Malware Analysis Report

2025-04-14 03:45

Sample ID 240612-xf5ppszbnn
Target AutoClickerv3.2.0.zip
SHA256 43eb23c5036aaaa93d076cc01d09ccc932df41369001835a91f8a9251d31727c
Tags
score
3/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
3/10

SHA256

43eb23c5036aaaa93d076cc01d09ccc932df41369001835a91f8a9251d31727c

Threat Level: Likely benign

The file AutoClickerv3.2.0.zip was found to be: Likely benign.

Malicious Activity Summary


Unsigned PE

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-12 18:48

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-12 18:48

Reported

2024-06-12 18:51

Platform

win10v2004-20240508-en

Max time kernel

142s

Max time network

148s

Command Line

C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\AutoClickerv3.2.0.zip

Signatures

Processes

C:\Windows\Explorer.exe

C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\AutoClickerv3.2.0.zip

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4624,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:8

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\Desktop\AutoClickerv3.2.0\AutoClicker.exe

"C:\Users\Admin\Desktop\AutoClickerv3.2.0\AutoClicker.exe"

C:\Users\Admin\Desktop\AutoClickerv3.2.0\AutoClicker.exe

"C:\Users\Admin\Desktop\AutoClickerv3.2.0\AutoClicker.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

memory/2692-0-0x0000000074F4E000-0x0000000074F4F000-memory.dmp

memory/2692-1-0x0000000000840000-0x000000000086C000-memory.dmp

memory/2692-2-0x0000000074F40000-0x00000000756F0000-memory.dmp

memory/2692-3-0x0000000005220000-0x0000000005246000-memory.dmp

memory/2692-4-0x00000000051F0000-0x0000000005200000-memory.dmp

memory/2692-5-0x0000000005200000-0x000000000520E000-memory.dmp

memory/2692-6-0x00000000056A0000-0x00000000056FA000-memory.dmp

memory/2692-7-0x0000000005670000-0x0000000005696000-memory.dmp

memory/2692-8-0x0000000005650000-0x000000000565A000-memory.dmp

memory/2692-9-0x0000000005700000-0x0000000005708000-memory.dmp

memory/2692-10-0x0000000005660000-0x0000000005668000-memory.dmp

memory/2692-11-0x0000000005760000-0x0000000005774000-memory.dmp

memory/2692-12-0x00000000057A0000-0x00000000057BE000-memory.dmp

memory/2692-13-0x0000000005D70000-0x0000000006314000-memory.dmp

memory/2692-14-0x0000000074F40000-0x00000000756F0000-memory.dmp

memory/2692-15-0x0000000005A70000-0x0000000005A78000-memory.dmp

memory/2692-16-0x0000000005BC0000-0x0000000005BF8000-memory.dmp

memory/2692-17-0x0000000005B90000-0x0000000005B9E000-memory.dmp

memory/2692-18-0x0000000009120000-0x00000000091B2000-memory.dmp

memory/2692-21-0x0000000074F40000-0x00000000756F0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AutoClicker.exe.log

MD5 f18c95d57458abedc3d05b8b9b5d8ac1
SHA1 d882614e04bf28751f2f40ab71c19039b8a379ce
SHA256 7aea0cb14b293d652a9f3f5dc6f7eb60265ccff0e5a98aece69e0629a07e2297
SHA512 d214c74c9d4999ef5fb47d5bfa27fc5959150036a8b92e56bcaa9f9d0c87fda4d06ca5d6ca27c375cc5186547d3c9ce465b9d5ad781e80cd4665207e9ec3f742

C:\Users\Admin\AppData\Roaming\AutoClicker_Logs.txt

MD5 efaa622dc4a0468563ceedced66eaeff
SHA1 320191c3e8b141a365b1252dcc81ac5e0d41bb4a
SHA256 01096723466076ec1d9a145b408453112644e20e158389cba3daeea285083b27
SHA512 350d44eed768f7df6935407334936f524b592312cfbac2bc3aadca87cbe17e89f787bbdd500a65fc40dc823304442118b61e2d7cf2444924e21d220e235d0341

memory/4912-24-0x0000000009F50000-0x0000000009F5A000-memory.dmp

memory/4912-25-0x0000000009F60000-0x0000000009F6A000-memory.dmp