e903972ad49cb6be91dbb51165073cea072ed47fb1180364b1049dc00d33cc75

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 23:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TeraCopy/安装.cmd
Size

72B
MD5

77868e47cc260d6b6b6b5d31e8aeeea1
SHA1

ea324b1b260f24854cef231a427db04fe0aba9f3
SHA256

ea99c05214cd7a4db2d64e2028454673140d88fe87ca427c7b1d6a5cf7ef7653
SHA512

becbb764b1c687d0e780606f3cf6b035ef690768a78bf88a37644bfe01f4b3e6ff48406a2fb5badaaaebf4bf9d6d7aae633f3efd0dfafe0539874cec50b29b66

Score

7^/10

persistence

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\TeraCopy	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\TeraCopy\ = "{A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}"	rundll32.exe

Registers COM server for autorun 1 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A7005AF0-D6E8-48AF-8DFA-023B1CF660A7}\InProcServer32\ThreadingModel = "Apartment"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}\InProcServer32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TeraCopy\\TeraCopyExt.dll"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}\InProcServer32\ThreadingModel = "Apartment"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A7005AF0-D6E8-48AF-8DFA-023B1CF660A7}\InProcServer32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A7005AF0-D6E8-48AF-8DFA-023B1CF660A7}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TeraCopy\\TeraCopy.dll"	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	rundll32.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.app.log	rundll32.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Modifies registry class 34 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A7005AF0-D6E8-48AF-8DFA-023B1CF660A7}\InProcServer32	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A7005AF0-D6E8-48AF-8DFA-023B1CF660A7}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A7005AF0-D6E8-48AF-8DFA-023B1CF660A7}\InProcServer32\ThreadingModel = "Apartment"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\DragDropHandlers\TeraCopy\ = "{A7005AF0-D6E8-48AF-8DFA-023B1CF660A7}"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\TeraCopy	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\TeraCopy\ = "{A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\TeraCopy	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\TeraCopy\ = "{A7005AF0-D6E8-48AF-8DFA-023B1CF660A7}"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\TeraCopy	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\shellex\ContextMenuHandlers\TeraCopy	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\TeraCopy	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}\InProcServer32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}\InProcServer32\ThreadingModel = "Apartment"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\DragDropHandlers	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TeraCopy\\TeraCopyExt.dll"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\TeraCopy\ = "{A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\TeraCopy	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\DragDropHandlers\TeraCopy\ = "{A7005AF0-D6E8-48AF-8DFA-023B1CF660A7}"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\TeraCopy	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A7005AF0-D6E8-48AF-8DFA-023B1CF660A7}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TeraCopy\\TeraCopy.dll"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\DragDropHandlers\TeraCopy	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\TeraCopy	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\TeraCopy\ = "{A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\TeraCopy\ = "{A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\ShellEx\ContextMenuHandlers\TeraCopy\ = "{A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\TeraCopy\ = "{A7005AF0-D6E8-48AF-8DFA-023B1CF660A7}"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\TeraCopy	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\TeraCopy	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\TeraCopy\ = "{A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\TeraCopy\ = "{A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}"	rundll32.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeRestorePrivilege	2412	rundll32.exe
Token: SeRestorePrivilege	2412	rundll32.exe
Token: SeRestorePrivilege	2412	rundll32.exe
Token: SeRestorePrivilege	2412	rundll32.exe
Token: SeRestorePrivilege	2412	rundll32.exe
Token: SeRestorePrivilege	2412	rundll32.exe
Token: SeRestorePrivilege	2412	rundll32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 2412	2456	cmd.exe	29
PID 2456 wrote to memory of 2412	2456	cmd.exe	29
PID 2456 wrote to memory of 2412	2456	cmd.exe	29
PID 2412 wrote to memory of 2260	2412	rundll32.exe	30
PID 2412 wrote to memory of 2260	2412	rundll32.exe	30
PID 2412 wrote to memory of 2260	2412	rundll32.exe	30
PID 2260 wrote to memory of 2840	2260	runonce.exe	31
PID 2260 wrote to memory of 2840	2260	runonce.exe	31
PID 2260 wrote to memory of 2840	2260	runonce.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\TeraCopy\安装.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Windows\system32\rundll32.exe
  rundll32 setupapi,InstallHinfSection DefaultInstall 132 .\Install.inf
  2⤵
  - Modifies system executable filetype association
  - Registers COM server for autorun
  - Adds Run key to start application
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2412
- - C:\Windows\system32\runonce.exe
    "C:\Windows\system32\runonce.exe" -r
    3⤵
    - Checks processor information in registry
    - Suspicious use of WriteProcessMemory
    PID:2260
  - - C:\Windows\System32\grpconv.exe
      "C:\Windows\System32\grpconv.exe" -o
      4⤵
      PID:2840