Analysis
- user interaction
yes - max time kernel
43s - max time network
48s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/08/2026, 09:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
rusty-autoclicker-windows.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
rusty-autoclicker-windows.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target rusty-autoclicker-windows.exe
- Size 9.1MB
- Sample260813-lm6d2avyft
- SHA256 17037586cb0c3305a6d749e43c676efa96b2809642f9d39d5f4fb1f5270f166b
- MD5 d30015a3fb3eff9e886b4c274dda0f6f
- SHA1 03685c4fb09ed2fbbcb6078cb16b77ec361d7a7a
- SHA512 511927a81f4c041c388b7be4ddc0289f327c0a85f6a0558d25912d621e91dda6a5c729a78f00688b09916735b42e764fecb0648f941f28ca355ce4de11bb817e
- SSDEEP 49152:7wuhXCnP/Tbq/ee6Mvkzz3HWP0uV7ZLhAAMAEetEXk7EQ4UvPx6m38/fkDpzcJTd:cvHqtsOHmEqhHNvHUrUbl
- TLSH T12AA63A03F25295ECC0AAC074D357A233FA32FC8A432576E75BD46E213E55F946A29B0D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Modifies data under HKEY_USERS 4 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5992 rusty-autoclicker-windows.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5992 rusty-autoclicker-windows.exe 5740 LogonUI.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\rusty-autoclicker-windows.exe"C:\Users\Admin\AppData\Local\Temp\rusty-autoclicker-windows.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5992
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a27055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5740
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵PID:4628