PUP.InstallPack

The detection of PUP.InstallPack on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It is essential to understand the nature of this threat and take appropriate steps to remove it to prevent any potential harm.

What Is PUP.InstallPack?

PUP.InstallPack is a type of malware that is categorized as a potentially unwanted program. This means that while it may not be as malicious as other types of malware, such as viruses or Trojans, it can still cause problems with your system and compromise your privacy. PUPs are often installed unintentionally by users, usually as a result of downloading and installing software from untrusted sources or clicking on suspicious links.

How PUP.InstallPack Operates

PUP.InstallPack, like other PUPs, operates by installing itself on your system without your explicit consent. It may do this by bundling itself with other software or by exploiting vulnerabilities in your system. Once installed, it can start to display unwanted advertisements, collect your personal data, and even install additional malware on your system. PUPs can also slow down your system, cause crashes, and interfere with other programs.

Symptoms of Infection

If your system is infected with PUP.InstallPack, you may notice several symptoms. These can include an increase in unwanted pop-ups and advertisements, slow system performance, and unfamiliar programs or icons on your desktop. You may also notice that your browser settings have been changed, or that you are being redirected to suspicious websites. Additionally, you may see unfamiliar toolbars or extensions installed in your browser.

• Unwanted advertisements and pop-ups
• Slow system performance
• Unfamiliar programs or icons on your desktop
• Changed browser settings
• Redirects to suspicious websites
• Unfamiliar toolbars or extensions installed in your browser

How to Remove PUP.InstallPack

1. Boot your system in Safe Mode with Networking to prevent PUP.InstallPack from loading and to allow you to download and install removal tools.
2. Download and install a reputable anti-malware tool, such as SpyHunter, and perform a full scan of your system to detect and remove PUP.InstallPack and any other malware that may be present.
3. Uninstall any suspicious programs that you have installed recently, as these may be related to the PUP.
4. Reset your browser settings to their default values, including Chrome, Firefox, and Edge, to remove any unwanted changes made by the PUP.
5. Reboot your system and perform another scan with your anti-malware tool to ensure that PUP.InstallPack has been completely removed.

Conclusion

Removing PUP.InstallPack from your system is crucial to prevent any potential harm and to restore your system's performance and security. By following the steps outlined above, you can effectively remove this PUP and protect your system from similar threats in the future. It is also essential to practice safe computing habits, such as downloading software from trusted sources, avoiding suspicious links, and keeping your anti-malware tool up to date, to prevent infections like PUP.InstallPack from occurring in the first place.

Analysis Report

General information

Family Name:	PUP.InstallPack
Signature status:	Hash Mismatch

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: b2ba202717f0d5cffac3dfca20142490 SHA1: 5f2e1e722c7526b3be8f723098e249b4c104b490 SHA256: 68A099226C28C1BCE56E1A41C37202DA953A6D60DF99F6BB1C164514D4D9E266 File Size: 1.19 MB, 1194984 bytes

MD5: c999b59989edb49fed55411ccd42d1fa SHA1: d3bffaba3e17ac4dc215a4d0533deba0e97491df SHA256: E5B5C3937EDAA3AA7FBA4070119D59D4C23E7175E318A3F83700B8DE94024E26 File Size: 2.47 MB, 2466856 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)

Show More

• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Company Name	Oleg N. Scherbakov
File Description	7z Setup SFX (x86)
File Version	1.7.0.3900
Internal Name	7ZSfxMod
Legal Copyright	Copyright © 2005-2016 Oleg N. Scherbakov
Original Filename	7ZSfxMod_x86.exe
Private Build	April 1, 2016
Product Name	7-Zip SFX
Product Version	1.7.0.3900

Digital Signatures

i

Digital Signatures

This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.

Signer	Root	Status
IN SITE GROUP LLC	USERTrust RSA Certification Authority	Hash Mismatch
СЕРГЕЙ КУЦЕРЕЙ	СЕРГЕЙ КУЦЕРЕЙ	Self Signed

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.1.regtrans-ms	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.2.regtrans-ms	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ip\bin	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\bin\init.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\bin\init.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\bin\start.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\bin\start.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\bin\tools	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\bin\tools\wget.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\bin\tools\wget.exe	Synchronize,Write Attributes

Show More

c:\users\user\appdata\local\temp\ip\bin\unzip.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\bin\unzip.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\css	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\css\app-sprite-16.css	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\css\app-sprite-16.css	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\css\app-sprite.css	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\css\app-sprite.css	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\css\ie6.css	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\css\ie6.css	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\css\ie7.css	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\css\ie7.css	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\css\iepngfix.htc	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\css\iepngfix.htc	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\css\installpack.css	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\css\installpack.css	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\css\normalize.min.css	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\css\normalize.min.css	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\data	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\data\applications.json	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\data\applications.json	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\data\categories.json	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\data\categories.json	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\data\pages.json	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\data\pages.json	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\data\prechecks.json	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\data\prechecks.json	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\img	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\img\blank.gif	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\img\blank.gif	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\img\breadcrumb-bg-active.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\img\breadcrumb-bg-active.png	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\img\breadcrumb-bg-before-active.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\img\breadcrumb-bg-before-active.png	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\img\breadcrumb-bg.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\img\breadcrumb-bg.png	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\img\close.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\img\close.png	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\img\close_blue.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\img\close_blue.png	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\img\coin-green.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\img\coin-green.png	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\img\coin-red.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\img\coin-red.png	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\img\coin-yellow.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\img\coin-yellow.png	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\img\fail-checkbox.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\img\fail-checkbox.png	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\img\folder.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\img\folder.png	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\img\grey.gif	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\img\grey.gif	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\img\header_step1.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\img\header_step1.png	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\img\infinity-loader.gif	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\img\infinity-loader.gif	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\img\installpack.ico	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\img\installpack.ico	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\img\ip_logo.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\img\ip_logo.png	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\img\layout.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\img\layout.png	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\img\loader.gif	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\img\loader.gif	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\img\loading.gif	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\img\loading.gif	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\img\logo_small.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\img\logo_small.png	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\img\progressbar-bg-candy.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\img\progressbar-bg-candy.png	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\img\progressbar-bg.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\img\progressbar-bg.png	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\img\ready-checkbox.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\img\ready-checkbox.png	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\img\semiwhite.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\img\semiwhite.png	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\img\star-active.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\img\star-active.png	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\img\star.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\img\star.png	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\img\warning.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\img\warning.png	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\img\warning_small.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\img\warning_small.png	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\installpack.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\installpack.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\installpack.hta	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\installpack.hta	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\installpack.html	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\installpack.html	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\installpackinit.html	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\installpackinit.html	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\js\_analyticsinit.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\js\_analyticsinit.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\js\_antivirus.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\js\_antivirus.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\js\_config.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\js\_config.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\js\_configanalytics.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\js\_configanalytics.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\js\_customdata.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\js\_customdata.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\js\_customdatainit.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\js\_customdatainit.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\js\_executor.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\js\_executor.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\js\_launchescounter.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\js\_launchescounter.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\js\_log.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\js\_log.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\js\_offer_mult.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\js\_offer_mult.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\js\_offer_prices.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\js\_offer_prices.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\js\_queue.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\js\_queue.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\js\_registry.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\js\_registry.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\js\_system.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\js\_system.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\js\_updater.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\js\_updater.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\js\_wget.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\js\_wget.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\js\_wmi.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\js\_wmi.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\js\addlistener.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\js\addlistener.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\js\analytics.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\js\analytics.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\js\analytics_debug.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\js\analytics_debug.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\js\backend.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\js\backend.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\js\countly.min.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\js\countly.min.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\js\es5-sham.min.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\js\es5-sham.min.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\js\es5-shim.min.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\js\es5-shim.min.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\js\gotohtml.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\js\gotohtml.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\js\gotoinit.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\js\gotoinit.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\js\installpack.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\js\installpack.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\js\installpacksize.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\js\installpacksize.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\js\jquery-1.12.0.min.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\js\jquery-1.12.0.min.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\js\jquery.lazyload.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\js\jquery.lazyload.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\js\jquery.my.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\js\jquery.my.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\js\jquery.tpl.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\js\jquery.tpl.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\js\jquery.tpl.min.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\js\jquery.tpl.min.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\js\json2.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\js\json2.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\js\json2.min.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\js\json2.min.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\js\notie.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\js\notie.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\js\placeholder.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\js\placeholder.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\js\rotator.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\js\rotator.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\js\strings.min.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\js\strings.min.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\js\sugar.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\js\sugar.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\js\ua-parser.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\js\ua-parser.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\offers	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\offers\offers	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\offers\offers.json	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\offers\offers.json	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\offers\offers\360-total-security	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\offers\offers\360-total-security\360ts_offer.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\offers\offers\360-total-security\360ts_offer.png	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\offers\offers\360-total-security\index.html	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\offers\offers\360-total-security\index.html	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\offers\offers\360-total-security\script.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\offers\offers\360-total-security\script.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\offers\offers\360-total-security\split.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\offers\offers\360-total-security\split.png	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\offers\offers\avast	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ip\offers\offers\avast\avast-offer-2.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ip\offers\offers\avast\avast-offer-2.png	Synchronize,Write Attributes

106 additional files are not displayed above.

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKLM\software\wow6432node\installpack::launchescounter_v0.2	1	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect		RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�m & �v����#�� (�1�1HO@V�H[u_�zb"hi��k�qrnJu�~w�n{b��P���� ��7 �M�����������m�Ù��IV�gi ������$ �8წ���(! ��o��jA � �=�SB1_B��T�Vw�`�V ��%�������AE�Q]��D��&��$���L	RegNtPreCreateKey

Show More

HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�m ' �v����#�� (�1�1HO@V�H[u_�zb"he�vi��k�qrnJu�~w�n{b��P���� ��7 �M�����������m�Ù��IV�gi ������$ �8წ���(! ��o��jA � �=�SB1_B��T�Vw�`�V ��%�������AE�Q]��D��&��$���	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�m ) �v����#�� %� (�1�1HO@V�H[u_�za$ b"he�vi��k�qrnJu�~w�n{b��P���� ��7 �M�����������m�Ù��IV�gi ������$ �8წ���(! ��o��jA � �=�SB1_B��T�Vw�`�V �i���%�������AE�Q]��D��	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475	鴃 ȁ 獖}	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�m * �v ������#�� %� (�1�1HO@V�H[u_�za$ b"he�vi��k�qrnJu�~w�n{b��P���� ��7 �M�����������m�Ù��IV�gi ������$ �8წ���(! ��o��jA � �=�SB1_B��T�Vw�`�V �i���%�������AE�Q]��	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�m - �v ������#�� %� (�,=�1�1HO@V�H[uN�_�za$ b"he�vi��k�qrnJu�~w�ny�9{b��P���� ��7 �M�����������m�Ù��IV�gi ������$ �8წ���(! ��o��jA � �=�SB1_B��T�Vw�`�V �i���%�����	RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Network Wininet	HttpOpenRequest HttpQueryInfo HttpSendRequest InternetConnect InternetOpen InternetQueryOption InternetReadFile
Encryption Used	BCryptOpenAlgorithmProvider
Process Manipulation Evasion	NtUnmapViewOfSection
Process Shell Execute	ShellExecuteEx

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

(NULL) wscript.exe //E:jscript "C:\Users\Hdmvanag\AppData\Local\Temp\ip\bin\start.js" "C:\Users\Hdmvanag\AppData\Local\Temp\ip\InstallPack.exe" "C:\Users\Hdmvanag\AppData\Local\Temp\ip" "d3bffaba3e17ac4dc215a4d0533deba0e97491df_0002466856" "c:\users\user\downloads"