186cc0d215c57b563c5431221bfabd3bfdca9c1983fded862ca4e93bca2de308

Analysis

max time kernel
1560s
max time network
1563s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
14-11-2023 03:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SpeedAutoClicker.exe
Size

4.6MB
MD5

ec9defe751acb1491080d19902c8f0a5
SHA1

fbf71e02a383b7a7c0f05feb7e429bb7308718a6
SHA256

e39f8c1ed5de697d46fa739bd96a32c61fc4203e10fc82a3e6b6b03ee683abba
SHA512

456740dce99bf0eb95978985a9b818ed1677e32cad0b2aee0ef3b8f89db03af0268dd906e7f58abe6a845b89a9fc881af2329f62e932679c02dbaad5f5d27166
SSDEEP

24576:T7UuBQadPnBLoKN7md9QOALAG4RAA0/POdGV5jfW5VnhFyvOB7jW5JMtaUX:Tw09dBLoMAG4RA4oOB7jTX

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008d5ea254cbc3cc499365b391a5fd6692000000000200000000001066000000010000200000000bde80b37f110120e457f2f1a5e94778863395c9af29a605fa7073ecd83f9a4a000000000e8000000002000020000000456ef57a0d0434430264221832eef0ee55a8cd6a8f1e18cb95ad39074bfbf8ff90000000619c3587a233f9af02edd09890502f630c5e781b1f682399dc072fa4ce35fca448c2b9c135e1e44a901aa82b39e6c48dbfe037195df2535b28c1499edbb19deac59ad5545eb6b59e3719404d1f313595cc86877411f7a2094a8b31f9f78690ac446c9b28bdbf93e66c66df594e6eb51f05787aba306cebad74ec97d6df48320f74803dfc27eb77ab0d54f7ee94b941b04000000078decf473908a68ac24ca656d6106c0433b079122afbc21bbdf4175da341885f087d83a91187947199e0fc3cc3c96ea162c7a0198cfebe44aed2590f8456466e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80db729bad16da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C37541E1-82A0-11EE-A512-C6A71AF0F40E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008d5ea254cbc3cc499365b391a5fd66920000000002000000000010660000000100002000000027f2b31f5179824d8d580b4e0288584e7af19a9026a96ac60901cdddb1aac3ef000000000e8000000002000020000000fed037aa0b108c34a5748d69f168c449d37422275a0e4fe1830786da0e247e9220000000854ea66514078e700da77f988d28d91f264ee013e3427d0e5f73ec8ad28961ea400000009236bd7121f6a3d87e118bbb4398299996c13743f5b5d47b987bd77d7e82e503f3afb5b42b06385a7c280d5fdf2795903518d44fed34277e785564768afcd891	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2912	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2912	iexplore.exe
2912	iexplore.exe
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2912	2288	SpeedAutoClicker.exe	28
PID 2288 wrote to memory of 2912	2288	SpeedAutoClicker.exe	28
PID 2288 wrote to memory of 2912	2288	SpeedAutoClicker.exe	28
PID 2912 wrote to memory of 2796	2912	iexplore.exe	30
PID 2912 wrote to memory of 2796	2912	iexplore.exe	30
PID 2912 wrote to memory of 2796	2912	iexplore.exe	30
PID 2912 wrote to memory of 2796	2912	iexplore.exe	30

C:\Users\Admin\AppData\Local\Temp\SpeedAutoClicker.exe
"C:\Users\Admin\AppData\Local\Temp\SpeedAutoClicker.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=win7-x64&apphost_version=6.0.12&gui=true
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2912 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f57e4df985798c54a53441d93602fa8

SHA1
2129e2a3fab7a43449ecd254aca3bdc1a2186c19

SHA256
18d0a273703882f1c25426b2f50a7d60c9394f437a8380828628de563330f6e6

SHA512
7a0335006c490740c81e9fc566e3126d9091bd2f365db913591995503f303da4429e1a017d400be93fa5ebcf7ba526eb3ebb82d4e00c7bc1caf8ffbefb981f99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b95f881140c3251ad929bacf5685a35f

SHA1
68fd88d9f7f6a7e7828ab62e08a2aa83fbd910b2

SHA256
170bec37089b3332cbebdbddfa09c21a21a218c7b73c29b61a95eb06e91aa3cb

SHA512
5256983ee209ee52afd89f0382cf71ea6c2ea7249c3f01ace26532f6aea71f30c9aef02abddd9863152dd9edd1429453c8490da417174eae05e610863acdaad9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3cd0630555c78f2c1e1889059db84c00

SHA1
44d4e96657dca46c09e671e08ebac94503eacd5a

SHA256
55be2cf1643fb0098c926e5d1a7c75868ba5067e0e3dcd2ee51a86cd7cbfd586

SHA512
36bd665a055ed2ec36ce139696ea18ce436ea509ac6d9129dc18967889abf76986bc5197bad15be44fcd8992f6d53e22b41f7dd2e5978215b0fe4372acf08870

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a6e67ed763bef011881249a07bc5e15

SHA1
9cc2543bff750fcfe6af35253226f3a43ae58d1a

SHA256
8cf66d51376e1dad983f3b10c9ae91b72808df1d440921e38fe856a33979904b

SHA512
d3d9219692d153798b766df5f017986427614abdcf87b28c413732bad821b13fd4f2b59f612780ed4fe02e7624cd3212f876a87c805b6c3fe4557ec5ec5378ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17cf712633bbe6c2ba683a5c703adfa9

SHA1
ae19aa764e02401618d5262e186b146b2c1160e3

SHA256
c44f708607f88ea540140f08741a1c6aa53f39d254c2f1b483a02aa37a1ba533

SHA512
60d4e462c9d9ba97c523656b637d031625ed78dfad196ad54e09fb5fe452983c5874d2cf857b96d069a7bd6b720cec53f939fb8211798593f10b96d7659b634e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c34d980ae8de3decc3bd60bb1a7ab83e

SHA1
751b40cfe02f2f88a3b14200c0ad5e46f505c1ea

SHA256
2e9bd3b79e05687c6dc629569d8f0a492bd6ac9be89c398ebd01b0045b225cdc

SHA512
636adf686084a695d7f7a5d085c27bf2e19ea1786a71a521d71fef46ea877b67b15204a0b0dd4a01238793157f506664a0014be5bca8ef5469c796d39d7dc46f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fd58e1375733870987a84708673552d

SHA1
92bba240802997586caca2d86502fe0a72059ef3

SHA256
2a908a16bb9f39af802fdd05642caec3f2d6bec8587e2fdf1c9b557847d3b79d

SHA512
0e56d6629ecff44a6430c986cf7eb466be1f2d211f9a1e149d59e8eef2dfa74ce640ee1db891f4e84a558c0ca95ee5f8bcff39aee80c25ad88f4eb218b5aa37e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c844ad6f74cbd12876551d3a567bce5e

SHA1
143a81078a0bd033a21f0b9de5048363941dc752

SHA256
f2281f7c5b2f09003e2a3de3f23f27ad801c6cbead287e736292ce8a0f834dfe

SHA512
3968f4cb2fd9e4a067cf5ed6547fb43f3865c8a8db93f51875ea50305fc03519c157166377f7dcac1a14dd7842f04f011c81fb9aa20c01a98dfa13ae9189adeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5766f0a5c213f70c8715345e2ffefb9f

SHA1
61e6162434424e338ec3e5f9abdcde1fcfb78e89

SHA256
7fbfdf5c3b16be84b0a83e50c205b2ba262d047aca46ae1bd8526b2c370eb873

SHA512
2cb549d200271581c6329c4bc8c2fb64671b455acd5bc7832674157118beae67dc6e36f751ad57790e44e98be6fefafbdd98562b4a165f355985a894fd78cc89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
423f76d1b93009b1890d63c63fddc8ec

SHA1
c338f375cb6b8b35066f219dceb8fec7d49ef2d1

SHA256
5b78b13a0f7d5d56f9d64beb362d7b50b52d93c86fab7cfe7c24900ea6d5a842

SHA512
2751ac75b99d12dfc24f5ae75d6dc3d5c6e8d57653a5a39978bd6bdb4e59d9fc2154d9c8f3d70b20313cb1d07d2b879ae1180b098b37d08d7d250cf9a76ca988

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ee22233d580d6a04f29f2f304c8863b

SHA1
8a75dbc1c17210337138217bcf5b0462116c74d1

SHA256
044a7e818a500adbf7e157b4fbacc928db3e7b40cde928de0b3f8df35814e54a

SHA512
b6e44f2ce388d50ff61266a5e4be932d8efe84323f8bdddb8d813aca307a514edabfab4cb1b561ff9a43962dd8a5d7716f905d4375215d120b4023e1ff7dfc05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3958f83f31a5d19712389aef7a4131b0

SHA1
9b413b4a0b13d02b31c34649d371ab285dd8829f

SHA256
341feec838575c71226255beff0c737786f94bb026ef136b7bcfff557300ac6d

SHA512
a50443f10202abbb91908b165b7dcab487fcb913779883568f82706430912722a21ebb6dea51549c537c2d389e3a2527128cda14117cc0a248268c51702f32d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db0d34b95b67f51f2eb20a3f1adf8fc6

SHA1
a82b07515ec19e46412350094e9dcbec7613ca3f

SHA256
f92e318b3e39069931ef586921bbf3aa85b23c7258c6f15f4071b3069ecef141

SHA512
c4db067f0e6902daf5b24c58a3f5ef96bab1d0db3c3226de8ccb740dc9da9904d19427eb7b59de033d3fbe2b7a2c94ea528ddb0dd41a2459a7646a564ff93392

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b30a69727632b4b0c6eb12a1d95ce1e

SHA1
067099dfd712b13b3e4a83652ffee84c7eb676ba

SHA256
b4ba75b8d5aff439bc45fd9f90f7e9e0c095b28acaa0fd3d2a267932b3a69de9

SHA512
2f5bddcb16c8c7cf351250c2d8a3da5127c4bb2ca02a1375b59c5c9b9bc6bf55844c372547a7f57cf6578395d80a4123a7fe6b29e2f51f36c2ea29d7dddf3dfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61afb3e58b2e85ed11b602e4feae5c47

SHA1
344a123d8a8432753a6d951ed5bd510dd37db1d0

SHA256
441f8bd23b8f3a4c51e9886e1fbaa39c806d9614c087ccc213e62c674003a796

SHA512
feb74816b1685a2b4035ebac8b16637c677d7e20861944327db541783b46398d8487f8348175f4cad8a4e0715e5a639c4fa047c37b852525bb512d5534f9215f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a2879fdf6a57292dec0a23d03df9b7f

SHA1
538c6128716ab2d4e44e72ebc175f871d641c289

SHA256
a6d329857fb7a7f78c3ecbe7c83f2a9f373897b54dedbda8af3b382bc31facb3

SHA512
caf235febb6ecc7ecc8271066d55c8bded812662beab409c14fb7894c784f342a5df75849755c28248cbeab38677757e5f10ea1bb62c069e633dcc1de57b479d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab61D1.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar62BE.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF8CCAEC8B0912B49B.TMP

Filesize
16KB

MD5
0df5a066ce0254c058c976142cf768e3

SHA1
48c1f79d6f3489067bd2ee50749eabe1fa20bf80

SHA256
c55bc0e92caf66f3b269b665d463eafc5006ea2aaff15a365fbe5b9a999e4718

SHA512
da358b7ab0001dc99e44d8b71a089a33c9cbb331139619b3bfce7953765284e1e12e10b60371b6477b80969f0745fcf19dcefdbdec10cc5a5f770c06827982a8

Download Submit