Is this program morphing in the wild? Shouldn’t Avast be able to detect it and stop the install?
What about the behavior shield - isn’t this the kind of thing it’s supposed to prevent?
Not even automatic sandbox would catch it?