Analysis
- max time kernel
117s - max time network
50s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
05/09/2026, 17:52
General
- Target AutoClicker.exe
- Size 1.1MB
- Sample260905-wf4xqsfb52
- SHA256 1ce7da6f2813c2ad1d2e496be6714e08cd618e6d9fe2df26c2bd4d894c9a6ec1
Malware Config
Signatures
- Drops desktop.ini file(s) 7 IoCs
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Windows directory 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Opens file in notepad (likely ransom note) 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe"C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost1⤵
- Drops file in Windows directory
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" "C:\Users\Admin\Desktop\CopyConvertTo.ps1"1⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" "C:\Users\Admin\Desktop\CopyConvertTo.ps1"1⤵
- Opens file in notepad (likely ransom note)
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CurrentDatabase_400.wmdb
CurrentDatabase_400.wmdb
LocalMLS_3.wmdb
WMSDKNS.DTD
WMSDKNS.XML
wmsetup.log
74d7f43c1561fc1e.customDestinations-ms
74d7f43c1561fc1e.customDestinations-ms
memory/4628-76-0x00000000083F0000-0x0000000008400000-memory.dmp
memory/4628-81-0x00000000082C0000-0x00000000082D0000-memory.dmp
memory/4628-47-0x0000000007990000-0x00000000079A0000-memory.dmp
memory/4628-48-0x00000000082C0000-0x00000000082D0000-memory.dmp
memory/4628-49-0x00000000082C0000-0x00000000082D0000-memory.dmp
memory/4628-50-0x00000000082C0000-0x00000000082D0000-memory.dmp
memory/4628-52-0x00000000082C0000-0x00000000082D0000-memory.dmp
memory/4628-51-0x00000000082C0000-0x00000000082D0000-memory.dmp
memory/4628-53-0x00000000083F0000-0x0000000008400000-memory.dmp
memory/4628-56-0x00000000083F0000-0x0000000008400000-memory.dmp
memory/4628-55-0x00000000083F0000-0x0000000008400000-memory.dmp
memory/4628-57-0x00000000083F0000-0x0000000008400000-memory.dmp
memory/4628-59-0x00000000083F0000-0x0000000008400000-memory.dmp
memory/4628-58-0x00000000083F0000-0x0000000008400000-memory.dmp
memory/4628-60-0x00000000083F0000-0x0000000008400000-memory.dmp
memory/4628-65-0x00000000083F0000-0x0000000008400000-memory.dmp
memory/4628-64-0x00000000083F0000-0x0000000008400000-memory.dmp
memory/4628-63-0x00000000083F0000-0x0000000008400000-memory.dmp
memory/4628-62-0x00000000083F0000-0x0000000008400000-memory.dmp
memory/4628-61-0x00000000083F0000-0x0000000008400000-memory.dmp
memory/4628-66-0x00000000083F0000-0x0000000008400000-memory.dmp
memory/4628-67-0x00000000083F0000-0x0000000008400000-memory.dmp
memory/4628-69-0x00000000082C0000-0x00000000082D0000-memory.dmp
memory/4628-68-0x00000000083F0000-0x0000000008400000-memory.dmp
memory/4628-72-0x00000000083F0000-0x0000000008400000-memory.dmp
memory/4628-71-0x00000000082C0000-0x00000000082D0000-memory.dmp
memory/4628-70-0x00000000082C0000-0x00000000082D0000-memory.dmp
memory/4628-75-0x0000000007990000-0x00000000079A0000-memory.dmp
memory/4628-36-0x0000000007990000-0x00000000079A0000-memory.dmp
memory/4628-77-0x00000000083F0000-0x0000000008400000-memory.dmp
memory/4628-46-0x0000000007990000-0x00000000079A0000-memory.dmp
memory/4628-78-0x00000000082C0000-0x00000000082D0000-memory.dmp
memory/4628-89-0x00000000083F0000-0x0000000008400000-memory.dmp
memory/4628-79-0x00000000082C0000-0x00000000082D0000-memory.dmp
memory/4628-83-0x00000000082C0000-0x00000000082D0000-memory.dmp
memory/4628-82-0x00000000083F0000-0x0000000008400000-memory.dmp
memory/4628-86-0x00000000083F0000-0x0000000008400000-memory.dmp
memory/4628-85-0x00000000083F0000-0x0000000008400000-memory.dmp
memory/4628-84-0x00000000083F0000-0x0000000008400000-memory.dmp
memory/4628-88-0x00000000083F0000-0x0000000008400000-memory.dmp
memory/4628-80-0x00000000082C0000-0x00000000082D0000-memory.dmp
memory/4628-90-0x00000000083F0000-0x0000000008400000-memory.dmp
memory/4628-91-0x00000000083F0000-0x0000000008400000-memory.dmp
memory/4628-92-0x00000000083F0000-0x0000000008400000-memory.dmp
memory/4628-93-0x00000000083F0000-0x0000000008400000-memory.dmp
memory/4628-94-0x00000000083F0000-0x0000000008400000-memory.dmp
memory/4628-95-0x00000000083F0000-0x0000000008400000-memory.dmp
memory/4628-96-0x00000000082C0000-0x00000000082D0000-memory.dmp
memory/4628-97-0x00000000083F0000-0x0000000008400000-memory.dmp
memory/4628-100-0x00000000082C0000-0x00000000082D0000-memory.dmp
memory/4628-101-0x0000000007990000-0x00000000079A0000-memory.dmp
memory/4628-99-0x00000000082C0000-0x00000000082D0000-memory.dmp
memory/4628-98-0x00000000083F0000-0x0000000008400000-memory.dmp
memory/4628-102-0x00000000083F0000-0x0000000008400000-memory.dmp
memory/4628-103-0x00000000083F0000-0x0000000008400000-memory.dmp
memory/4628-104-0x00000000082C0000-0x00000000082D0000-memory.dmp
memory/4628-106-0x00000000082C0000-0x00000000082D0000-memory.dmp
memory/4628-108-0x00000000082C0000-0x00000000082D0000-memory.dmp
memory/4628-107-0x00000000082C0000-0x00000000082D0000-memory.dmp
memory/4628-110-0x00000000082C0000-0x00000000082D0000-memory.dmp
memory/4628-109-0x00000000083F0000-0x0000000008400000-memory.dmp
memory/4628-114-0x00000000083F0000-0x0000000008400000-memory.dmp
memory/4628-113-0x00000000083F0000-0x0000000008400000-memory.dmp
memory/4628-112-0x00000000083F0000-0x0000000008400000-memory.dmp