.svg	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-dark\windows.troubleshoot.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-dark\windows.troubleshoot.svg	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-light	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-light\accessmedia.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-light\accessmedia.svg	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-light\easyaccess.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-light\easyaccess.svg	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-light\windows.addremoveprograms.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-light\windows.addremoveprograms.svg	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-light\windows.computer.manage.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-light\windows.computer.manage.svg	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-light\windows.copytomenu.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-light\windows.copytomenu.svg	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-light\windows.edit.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-light\windows.edit.svg	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-light\windows.email.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-light\windows.email.svg	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-light\windows.folderoptions.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-light\windows.folderoptions.svg	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-light\windows.help.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-light\windows.help.svg	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-light\windows.hideselected.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-light\windows.hideselected.svg	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-light\windows.layout.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-light\windows.layout.svg	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-light\windows.movetomenu.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-light\windows.movetomenu.svg	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-light\windows.multiverb.cmd.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-light\windows.multiverb.cmd.svg	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-light\windows.multiverb.cmdpromptasadministrator.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-light\windows.multiverb.cmdpromptasadministrator.svg	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-light\windows.open.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-light\windows.open.svg	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-light\windows.opencontrolpanel.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-light\windows.opencontrolpanel.svg	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-light\windows.pastelink.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-light\windows.pastelink.svg	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-light\windows.removeproperties.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-light\windows.removeproperties.svg	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-light\windows.ribbonpermissionsdialog.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-light\windows.ribbonpermissionsdialog.svg	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-light\windows.shareprivate.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-light\windows.shareprivate.svg	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-light\windows.slideshow.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-light\windows.slideshow.svg	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-light\windows.systemproperties.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-light\windows.systemproperties.svg	Synchronize,Write Attributes
c:\kinghaze\w11\ribbon\theme-light\windows.troubleshoot.svg	Generic Write,Read Attributes
c:\kinghaze\w11\ribbon\theme-light\windows.troubleshoot.svg	Synchronize,Write Attributes
c:\kinghaze\w11\startallbacka64.dll	Generic Write,Read Attributes
c:\kinghaze\w11\startallbacka64.dll	Synchronize,Write Attributes
c:\kinghaze\w11\startallbackcfg.exe	Generic Write,Read Attributes
c:\kinghaze\w11\startallbackcfg.exe	Synchronize,Write Attributes
c:\kinghaze\w11\startallbackloaderx64.dll	Generic Write,Read Attributes
c:\kinghaze\w11\startallbackloaderx64.dll	Synchronize,Write Attributes
c:\kinghaze\w11\startallbackx64.dll	Generic Write,Read Attributes
c:\kinghaze\w11\startallbackx64.dll	Synchronize,Write Attributes
c:\kinghaze\w11\styles	Synchronize,Write Attributes
c:\kinghaze\w11\styles\plain8.msstyles	Generic Write,Read Attributes
c:\kinghaze\w11\styles\plain8.msstyles	Synchronize,Write Attributes
c:\kinghaze\w11\styles\windows 7.msstyles	Generic Write,Read Attributes
c:\kinghaze\w11\styles\windows 7.msstyles	Synchronize,Write Attributes
c:\kinghaze\w11\updatecheck.exe	Generic Write,Read Attributes
c:\kinghaze\w11\updatecheck.exe	Synchronize,Write Attributes
c:\kinghaze\w8	Synchronize,Write Attributes
c:\kinghaze\w81	Synchronize,Write Attributes
c:\kinghaze\w81\orbs	Synchronize,Write Attributes
c:\kinghaze\w81\orbs\shamrock_106.bmp	Generic Write,Read Attributes
c:\kinghaze\w81\orbs\shamrock_106.bmp	Synchronize,Write Attributes
c:\kinghaze\w81\orbs\shamrock_54.bmp	Generic Write,Read Attributes
c:\kinghaze\w81\orbs\shamrock_54.bmp	Synchronize,Write Attributes
c:\kinghaze\w81\orbs\shamrock_66.bmp	Generic Write,Read Attributes
c:\kinghaze\w81\orbs\shamrock_66.bmp	Synchronize,Write Attributes
c:\kinghaze\w81\orbs\shamrock_81.bmp	Generic Write,Read Attributes
c:\kinghaze\w81\orbs\shamrock_81.bmp	Synchronize,Write Attributes
c:\kinghaze\w81\orbs\start3.bmp	Generic Write,Read Attributes
c:\kinghaze\w81\orbs\start3.bmp	Synchronize,Write Attributes
c:\kinghaze\w81\orbs\startisback_ei8htorb_v2_by_painter.bmp	Generic Write,Read Attributes
c:\kinghaze\w81\orbs\startisback_ei8htorb_v2_by_painter.bmp	Synchronize,Write Attributes
c:\kinghaze\w81\orbs\win7_106.bmp	Generic Write,Read Attributes
c:\kinghaze\w81\orbs\win7_106.bmp	Synchronize,Write Attributes
c:\kinghaze\w81\orbs\win7_54.bmp	Generic Write,Read Attributes
c:\kinghaze\w81\orbs\win7_54.bmp	Synchronize,Write Attributes
c:\kinghaze\w81\orbs\win7_66.bmp	Generic Write,Read Attributes
c:\kinghaze\w81\orbs\win7_66.bmp	Synchronize,Write Attributes

94 additional files are not displayed above.

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect		RegNtPreCreateKey
HKCU\software\startisback::autoupdates		RegNtPreCreateKey
HKCU\software\startisback::welcomeshown		RegNtPreCreateKey
HKCU\software\startisback::noxamlprelaunch		RegNtPreCreateKey
HKCU\software\startisback::terminateonclose		RegNtPreCreateKey
HKCU\software\startisback::startisapps		RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe	ﺘ벿ǜ	RegNtPreCreateKey

Show More

HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475	闸 ȁ ਪˣ 鈯ˣ 遙̃ 豤̃ অˣ 炑̃龡^ 濖̃ 賬̃ 2獖}偫~엦1 ਷ˣ 邯̃ 뫯ʃd ᵂċᵆċeЂ엦1¶ iꙥž r֢	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475	�   xy * � /�� Y� d�kP~ � ��ރ �p$��^ �o � ee SVs}$kP~$��1B�� 7 � �� ﺃe"e�� � ��1-�� fe�� g �	RegNtPreCreateKey
HKCU\software\microsoft\ctf\msutb::left	ঔ	RegNtPreCreateKey
HKCU\software\microsoft\ctf\msutb::top		RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�m  �v��%� (�1�1HO@V�_�za$ b"h{b��P�������m�����$ წ���=�SB1_T�Vw��i���%����AE��D��&��$���L	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�m  �v��%� (�1�1HO@V�_�za$ b"he�v{b��P�������m�����$ წ���=�SB1_T�Vw��i���%����AE��D��&��$���L	RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Process Shell Execute	CreateProcess ShellExecuteEx
Anti Debug	IsDebuggerPresent NtQuerySystemInformation
User Data Access	GetComputerName GetUserName GetUserObjectInformation
Process Manipulation Evasion	NtUnmapViewOfSection
Other Suspicious	SetWindowsHookEx
Syscall Use	ntdll.dll!NtAccessCheck ntdll.dll!NtAlertThreadByThreadId ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtApphelpCacheControl ntdll.dll!NtClearEvent ntdll.dll!NtClose ntdll.dll!NtConnectPort ntdll.dll!NtCreateEvent ntdll.dll!NtCreateFile ntdll.dll!NtCreateMutant Show More ntdll.dll!NtCreateSection ntdll.dll!NtCreateSemaphore ntdll.dll!NtDuplicateObject ntdll.dll!NtDuplicateToken ntdll.dll!NtEnumerateValueKey ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtMapViewOfSection ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenKeyEx ntdll.dll!NtOpenProcessToken ntdll.dll!NtOpenProcessTokenEx ntdll.dll!NtOpenSection ntdll.dll!NtOpenSemaphore ntdll.dll!NtOpenThreadTokenEx ntdll.dll!NtProtectVirtualMemory ntdll.dll!NtQueryAttributesFile ntdll.dll!NtQueryDebugFilterState ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationThread ntdll.dll!NtQueryInformationToken ntdll.dll!NtQueryKey ntdll.dll!NtQueryPerformanceCounter ntdll.dll!NtQuerySecurityAttributesToken ntdll.dll!NtQuerySystemInformationEx ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryVolumeInformationFile ntdll.dll!NtQueryWnfStateData ntdll.dll!NtReadFile ntdll.dll!NtReleaseMutant ntdll.dll!NtReleaseSemaphore ntdll.dll!NtReleaseWorkerFactoryWorker ntdll.dll!NtRequestWaitReplyPort ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationFile ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtSubscribeWnfStateChange ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtUnmapViewOfSectionEx ntdll.dll!NtWaitForAlertByThreadId ntdll.dll!NtWaitForSingleObject ntdll.dll!NtWaitForWorkViaWorkerFactory ntdll.dll!NtWaitLowEventPair ntdll.dll!NtWorkerFactoryWorkerReady ntdll.dll!NtWriteFile UNKNOWN
Network Winsock2	WSAStartup
Network Winsock	gethostbyname gethostname

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

"C:\Users\Hvobdlub\AppData\Local\Temp\is-BNDT0.tmp\d28b211bc0c40e50fb81ec1f029efa710ce19fca_0006431457.tmp" /SL5="$301FA,6090101,64512,c:\users\user\downloads\d28b211bc0c40e50fb81ec1f029efa710ce19fca_0006431457"

"C:\Users\Tbvyajmk\AppData\Local\Temp\is-I28F7.tmp\12750e150e08096bdb651f5a56bfbd1fe6162cfa_0006485914.tmp" /SL5="$201F2,6144781,64512,c:\users\user\downloads\12750e150e08096bdb651f5a56bfbd1fe6162cfa_0006485914"

"C:\Users\Jfmyfhss\AppData\Local\Temp\is-S5F2Q.tmp\28792a84e264bab5b15ade0957abc67363934ec4_0006480963.tmp" /SL5="$1501E4,6139835,64512,c:\users\user\downloads\28792a84e264bab5b15ade0957abc67363934ec4_0006480963"

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\30fce39cc6560901299f6ea1d9ec53785ea4cf5c_0000014336.,LiQMAxHB

"C:\Users\Dumevbyv\AppData\Local\Temp\is-4NNK9.tmp\3294c2fbd2ba40b62024e37ae7f0b692bfc51e55_0006449066.tmp" /SL5="$F029C,6108001,64512,c:\users\user\downloads\3294c2fbd2ba40b62024e37ae7f0b692bfc51e55_0006449066"

Show More

(NULL) Kur.exe

C:\Kinghaze\W10_2\StartIsBackCfg.exe /install /elevated /silent

startscreen.exe /stop

taskkill.exe /F /IM startscreen*

"C:\Users\Jwzuznvy\AppData\Local\Temp\is-VVB91.tmp\a4ef18e14ca5233f32c4312136b8d59efe1eabdd_0006441367.tmp" /SL5="$40358,6100318,64512,c:\users\user\downloads\a4ef18e14ca5233f32c4312136b8d59efe1eabdd_0006441367"