Analysis
- user interaction
yes - max time kernel
55s - max time network
61s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
22/07/2026, 04:30
General
- Target AutoClicker(1).exe
- Size 1.1MB
- Sample260722-e4x1nadj9v
- SHA256 1ce7da6f2813c2ad1d2e496be6714e08cd618e6d9fe2df26c2bd4d894c9a6ec1
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious use of FindShellTrayWindow 18 IoCs
- Suspicious use of SendNotifyMessage 17 IoCs
- Suspicious use of SetWindowsHookEx 33 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AutoClicker(1).exe"C:\Users\Admin\AppData\Local\Temp\AutoClicker(1).exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\SetWatch.rle"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\SetWatch.rle"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\SetWatch.rle"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\SetWatch.rle"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RestoreStart.mpeg"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RestoreStart.mpeg"1⤵
-
C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /n "C:\Users\Admin\Desktop\RestartRequest.pot"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\AssertCopy.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UnpublishAssert.ogg"1⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UnpublishAssert.ogg"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
index.dat
b8ab77100df80ab2.customDestinations-ms
b8ab77100df80ab2.customDestinations-ms
vlc-qt-interface.ini
wiatrace.log
wiatrace.log
wiatrace.log
memory/2228-25-0x00007FFD88BB0000-0x00007FFD88BC4000-memory.dmp
memory/2228-23-0x00007FFD88F60000-0x00007FFD88F8B000-memory.dmp
memory/2228-17-0x00007FF6F94D0000-0x00007FF6F95C8000-memory.dmp
memory/2228-21-0x00007FFD88FC0000-0x00007FFD88FD9000-memory.dmp
memory/2228-20-0x00007FFD98E50000-0x00007FFD98E61000-memory.dmp
memory/2228-26-0x00007FFD88B90000-0x00007FFD88BA1000-memory.dmp
memory/2228-33-0x00007FFD88590000-0x00007FFD885A8000-memory.dmp
memory/2228-38-0x00007FFD884D0000-0x00007FFD884E1000-memory.dmp
memory/2228-48-0x00007FFD80070000-0x00007FFD802B5000-memory.dmp
memory/2228-47-0x00000218A9BD0000-0x00000218A9C27000-memory.dmp
memory/2228-46-0x00000218A9BB0000-0x00000218A9BC1000-memory.dmp
memory/2228-45-0x00007FFD880B0000-0x00007FFD880C2000-memory.dmp
memory/2228-44-0x00007FFD880D0000-0x00007FFD880EB000-memory.dmp
memory/2228-43-0x00007FFD880F0000-0x00007FFD8819B000-memory.dmp
memory/2228-42-0x00007FFD881A0000-0x00007FFD881C5000-memory.dmp
memory/2228-41-0x00007FFD881D0000-0x00007FFD8821F000-memory.dmp
memory/2228-40-0x00007FFD88220000-0x00007FFD882B8000-memory.dmp
memory/2228-39-0x00000218A99A0000-0x00000218A9BAB000-memory.dmp
memory/2228-37-0x00007FFD884F0000-0x00007FFD88501000-memory.dmp
memory/2228-36-0x00007FFD88510000-0x00007FFD8852A000-memory.dmp
memory/2228-35-0x00007FFD88530000-0x00007FFD8855D000-memory.dmp
memory/2228-34-0x00007FFD88560000-0x00007FFD88586000-memory.dmp
memory/2228-31-0x00007FFD885E0000-0x00007FFD88621000-memory.dmp
memory/2228-30-0x00007FFD88630000-0x00007FFD88713000-memory.dmp
memory/2228-32-0x00007FFD885B0000-0x00007FFD885DF000-memory.dmp
memory/2228-29-0x00007FFD88720000-0x00007FFD88808000-memory.dmp
memory/2228-28-0x00007FFD88810000-0x00007FFD88AA6000-memory.dmp
memory/2228-22-0x00007FFD88F90000-0x00007FFD88FB2000-memory.dmp
memory/2228-24-0x00007FFD88BD0000-0x00007FFD88F60000-memory.dmp
memory/2228-27-0x00007FFD88AB0000-0x00007FFD88B82000-memory.dmp
memory/2228-18-0x00007FFD892A0000-0x00007FFD892D4000-memory.dmp
memory/2228-19-0x00007FFD88FE0000-0x00007FFD89296000-memory.dmp
memory/2696-15-0x00007FFD66C20000-0x00007FFD66C30000-memory.dmp
memory/2696-14-0x00007FFD68D90000-0x00007FFD68DA0000-memory.dmp
memory/2696-16-0x00007FFD66C20000-0x00007FFD66C30000-memory.dmp
memory/2696-12-0x00007FFD68D90000-0x00007FFD68DA0000-memory.dmp
memory/2696-10-0x00007FFD68D90000-0x00007FFD68DA0000-memory.dmp
memory/2696-13-0x00007FFD68D90000-0x00007FFD68DA0000-memory.dmp
memory/2696-11-0x00007FFD68D90000-0x00007FFD68DA0000-memory.dmp
memory/2936-77-0x00007FFD88590000-0x00007FFD885A8000-memory.dmp
memory/2936-70-0x00007FFD88B90000-0x00007FFD88BA1000-memory.dmp
memory/2936-82-0x00007FFD884D0000-0x00007FFD884E1000-memory.dmp
memory/2936-81-0x00007FFD884F0000-0x00007FFD88501000-memory.dmp
memory/2936-80-0x00007FFD88510000-0x00007FFD8852A000-memory.dmp
memory/2936-79-0x00007FFD88530000-0x00007FFD8855D000-memory.dmp
memory/2936-73-0x00007FFD88720000-0x00007FFD88808000-memory.dmp
memory/2936-78-0x00007FFD88560000-0x00007FFD88586000-memory.dmp
memory/2936-89-0x00007FFD881A0000-0x00007FFD881C5000-memory.dmp
memory/2936-76-0x00007FFD885B0000-0x00007FFD885DF000-memory.dmp
memory/2936-75-0x00007FFD885E0000-0x00007FFD88621000-memory.dmp
memory/2936-74-0x00007FFD88630000-0x00007FFD88713000-memory.dmp
memory/2936-71-0x00007FFD88AB0000-0x00007FFD88B82000-memory.dmp
memory/2936-83-0x000001F48E0A0000-0x000001F48E2AB000-memory.dmp
memory/2936-69-0x00007FFD88BB0000-0x00007FFD88BC4000-memory.dmp
memory/2936-63-0x00007FFD88FE0000-0x00007FFD89296000-memory.dmp
memory/2936-67-0x00007FFD88F60000-0x00007FFD88F8B000-memory.dmp
memory/2936-66-0x00007FFD88F90000-0x00007FFD88FB2000-memory.dmp
memory/2936-65-0x00007FFD88FC0000-0x00007FFD88FD9000-memory.dmp
memory/2936-64-0x00007FFD98E50000-0x00007FFD98E61000-memory.dmp
memory/2936-62-0x00007FFD892A0000-0x00007FFD892D4000-memory.dmp
memory/2936-87-0x00007FFD88220000-0x00007FFD882B8000-memory.dmp
memory/2936-61-0x00007FF6F94D0000-0x00007FF6F95C8000-memory.dmp
memory/2936-68-0x00007FFD88BD0000-0x00007FFD88F60000-memory.dmp
memory/2936-88-0x00007FFD881D0000-0x00007FFD8821F000-memory.dmp