e903972ad49cb6be91dbb51165073cea072ed47fb1180364b1049dc00d33cc75

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 23:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TeraCopy/安装.cmd
Size

72B
MD5

77868e47cc260d6b6b6b5d31e8aeeea1
SHA1

ea324b1b260f24854cef231a427db04fe0aba9f3
SHA256

ea99c05214cd7a4db2d64e2028454673140d88fe87ca427c7b1d6a5cf7ef7653
SHA512

becbb764b1c687d0e780606f3cf6b035ef690768a78bf88a37644bfe01f4b3e6ff48406a2fb5badaaaebf4bf9d6d7aae633f3efd0dfafe0539874cec50b29b66

Score

7^/10

persistence

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\TeraCopy	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\TeraCopy\ = "{A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}"	rundll32.exe

Registers COM server for autorun 1 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A7005AF0-D6E8-48AF-8DFA-023B1CF660A7}\InProcServer32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A7005AF0-D6E8-48AF-8DFA-023B1CF660A7}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TeraCopy\\TeraCopy.dll"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A7005AF0-D6E8-48AF-8DFA-023B1CF660A7}\InProcServer32\ThreadingModel = "Apartment"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}\InProcServer32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TeraCopy\\TeraCopyExt.dll"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}\InProcServer32\ThreadingModel = "Apartment"	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	rundll32.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Modifies registry class 34 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\TeraCopy	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\TeraCopy	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\TeraCopy	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A7005AF0-D6E8-48AF-8DFA-023B1CF660A7}\InProcServer32\ThreadingModel = "Apartment"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\DragDropHandlers	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\TeraCopy	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A7005AF0-D6E8-48AF-8DFA-023B1CF660A7}	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\TeraCopy	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\TeraCopy\ = "{A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\TeraCopy	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\ShellEx\ContextMenuHandlers\TeraCopy\ = "{A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\TeraCopy\ = "{A7005AF0-D6E8-48AF-8DFA-023B1CF660A7}"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\TeraCopy\ = "{A7005AF0-D6E8-48AF-8DFA-023B1CF660A7}"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\DragDropHandlers\TeraCopy\ = "{A7005AF0-D6E8-48AF-8DFA-023B1CF660A7}"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\TeraCopy	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A7005AF0-D6E8-48AF-8DFA-023B1CF660A7}\InProcServer32	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\TeraCopy\ = "{A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}\InProcServer32	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\TeraCopy	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\TeraCopy\ = "{A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shellex\ContextMenuHandlers\TeraCopy\ = "{A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A7005AF0-D6E8-48AF-8DFA-023B1CF660A7}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TeraCopy\\TeraCopy.dll"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\TeraCopy\ = "{A7005AF0-D6E8-48AF-8DFA-023B1CF660A7}"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}\InProcServer32\ThreadingModel = "Apartment"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\shellex\ContextMenuHandlers\TeraCopy	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\DragDropHandlers\TeraCopy	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TeraCopy\\TeraCopyExt.dll"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\TeraCopy	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\TeraCopy\ = "{A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\TeraCopy\ = "{A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}"	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 864	2428	cmd.exe	90
PID 2428 wrote to memory of 864	2428	cmd.exe	90
PID 864 wrote to memory of 4740	864	rundll32.exe	91
PID 864 wrote to memory of 4740	864	rundll32.exe	91
PID 4740 wrote to memory of 2704	4740	runonce.exe	92
PID 4740 wrote to memory of 2704	4740	runonce.exe	92

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\TeraCopy\安装.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\system32\rundll32.exe
  rundll32 setupapi,InstallHinfSection DefaultInstall 132 .\Install.inf
  2⤵
  - Modifies system executable filetype association
  - Registers COM server for autorun
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:864
- - C:\Windows\system32\runonce.exe
    "C:\Windows\system32\runonce.exe" -r
    3⤵
    - Checks processor information in registry
    - Suspicious use of WriteProcessMemory
    PID:4740
  - - C:\Windows\System32\grpconv.exe
      "C:\Windows\System32\grpconv.exe" -o
      4⤵
      PID:2704