Analysis Overview
SHA256
43eb23c5036aaaa93d076cc01d09ccc932df41369001835a91f8a9251d31727c
Threat Level: Likely benign
The file AutoClickerv3.2.0.zip was found to be: Likely benign.
Malicious Activity Summary
Unsigned PE
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2024-06-12 18:48
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-12 18:48
Reported
2024-06-12 18:51
Platform
win10v2004-20240508-en
Max time kernel
142s
Max time network
148s
Command Line
Signatures
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\Desktop\AutoClickerv3.2.0\AutoClicker.exe | N/A |
| N/A | N/A | C:\Users\Admin\Desktop\AutoClickerv3.2.0\AutoClicker.exe | N/A |
| N/A | N/A | C:\Users\Admin\Desktop\AutoClickerv3.2.0\AutoClicker.exe | N/A |
| N/A | N/A | C:\Users\Admin\Desktop\AutoClickerv3.2.0\AutoClicker.exe | N/A |
| N/A | N/A | C:\Users\Admin\Desktop\AutoClickerv3.2.0\AutoClicker.exe | N/A |
Suspicious use of SendNotifyMessage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\Desktop\AutoClickerv3.2.0\AutoClicker.exe | N/A |
| N/A | N/A | C:\Users\Admin\Desktop\AutoClickerv3.2.0\AutoClicker.exe | N/A |
| N/A | N/A | C:\Users\Admin\Desktop\AutoClickerv3.2.0\AutoClicker.exe | N/A |
| N/A | N/A | C:\Users\Admin\Desktop\AutoClickerv3.2.0\AutoClicker.exe | N/A |
| N/A | N/A | C:\Users\Admin\Desktop\AutoClickerv3.2.0\AutoClicker.exe | N/A |
Processes
C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\AutoClickerv3.2.0.zip
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4624,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:8
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
C:\Users\Admin\Desktop\AutoClickerv3.2.0\AutoClicker.exe
"C:\Users\Admin\Desktop\AutoClickerv3.2.0\AutoClicker.exe"
C:\Users\Admin\Desktop\AutoClickerv3.2.0\AutoClicker.exe
"C:\Users\Admin\Desktop\AutoClickerv3.2.0\AutoClicker.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
Files
memory/2692-0-0x0000000074F4E000-0x0000000074F4F000-memory.dmp
memory/2692-1-0x0000000000840000-0x000000000086C000-memory.dmp
memory/2692-2-0x0000000074F40000-0x00000000756F0000-memory.dmp
memory/2692-3-0x0000000005220000-0x0000000005246000-memory.dmp
memory/2692-4-0x00000000051F0000-0x0000000005200000-memory.dmp
memory/2692-5-0x0000000005200000-0x000000000520E000-memory.dmp
memory/2692-6-0x00000000056A0000-0x00000000056FA000-memory.dmp
memory/2692-7-0x0000000005670000-0x0000000005696000-memory.dmp
memory/2692-8-0x0000000005650000-0x000000000565A000-memory.dmp
memory/2692-9-0x0000000005700000-0x0000000005708000-memory.dmp
memory/2692-10-0x0000000005660000-0x0000000005668000-memory.dmp
memory/2692-11-0x0000000005760000-0x0000000005774000-memory.dmp
memory/2692-12-0x00000000057A0000-0x00000000057BE000-memory.dmp
memory/2692-13-0x0000000005D70000-0x0000000006314000-memory.dmp
memory/2692-14-0x0000000074F40000-0x00000000756F0000-memory.dmp
memory/2692-15-0x0000000005A70000-0x0000000005A78000-memory.dmp
memory/2692-16-0x0000000005BC0000-0x0000000005BF8000-memory.dmp
memory/2692-17-0x0000000005B90000-0x0000000005B9E000-memory.dmp
memory/2692-18-0x0000000009120000-0x00000000091B2000-memory.dmp
memory/2692-21-0x0000000074F40000-0x00000000756F0000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AutoClicker.exe.log
| MD5 | f18c95d57458abedc3d05b8b9b5d8ac1 |
| SHA1 | d882614e04bf28751f2f40ab71c19039b8a379ce |
| SHA256 | 7aea0cb14b293d652a9f3f5dc6f7eb60265ccff0e5a98aece69e0629a07e2297 |
| SHA512 | d214c74c9d4999ef5fb47d5bfa27fc5959150036a8b92e56bcaa9f9d0c87fda4d06ca5d6ca27c375cc5186547d3c9ce465b9d5ad781e80cd4665207e9ec3f742 |
C:\Users\Admin\AppData\Roaming\AutoClicker_Logs.txt
| MD5 | efaa622dc4a0468563ceedced66eaeff |
| SHA1 | 320191c3e8b141a365b1252dcc81ac5e0d41bb4a |
| SHA256 | 01096723466076ec1d9a145b408453112644e20e158389cba3daeea285083b27 |
| SHA512 | 350d44eed768f7df6935407334936f524b592312cfbac2bc3aadca87cbe17e89f787bbdd500a65fc40dc823304442118b61e2d7cf2444924e21d220e235d0341 |
memory/4912-24-0x0000000009F50000-0x0000000009F5A000-memory.dmp
memory/4912-25-0x0000000009F60000-0x0000000009F6A000-memory.dmp