1ce7da6f2813c2ad1d2e496be6714e08cd618e6d9fe2df26c2bd4d894c9a6ec1

Analysis

user interaction
yes
max time kernel
55s
max time network
55s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
13/09/2026, 08:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AutoClicker.exe
Size 1.1MB
Sample260913-kr7bfshe67
SHA256 1ce7da6f2813c2ad1d2e496be6714e08cd618e6d9fe2df26c2bd4d894c9a6ec1
MD5 913a423f66aa1c41e374e21a911a3c20
SHA1 449df612d0f02e868992faabfbf4d5d37c727936
SHA512 ee01f1a322e982bfd6618920e4ec9decf23317628f39dc9b771ff4f758fef3c9266cebbeaeb8ba1e4bbb1f0b683cba1aa3a533bce62a706e7dfd2a7d3bdd1f73
SSDEEP 24576:pRaZROMOm8FN7TjsPnzt2heeRhQbJpOQam1Mfu37d:zkxOm+7TjsPnztyDMBayMc
TLSH
T169455B5523A44199FE6AF0F68A52C106D6B17C4A12B6CB1F01B039B52F736B3DE1E31B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20dbe37f6543dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a6ddc2ff94628641b357cf51c435d747000000000200000000001066000000010000200000007fbc2afc90a61b3a5351173e420319affa0acc9ddb47736387ba592ce6bd5d34000000000e80000000020000200000009e98a0458ac50f2720b0d7405823a98b619d44f097a21cad4e4756c393a5054620000000d0f753b243345f1e52615239587854490e2f436bdf2a4665d733f4748fc2e25340000000472602b203051f056920ebb87e849393df8a3b03d28c310da75822b51b29c750341a0fd4507bc70a3fd68ecce663b14b583db0a2be905bf3ca69522b04efa7ce	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31277917"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "787412283"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "794758966"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31277917"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{5A5F44E8-AF50-11F1-8A40-F6C8777C9041} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5588	AutoClicker.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5012	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
5012	iexplore.exe
5012	iexplore.exe
2756	IEXPLORE.EXE
2756	IEXPLORE.EXE
2756	IEXPLORE.EXE
2756	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 2756	5012	iexplore.exe	85

C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe
"C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:5588

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\UpdateStop.xht
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5012 CREDAT:17410 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2756

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\UpdateStop.xht
1⤵
- Modifies Internet Explorer settings
PID:2972

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\UpdateStop.xht
1⤵
- Modifies Internet Explorer settings
PID:2716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 4e7a238af8cdf358b0b95ec7d9de2ccfd81b9c245944f0833125e22ecd0ac662
MD5 cd9a639522269bdc8f64cca5ee9261ae
SHA1 66e7c3aec64d16c772caf7f7b2db671daf34b4f0
SHA512 c24073e9639f874f6e6fa8a82f0cf473ed45ede2955b33043d400e4c785ec2ca2db09949abaf4c4c707995ffdf99a6e30d702d230a4d97f2133fc00af591a44e
TLSH
T129F0975164BDD8F26A8024CC12E48FFE7025A0B720811099917C8AF2874AFBFBA1E03C
MD5 SHA1 SHA512 TLSH

Submit Download