Analysis

  • max time kernel
    142s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/06/2024, 18:48

General

  • Target

    AutoClickerv3.2.0.zip

  • Size

    646KB

  • MD5

    c62ddb38f13e5fceed8fcf2cfa5607c9

  • SHA1

    af63cfe01be4bd8168e3c2c65bf4ea4a8e02ac98

  • SHA256

    43eb23c5036aaaa93d076cc01d09ccc932df41369001835a91f8a9251d31727c

  • SHA512

    dfb05511feede5fc526dbe27659c92ecd09872ba8bbe00f56e93190bd03f2a41a18cf47a193344c948368f5b5a8d818cebc9613442fc1284ffd27a045b51a128

  • SSDEEP

    12288:BDmCunSRUKCMPVkAcOZSUm8qJhIdbfRofh3J4/5pBwHi66B1gk:rRDCck9OMUIu7a1AXNN1gk

Score
1/10

Malware Config

Signatures

  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\AutoClickerv3.2.0.zip
    1⤵
      PID:364
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4624,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:8
      1⤵
        PID:2324
      • C:\Windows\System32\rundll32.exe
        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
        1⤵
          PID:4400
        • C:\Users\Admin\Desktop\AutoClickerv3.2.0\AutoClicker.exe
          "C:\Users\Admin\Desktop\AutoClickerv3.2.0\AutoClicker.exe"
          1⤵
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:2692
        • C:\Users\Admin\Desktop\AutoClickerv3.2.0\AutoClicker.exe
          "C:\Users\Admin\Desktop\AutoClickerv3.2.0\AutoClicker.exe"
          1⤵
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:4912

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AutoClicker.exe.log

          Filesize

          2KB

          MD5

          f18c95d57458abedc3d05b8b9b5d8ac1

          SHA1

          d882614e04bf28751f2f40ab71c19039b8a379ce

          SHA256

          7aea0cb14b293d652a9f3f5dc6f7eb60265ccff0e5a98aece69e0629a07e2297

          SHA512

          d214c74c9d4999ef5fb47d5bfa27fc5959150036a8b92e56bcaa9f9d0c87fda4d06ca5d6ca27c375cc5186547d3c9ce465b9d5ad781e80cd4665207e9ec3f742

        • C:\Users\Admin\AppData\Roaming\AutoClicker_Logs.txt

          Filesize

          1KB

          MD5

          efaa622dc4a0468563ceedced66eaeff

          SHA1

          320191c3e8b141a365b1252dcc81ac5e0d41bb4a

          SHA256

          01096723466076ec1d9a145b408453112644e20e158389cba3daeea285083b27

          SHA512

          350d44eed768f7df6935407334936f524b592312cfbac2bc3aadca87cbe17e89f787bbdd500a65fc40dc823304442118b61e2d7cf2444924e21d220e235d0341

        • memory/2692-12-0x00000000057A0000-0x00000000057BE000-memory.dmp

          Filesize

          120KB

        • memory/2692-13-0x0000000005D70000-0x0000000006314000-memory.dmp

          Filesize

          5.6MB

        • memory/2692-4-0x00000000051F0000-0x0000000005200000-memory.dmp

          Filesize

          64KB

        • memory/2692-5-0x0000000005200000-0x000000000520E000-memory.dmp

          Filesize

          56KB

        • memory/2692-6-0x00000000056A0000-0x00000000056FA000-memory.dmp

          Filesize

          360KB

        • memory/2692-7-0x0000000005670000-0x0000000005696000-memory.dmp

          Filesize

          152KB

        • memory/2692-8-0x0000000005650000-0x000000000565A000-memory.dmp

          Filesize

          40KB

        • memory/2692-9-0x0000000005700000-0x0000000005708000-memory.dmp

          Filesize

          32KB

        • memory/2692-10-0x0000000005660000-0x0000000005668000-memory.dmp

          Filesize

          32KB

        • memory/2692-14-0x0000000074F40000-0x00000000756F0000-memory.dmp

          Filesize

          7.7MB

        • memory/2692-3-0x0000000005220000-0x0000000005246000-memory.dmp

          Filesize

          152KB

        • memory/2692-0-0x0000000074F4E000-0x0000000074F4F000-memory.dmp

          Filesize

          4KB

        • memory/2692-11-0x0000000005760000-0x0000000005774000-memory.dmp

          Filesize

          80KB

        • memory/2692-15-0x0000000005A70000-0x0000000005A78000-memory.dmp

          Filesize

          32KB

        • memory/2692-16-0x0000000005BC0000-0x0000000005BF8000-memory.dmp

          Filesize

          224KB

        • memory/2692-17-0x0000000005B90000-0x0000000005B9E000-memory.dmp

          Filesize

          56KB

        • memory/2692-18-0x0000000009120000-0x00000000091B2000-memory.dmp

          Filesize

          584KB

        • memory/2692-21-0x0000000074F40000-0x00000000756F0000-memory.dmp

          Filesize

          7.7MB

        • memory/2692-2-0x0000000074F40000-0x00000000756F0000-memory.dmp

          Filesize

          7.7MB

        • memory/2692-1-0x0000000000840000-0x000000000086C000-memory.dmp

          Filesize

          176KB

        • memory/4912-24-0x0000000009F50000-0x0000000009F5A000-memory.dmp

          Filesize

          40KB

        • memory/4912-25-0x0000000009F60000-0x0000000009F6A000-memory.dmp

          Filesize

          40KB