b0db11cb8d232f65a27118734a477a2b3d3f0d5e8170f966ba82309cd437c114

Analysis

max time kernel
51s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 11:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

AVG Anti-Spyware/!)右鍵设置.bat
Size

67B
MD5

dd963ca73c035e87f346b69d82a5ed35
SHA1

443559323de578cd91a60fd026009985a0102de8
SHA256

7a6756db0ffa06abaa19ed1ca8bc0bdb2a7bb9e12be980fcfa5062c82203db15
SHA512

85d73fb8246eb54315d12fe8c22e7e072850c8883d73730ee7b374f3c4f5a397b369049c8569194e24568d943101361325afa4f3d8ea70362552d1a503a076be

Score

7^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies system executable filetype association 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\ContextMenuHandlers\ewido anti-spyware	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\ContextMenuHandlers	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\ContextMenuHandlers\ewido anti-spyware\ = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	rundll32.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57B86673-276A-48B2-BAE7-C6DBB3020EB8}\InprocServer32\ThreadingModel = "apartment"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8934FCEF-F5B8-468f-951F-78A921CD3920}\ = "CContextScan Object"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8934FCEF-F5B8-468f-951F-78A921CD3920}\ProgID\ = "ewido.context.1"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8934FCEF-F5B8-468f-951F-78A921CD3920}\TypeLib	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\ewido anti-spyware	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8416F47-1E83-44AF-8C0C-C5AB14ABDFD2}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ewido anti-spyware\ = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8934FCEF-F5B8-468f-951F-78A921CD3920}\InprocServer32	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{92F51889-D476-4BC8-BD21-B30744A5EF51}\1.0\HELPDIR	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8416F47-1E83-44AF-8C0C-C5AB14ABDFD2}\1.0\0	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\shellexecutehook.CShellExecuteHookImpl\CLSID\ = "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{92F51889-D476-4BC8-BD21-B30744A5EF51}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AVG Anti-Spyware\\"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8416F47-1E83-44AF-8C0C-C5AB14ABDFD2}\1.0\FLAGS\ = "0"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\shellexecutehook.CShellExecuteHookImpl	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57B86673-276A-48B2-BAE7-C6DBB3020EB8}\AppID	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57B86673-276A-48B2-BAE7-C6DBB3020EB8}\ProgID\ = "shellexecutehook.CShellExecuteHookImp.1"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57B86673-276A-48B2-BAE7-C6DBB3020EB8}\VersionIndependentProgID\ = "shellexecutehook.CShellExecuteHookImpl"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6a4585d6-8f7b-35e8-96a4-ccc42ff26f4f}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8934FCEF-F5B8-468f-951F-78A921CD3920}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AVG Anti-Spyware\\context.dll"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ewido anti-spyware\ = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\shellexecutehook.CShellExecuteHookImp.1\ = "CShellExecuteHookImpl Object"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\shellexecutehook.CShellExecuteHookImp.1\CLSID	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\shellexecutehook.CShellExecuteHookImpl\CurVer\ = "shellexecutehook.CShellExecuteHookImp.1"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{92F51889-D476-4BC8-BD21-B30744A5EF51}\1.0\0\win32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{92F51889-D476-4BC8-BD21-B30744A5EF51}\1.0\FLAGS\ = "0"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8416F47-1E83-44AF-8C0C-C5AB14ABDFD2}\1.0	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ewido anti-spyware	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57B86673-276A-48B2-BAE7-C6DBB3020EB8}	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57B86673-276A-48B2-BAE7-C6DBB3020EB8}\ProgID	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ewido.context\CurVer	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{92F51889-D476-4BC8-BD21-B30744A5EF51}\1.0	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{92F51889-D476-4BC8-BD21-B30744A5EF51}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{92F51889-D476-4BC8-BD21-B30744A5EF51}\1.0\ = "shellexecutehook 1.0 Typbibliothek"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8416F47-1E83-44AF-8C0C-C5AB14ABDFD2}\1.0\0\win32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57B86673-276A-48B2-BAE7-C6DBB3020EB8}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AVG Anti-Spyware\\shellexecutehook.dll"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8934FCEF-F5B8-468f-951F-78A921CD3920}\TypeLib\ = "{E8416F47-1E83-44AF-8C0C-C5AB14ABDFD2}"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ewido anti-spyware	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ewido.context\ = "CContextScan Object"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8934FCEF-F5B8-468f-951F-78A921CD3920}\VersionIndependentProgID	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\ewido anti-spyware\ = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\ContextMenuHandlers\ewido anti-spyware\ = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\shellexecutehook.CShellExecuteHookImpl\CLSID	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8416F47-1E83-44AF-8C0C-C5AB14ABDFD2}\1.0\HELPDIR	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ewido.context.1\ = "CContextScan Object"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\shellexecutehook.CShellExecuteHookImp.1	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{92F51889-D476-4BC8-BD21-B30744A5EF51}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AVG Anti-Spyware\\shellexecutehook.dll"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57B86673-276A-48B2-BAE7-C6DBB3020EB8}\ = "CShellExecuteHookImpl Object"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{92F51889-D476-4BC8-BD21-B30744A5EF51}\1.0\FLAGS	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57B86673-276A-48B2-BAE7-C6DBB3020EB8}\TypeLib	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8934FCEF-F5B8-468f-951F-78A921CD3920}\InprocServer32\ThreadingModel = "apartment"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8934FCEF-F5B8-468f-951F-78A921CD3920}\ProgID	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8416F47-1E83-44AF-8C0C-C5AB14ABDFD2}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AVG Anti-Spyware\\context.dll"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ewido.context.1\CLSID\ = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\ContextMenuHandlers\ewido anti-spyware	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8416F47-1E83-44AF-8C0C-C5AB14ABDFD2}\1.0\FLAGS	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6a4585d6-8f7b-35e8-96a4-ccc42ff26f4f}\1 = "1"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8934FCEF-F5B8-468f-951F-78A921CD3920}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\shellexecutehook.CShellExecuteHookImp.1\CLSID\ = "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\shellexecutehook.CShellExecuteHookImpl\CurVer	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57B86673-276A-48B2-BAE7-C6DBB3020EB8}\InprocServer32	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ewido.context\CLSID	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 1892	644	cmd.exe	82
PID 644 wrote to memory of 1892	644	cmd.exe	82
PID 1892 wrote to memory of 1240	1892	rundll32.exe	83
PID 1892 wrote to memory of 1240	1892	rundll32.exe	83
PID 1240 wrote to memory of 4472	1240	runonce.exe	84
PID 1240 wrote to memory of 4472	1240	runonce.exe	84

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\AVG Anti-Spyware\!)右鍵设置.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:644
- C:\Windows\system32\rundll32.exe
  rundll32 setupapi,InstallHinfSection DefaultInstall 128 .\setup.inf
  2⤵
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Windows\system32\runonce.exe
    "C:\Windows\system32\runonce.exe" -r
    3⤵
    - Checks processor information in registry
    - Suspicious use of WriteProcessMemory
    PID:1240
  - - C:\Windows\System32\grpconv.exe
      "C:\Windows\System32\grpconv.exe" -o
      4⤵
      PID:4472