PUP.ThePhoneSupport

The detection of PUP.ThePhoneSupport on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It is essential to understand the nature of this threat and take appropriate steps to remove it to prevent any potential harm.

What Is PUP.ThePhoneSupport?

PUP.ThePhoneSupport is a type of potentially unwanted program that may have been installed on your system without your knowledge or consent. PUPs are often bundled with other software or downloaded from the internet, and they can cause a range of problems, including slowing down your computer, displaying unwanted advertisements, and potentially compromising your personal data. PUPs can be difficult to remove, as they may have installed themselves in a way that makes them hard to detect and eliminate.

How PUP.ThePhoneSupport Operates

PUP.ThePhoneSupport, like other PUPs, operates by installing itself on your system and then executing its payload. This can include displaying unwanted advertisements, collecting your personal data, and potentially installing other malicious software. PUPs often use deceptive tactics to install themselves, such as bundling with other software or using fake updates to gain access to your system. Once installed, PUPs can be challenging to remove, as they may have created multiple entries in your system's registry and startup programs.

Symptoms of Infection

If your system is infected with PUP.ThePhoneSupport, you may experience a range of symptoms, including slow system performance, unwanted advertisements, and potentially even crashes or freezes. You may also notice that your browser settings have been changed, or that new toolbars or extensions have been installed without your consent. In some cases, PUPs can also cause problems with your system's security, making it more vulnerable to other types of malware and attacks.

• Unwanted advertisements or pop-ups
• Slow system performance
• Changed browser settings or new toolbars/extensions
• Crashes or freezes
• Potential security vulnerabilities

How to Remove PUP.ThePhoneSupport

1. Boot your system in Safe Mode with Networking to prevent PUP.ThePhoneSupport from loading and to allow for a more straightforward removal process.
2. Use a reputable anti-malware tool, such as SpyHunter, to perform a full scan of your system and detect any malicious files or programs associated with PUP.ThePhoneSupport.
3. Uninstall any suspicious programs or software that may be related to PUP.ThePhoneSupport, using the "Add/Remove Programs" or "Programs and Features" utility in your system's Control Panel.
4. Reset your web browsers, including Google Chrome, Mozilla Firefox, and Microsoft Edge, to their default settings to remove any changes made by PUP.ThePhoneSupport.
5. Reboot your system and perform another scan with your anti-malware tool to ensure that PUP.ThePhoneSupport has been completely removed.

Conclusion

Removing PUP.ThePhoneSupport from your system requires careful attention to detail and a thorough understanding of the steps involved. By following the guidance outlined above, you should be able to successfully remove this potentially unwanted program and restore your system to a safe and secure state. It is essential to remain vigilant and take steps to prevent future infections, such as keeping your operating system and software up to date, using reputable anti-malware tools, and being cautious when downloading software from the internet.

Analysis Report

General information

Family Name:	PUP.ThePhoneSupport
Signature status:	Self Signed

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: ef1bee5ac54e6fcfb526e73a43306a0b SHA1: bf13a6c450f481530927481db37a08215309f429 SHA256: 5C93312A371B7AAA8ACB5ED9EF9B5EEB97B650BECD3B69FB0E321297C62DD7F7 File Size: 4.31 MB, 4312592 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File has TLS information
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed

Show More

• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Comments	This installation was built with Inno Setup.
Company Name	Systweak Inc
File Description	RegClean Pro
File Version	RegClean Pro
Legal Copyright	© Systweak Inc
Product Name	RegClean-Pro
Product Version	6.21

Digital Signatures

i

Digital Signatures

This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.

Signer	Root	Status
The Phone Support Pvt. Ltd.	VeriSign Class 3 Code Signing 2010 CA	Self Signed

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
c:\users\user\appdata\local\temp\is-qic99.tmp\bf13a6c450f481530927481db37a08215309f429_0004312592.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-r6u25.tmp\_isetup\_iscrypt.dll	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-r6u25.tmp\_isetup\_setup64.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-r6u25.tmp\_isetup\_shfoldr.dll	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-r6u25.tmp\setup_en.bmp	Generic Write,Read Attributes

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKLM\software\classes\jscript::	JScript Language	RegNtPreCreateKey
HKLM\software\classes\jscript\clsid::	{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}	RegNtPreCreateKey
HKLM\software\classes\livescript::	JScript Language	RegNtPreCreateKey
HKLM\software\classes\livescript\clsid::	{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}	RegNtPreCreateKey
HKLM\software\classes\javascript::	JScript Language	RegNtPreCreateKey
HKLM\software\classes\javascript\clsid::	{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}	RegNtPreCreateKey
HKLM\software\classes\javascript1.1::	JScript Language	RegNtPreCreateKey
HKLM\software\classes\javascript1.1\clsid::	{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}	RegNtPreCreateKey
HKLM\software\classes\javascript1.2::	JScript Language	RegNtPreCreateKey
HKLM\software\classes\javascript1.2\clsid::	{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}	RegNtPreCreateKey

Show More

HKLM\software\classes\javascript1.3::	JScript Language	RegNtPreCreateKey
HKLM\software\classes\javascript1.3\clsid::	{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}	RegNtPreCreateKey
HKLM\software\classes\ecmascript::	JScript Language	RegNtPreCreateKey
HKLM\software\classes\ecmascript\clsid::	{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}	RegNtPreCreateKey
HKLM\software\classes\wow6432node\clsid\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}::	JScript Language	RegNtPreCreateKey
HKLM\software\classes\wow6432node\clsid\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\progid::	JScript	RegNtPreCreateKey
HKLM\software\classes\wow6432node\clsid\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\inprocserver32::	C:\WINDOWS\SysWow64\jscript.dll	RegNtPreCreateKey
HKLM\software\classes\wow6432node\clsid\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\inprocserver32::threadingmodel	Both	RegNtPreCreateKey
HKLM\software\classes\jscript author::	JScript Language Authoring	RegNtPreCreateKey
HKLM\software\classes\jscript author\clsid::	{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}	RegNtPreCreateKey
HKLM\software\classes\jscript.compact author::	JScript Language Authoring	RegNtPreCreateKey
HKLM\software\classes\jscript.compact author\clsid::	{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}	RegNtPreCreateKey
HKLM\software\classes\livescript author::	JScript Language Authoring	RegNtPreCreateKey
HKLM\software\classes\livescript author\clsid::	{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}	RegNtPreCreateKey
HKLM\software\classes\javascript author::	JScript Language Authoring	RegNtPreCreateKey
HKLM\software\classes\javascript author\clsid::	{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}	RegNtPreCreateKey
HKLM\software\classes\javascript1.1 author::	JScript Language Authoring	RegNtPreCreateKey
HKLM\software\classes\javascript1.1 author\clsid::	{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}	RegNtPreCreateKey
HKLM\software\classes\javascript1.2 authorjavascript1.3 author::	JScript Language Authoring	RegNtPreCreateKey
HKLM\software\classes\javascript1.2 authorjavascript1.3 author\clsid::	{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}	RegNtPreCreateKey
HKLM\software\classes\ecmascript author::	JScript Language Authoring	RegNtPreCreateKey
HKLM\software\classes\ecmascript author\clsid::	{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}	RegNtPreCreateKey
HKLM\software\classes\wow6432node\clsid\{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}::	JScript Language Authoring	RegNtPreCreateKey
HKLM\software\classes\wow6432node\clsid\{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}\progid::	JScript Author	RegNtPreCreateKey
HKLM\software\classes\wow6432node\clsid\{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}\inprocserver32::	C:\WINDOWS\SysWow64\jscript.dll	RegNtPreCreateKey
HKLM\software\classes\wow6432node\clsid\{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}\inprocserver32::threadingmodel	Both	RegNtPreCreateKey
HKLM\software\classes\jscript.encode::	JScript Language Encoding	RegNtPreCreateKey
HKLM\software\classes\jscript.encode\clsid::	{f414c262-6ac0-11cf-b6d1-00aa00bbbb58}	RegNtPreCreateKey
HKLM\software\classes\wow6432node\clsid\{f414c262-6ac0-11cf-b6d1-00aa00bbbb58}::	JScript Language Encoding	RegNtPreCreateKey
HKLM\software\classes\wow6432node\clsid\{f414c262-6ac0-11cf-b6d1-00aa00bbbb58}\progid::	JScript.Encode	RegNtPreCreateKey
HKLM\software\classes\wow6432node\clsid\{f414c262-6ac0-11cf-b6d1-00aa00bbbb58}\inprocserver32::	C:\WINDOWS\SysWow64\jscript.dll	RegNtPreCreateKey
HKLM\software\classes\wow6432node\clsid\{f414c262-6ac0-11cf-b6d1-00aa00bbbb58}\inprocserver32::threadingmodel	Both	RegNtPreCreateKey
HKLM\software\classes\jscript.compact::	JScript Compact Profile (ECMA 327)	RegNtPreCreateKey
HKLM\software\classes\jscript.compact\clsid::	{cc5bbec3-db4a-4bed-828d-08d78ee3e1ed}	RegNtPreCreateKey
HKLM\software\classes\wow6432node\clsid\{cc5bbec3-db4a-4bed-828d-08d78ee3e1ed}::	JScript Compact Profile (ECMA 327)	RegNtPreCreateKey
HKLM\software\classes\wow6432node\clsid\{cc5bbec3-db4a-4bed-828d-08d78ee3e1ed}\progid::	JScript.Compact	RegNtPreCreateKey
HKLM\software\classes\wow6432node\clsid\{cc5bbec3-db4a-4bed-828d-08d78ee3e1ed}\inprocserver32::	C:\WINDOWS\SysWow64\jscript.dll	RegNtPreCreateKey
HKLM\software\classes\wow6432node\clsid\{cc5bbec3-db4a-4bed-828d-08d78ee3e1ed}\inprocserver32::threadingmodel	Both	RegNtPreCreateKey
HKLM\software\wow6432node\systweak\regclean pro\version 6.1::telno	(800) 871-7918	RegNtPreCreateKey
HKLM\software\wow6432node\systweak\regclean pro\version 6.1::telnofr	+33 975 184 234	RegNtPreCreateKey
HKLM\software\wow6432node\systweak\regclean pro\version 6.1::utm_source	adppi15	RegNtPreCreateKey
HKLM\software\wow6432node\systweak\regclean pro\version 6.1::utm_campaign	adppi15	RegNtPreCreateKey
HKLM\software\wow6432node\systweak\regclean pro\version 6.1::utm_medium	newbuild	RegNtPreCreateKey
HKLM\software\wow6432node\systweak\regclean pro\version 6.1::rcpurl	http://www.systweak.com/registryCleaner/price/en?utm_source=adppi15&utm_campaign=adppi15&utm_medium=newbuild	RegNtPreCreateKey
HKLM\software\wow6432node\systweak\regclean pro\version 6.1::renewalurl	http://www.systweak.com/registrycleaner/renewal.asp?utm_source=adppi15&utm_campaign=adppi15&utm_medium=newbuild	RegNtPreCreateKey
HKCU\software\systweak\ssd::asobuildfor	adppi15	RegNtPreCreateKey
HKLM\software\wow6432node\systweak\ssd::asobuildfor	adppi15	RegNtPreCreateKey
HKCU\software\systweak\ssd::aso3cam	adppi15	RegNtPreCreateKey
HKLM\software\wow6432node\systweak\ssd::aso3cam	adppi15	RegNtPreCreateKey
HKCU\software\systweak\ssd::aso3affiliate		RegNtPreCreateKey
HKLM\software\wow6432node\systweak\ssd::aso3affiliate		RegNtPreCreateKey
HKLM\software\wow6432node\systweak\params::utm_source	adppi15	RegNtPreCreateKey
HKLM\software\wow6432node\systweak\params::utm_campaign	adppi15	RegNtPreCreateKey
HKLM\software\wow6432node\systweak\params::utm_medium	newbuild	RegNtPreCreateKey
HKLM\software\wow6432node\systweak\params::affiliateid		RegNtPreCreateKey
HKLM\software\wow6432node\systweak\params::delayasp		RegNtPreCreateKey
HKLM\software\wow6432node\systweak\params::nodockinaspuninstall		RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Process Manipulation Evasion	NtUnmapViewOfSection
Process Shell Execute	CreateProcess
User Data Access	GetUserObjectInformation
Keyboard Access	GetKeyState

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

"C:\Users\Neviakxk\AppData\Local\Temp\is-QIC99.tmp\bf13a6c450f481530927481db37a08215309f429_0004312592.tmp" /SL5="$1A019A,3792809,141312,c:\users\user\downloads\bf13a6c450f481530927481db37a08215309f429_0004312592"

"C:\WINDOWS\system32\regsvr32.exe" /s "C:\WINDOWS\system32\jscript.dll"