Analysis
- geolocation tags
- max time kernel
900s - max time network
489s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
03/07/2026, 03:47
General
- Target SpeedAutoClicker.exe
- Size 2.1MB
- Sample260703-ecbncaa18v
- SHA256 6bc32e935a514da31e6ed5559252c36d82fd64b1e6403748b0ba86598ef20071
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SpeedAutoClicker.exe"C:\Users\Admin\AppData\Local\Temp\SpeedAutoClicker.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ac.config
memory/5804-8-0x0000000004E30000-0x0000000004E4A000-memory.dmp
memory/5804-13-0x00000000750A0000-0x000000007585C000-memory.dmp
memory/5804-3-0x0000000002780000-0x000000000279A000-memory.dmp
memory/5804-6-0x00000000750A0000-0x000000007585C000-memory.dmp
memory/5804-5-0x00000000027C0000-0x00000000027D2000-memory.dmp
memory/5804-4-0x0000000004F20000-0x0000000004FB2000-memory.dmp
memory/5804-7-0x0000000004DE0000-0x0000000004E2A000-memory.dmp
memory/5804-0-0x00000000750B2000-0x00000000750B3000-memory.dmp
memory/5804-2-0x00000000054E0000-0x0000000005A9A000-memory.dmp
memory/5804-9-0x0000000002920000-0x0000000002928000-memory.dmp
memory/5804-12-0x0000000005DC0000-0x0000000005DCA000-memory.dmp
memory/5804-14-0x00000000750A0000-0x000000007585C000-memory.dmp
memory/5804-17-0x000000000B200000-0x000000000B3C2000-memory.dmp
memory/5804-18-0x000000000B900000-0x000000000BE2C000-memory.dmp
memory/5804-21-0x00000000750B2000-0x00000000750B3000-memory.dmp
memory/5804-22-0x00000000750A0000-0x000000007585C000-memory.dmp
memory/5804-23-0x00000000750A0000-0x000000007585C000-memory.dmp
memory/5804-1-0x0000000000170000-0x0000000000396000-memory.dmp