Analysis
- max time kernel
148s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 22:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
AutoClicker.exe
Resource
win10v2004-20260911-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
AutoClicker.exe
Resource
win11ltsc2024-20260911-en
5 signatures
150 seconds
General
- Target AutoClicker.exe
- Size 947KB
- Sample261102-18e7asxtaz
- SHA256 bf2b1ebfceb98d86091cb860d64261eedbe5785d9ddb9ae1834f4896266bc0c9
- MD5 3c0d87d2bab7f5fa8212211a80a84f6f
- SHA1 b434efad4181cfc0e9a0336fbbf3a2c428b1674e
- SHA512 38fedf350086c49d9571704aff2d8d55804e88661f8f7e69846656f3fffd11afb951c4eb45252051b10626ff208e2b64459560e1a9fd21a882f4f502dedc879c
- SSDEEP 24576:udM0upDffi0dnqrjgyL0ZeGB4n6QnVUM8:uudnOacuCn
- TLSH T112258D41F1A455EDE067E03886ABB60BF975389803105BCB73E4D5682FE36E47ABF211
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\pcGOUtEoImgKvgdosheobbeA\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\pcGOUtEoImgKvgdosheobbeA" AutoClicker.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3720 AutoClicker.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 3720 AutoClicker.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3720 AutoClicker.exe Token: SeLoadDriverPrivilege 3720 AutoClicker.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3720 AutoClicker.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe"C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe"1⤵
- Sets service image path in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3720
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1