1ce7da6f2813c2ad1d2e496be6714e08cd618e6d9fe2df26c2bd4d894c9a6ec1

Analysis

max time kernel
149s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/04/2026, 12:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AutoClicker.exe
Size 1.1MB
Sample260417-p2tkkaet3k
SHA256 1ce7da6f2813c2ad1d2e496be6714e08cd618e6d9fe2df26c2bd4d894c9a6ec1
MD5 913a423f66aa1c41e374e21a911a3c20
SHA1 449df612d0f02e868992faabfbf4d5d37c727936
SHA512 ee01f1a322e982bfd6618920e4ec9decf23317628f39dc9b771ff4f758fef3c9266cebbeaeb8ba1e4bbb1f0b683cba1aa3a533bce62a706e7dfd2a7d3bdd1f73
SSDEEP 24576:pRaZROMOm8FN7TjsPnzt2heeRhQbJpOQam1Mfu37d:zkxOm+7TjsPnztyDMBayMc
TLSH
T169455B5523A44199FE6AF0F68A52C106D6B17C4A12B6CB1F01B039B52F736B3DE1E31B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4000	POWERPNT.EXE

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4652	AutoClicker.exe
4000	POWERPNT.EXE

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
4556	OpenWith.exe
3316	OpenWith.exe
2252	OpenWith.exe
4000	POWERPNT.EXE
4000	POWERPNT.EXE
4000	POWERPNT.EXE
4000	POWERPNT.EXE
4000	POWERPNT.EXE
4000	POWERPNT.EXE
4000	POWERPNT.EXE
4000	POWERPNT.EXE
4000	POWERPNT.EXE
4000	POWERPNT.EXE
4000	POWERPNT.EXE
4000	POWERPNT.EXE

C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe
"C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:4652

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4556

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3316

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2252

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /n "C:\Users\Admin\Desktop\LimitSelect.potx"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4000

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /n "C:\Users\Admin\Desktop\LimitSelect.potx"
1⤵
PID:5020

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /n "C:\Users\Admin\Desktop\LimitSelect.potx"
1⤵
PID:4448

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /n "C:\Users\Admin\Desktop\LimitSelect.potx"
1⤵
PID:2684

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /n "C:\Users\Admin\Desktop\LimitSelect.potx"
1⤵
PID:3900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

39C9A09.tmp

Path C:\Users\Admin\AppData\Local\Temp\39C9A09.tmp
Size 73B
SHA256 ad10c595581cce91c7a6082a031b43e503eb85fc73bdef2ee70fc44d90854f76
MD5 47ca5a3b00894accf36f54aa67d9ed71
SHA1 6189af501f904d789e35bd24ed5ef250b0c009f9
SHA512 540d3cdf7ef233755161a0dd510c342ebad9fb6e4cdef35a3b3087980e6200ad79789dded3e6110d72c9f44eb5ccf908c7d38c23db75a1665b716dac2d7f1c64
TLSH
T1BBA0014B418CCA2F1084943B86B2A08CD6A81D293E9072089281990771CB96DC882917
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4000-7-0x00007FF889ED0000-0x00007FF889EE0000-memory.dmp

Download

memory/4000-8-0x00007FF889ED0000-0x00007FF889EE0000-memory.dmp

Download

memory/4000-9-0x00007FF889ED0000-0x00007FF889EE0000-memory.dmp

Download

memory/4000-10-0x00007FF889ED0000-0x00007FF889EE0000-memory.dmp

Download

memory/4000-11-0x00007FF889ED0000-0x00007FF889EE0000-memory.dmp

Download

memory/4000-16-0x00007FF887330000-0x00007FF887340000-memory.dmp

Download

memory/4000-20-0x00007FF887330000-0x00007FF887340000-memory.dmp

Download

memory/5020-21-0x00007FF889ED0000-0x00007FF889EE0000-memory.dmp

Download

memory/5020-24-0x00007FF889ED0000-0x00007FF889EE0000-memory.dmp

Download

memory/5020-23-0x00007FF889ED0000-0x00007FF889EE0000-memory.dmp

Download

memory/5020-22-0x00007FF889ED0000-0x00007FF889EE0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads