43cf70b124088b66313ebb3ea7e3466cd315cb202cd79ca89f2abb18122272e6

Analysis

max time kernel
149s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 03:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AutoClicker-3.1.12.exe
Size 6.7MB
Sample260605-d8dbdaay3y
SHA256 43cf70b124088b66313ebb3ea7e3466cd315cb202cd79ca89f2abb18122272e6
MD5 d45637c8a408232471d3c7da51115a3e
SHA1 36a662821f6e53c780cdfdc0ae4fbc171f52c5e3
SHA512 39b889234dbe05bea8520a36c064c6fc59a7832390c1c98e0d879b665f98b1abf9609b0007f1614d65537dd074cb5d6dbab09a61b28d963702918df18fca6a0f
SSDEEP 196608:sYQqP9aR6hVjrmpq8CjTWngyNvF+ngk69/Xl:sYQ09aRUt8CfWgvO9/V
TLSH
T1A2662345B6AE04BBDFAED27CB95E0922D6367C1A0771924B2220B6314F3F2D15527B0F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 3960	3004	AutoClicker-3.1.12.exe	82
PID 3960 wrote to memory of 3280	3960	cmd.exe	84

C:\Users\Admin\AppData\Local\Temp\AutoClicker-3.1.12.exe
"C:\Users\Admin\AppData\Local\Temp\AutoClicker-3.1.12.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RUN.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3960
- - C:\Windows\system32\mshta.exe
    mshta vbscript:Execute("CreateObject(""WScript.Shell"").Run """"C:\Users\Admin\AppData\Local\Temp\RUN.bat"" hide",0:close")&exit
    3⤵
    PID:3280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RUN.bat

Path C:\Users\Admin\AppData\Local\Temp\RUN.bat
Size 4KB
SHA256 26598f428da372e436903f495035a85faf040614a606aa0b218af9439b00bbaa
MD5 d86524e69d88d30d379755974c80f5af
SHA1 6ea9c1dba7cefd21e2411e82a68805145e5abb52
SHA512 0e876c4112f3a3ba595af703f68083067376a892ddbe8ee02af6ee92d47e6da66dfe9db3358462ce9fa0a49094fb3eab6e8a03d45611ddc24e212cd95dff409a
SSDEEP 96:uaaQI9I19FNkxERJ+OR9MErEPRmEaf6Zl98NENWEtXrlzTQWJ91Ch9lTxUsUlUBj:tL9L6OR9PoPR9b9H3NpZJ9129lin6Byu
TLSH
T1E591CA352F1BC144C9E2028B99BF91C3EF2A52373040E919B7EFE619C95A55EC274798
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download