Overview

overview

8

Static

static

5

AutoClicke...er.exe

windows10-2004-x64

8

AutoClicke...er.exe

windows11-ltsc_2024-x64

8

AutoClicke...er.dll

windows10-2004-x64

8

AutoClicke...er.dll

windows11-ltsc_2024-x64

8

AutoClicke...20.dll

windows10-2004-x64

1

AutoClicke...20.dll

windows11-ltsc_2024-x64

1

AutoClicke...20.dll

windows10-2004-x64

1

AutoClicke...20.dll

windows11-ltsc_2024-x64

1

AutoClicke...20.dll

windows10-2004-x64

1

AutoClicke...20.dll

windows11-ltsc_2024-x64

1

AutoClicke...40.dll

windows10-2004-x64

1

AutoClicke...40.dll

windows11-ltsc_2024-x64

1

AutoClicke...40.dll

windows10-2004-x64

1

AutoClicke...40.dll

windows11-ltsc_2024-x64

1

AutoClicke...40.dll

windows10-2004-x64

1

AutoClicke...40.dll

windows11-ltsc_2024-x64

1

AutoClicke...40.exe

windows10-2004-x64

1

AutoClicke...40.exe

windows11-ltsc_2024-x64

6

AutoClicke...40.dll

windows10-2004-x64

1

AutoClicke...40.dll

windows11-ltsc_2024-x64

1

AutoClicke...in.dll

windows10-2004-x64

1

AutoClicke...rt.dll

windows10-2004-x64

1

AutoClicke...se.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    0a9658a260be1a0a716896cf67ad0e4bfefdfc4adf086f4ecd39675664942350
  • Size 15.5MB
  • Sample261113-n8gc5sbs8n
  • SHA256 0a9658a260be1a0a716896cf67ad0e4bfefdfc4adf086f4ecd39675664942350
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryexecutionpersistenceprivilege_escalationransomwarerevoked_codesign

Malware Config

Targets

    • Target
      AutoClicker\AutoClicker.exe
    • Size 74KB
    • SHA256 f0b332ed4ff4f4dde04cf7463b6aba23d8cd3198bd763a627c5c196c2d775760
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    discoverypersistenceprivilege_escalationrevoked_codesignexecution

    • Sets service image path in registry

      This determines the executable launched when a service starts. It can be used to establish persistence.

      persistence

    • Signed with revoked ConnectWise certificate

      Binary is signed using a ConnectWise certificate revoked for key compromise.

      revoked_codesign

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Boot or Logon Autostart Execution: Authentication Package

      Suspicious Windows Authentication Registry Modification.

      persistenceprivilege_escalation

    • Drops file in System32 directory

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation
    behavioral1behavioral2
    • Target
      AutoClicker\SqlSetupBootstrapper.dll
    • Size 18KB
    • SHA256 d60fd318876eabb179c62be513d6f9a501a17becd8979e6b869d7151cb8a9dca
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    discoverypersistenceprivilege_escalationrevoked_codesignexecution

    • Sets service image path in registry

      This determines the executable launched when a service starts. It can be used to establish persistence.

      persistence

    • Signed with revoked ConnectWise certificate

      Binary is signed using a ConnectWise certificate revoked for key compromise.

      revoked_codesign

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Boot or Logon Autostart Execution: Authentication Package

      Suspicious Windows Authentication Registry Modification.

      persistenceprivilege_escalation

    • Drops file in System32 directory

    behavioral3behavioral4
    • Target
      AutoClicker\redist\2013\msvcp120.dll
    • Size 644KB
    • SHA256 3b92e964404e3f94531e7d7c4c7419561d9eca6accd98dc3979c9e3596db444c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral5behavioral6
    • Target
      AutoClicker\redist\2013\msvcr120.dll
    • Size 940KB
    • SHA256 753ac30c30aae62415cc225e3d057b8b6254afe280696e0a43f1a7c3132632a6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7behavioral8
    • Target
      AutoClicker\redist\2013\vcomp120.dll
    • Size 134KB
    • SHA256 7fd73132d9579eebb2e6ee202babc6a49b3744de84c9b34fede0b3be95ec98bb
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10behavioral9
    • Target
      AutoClicker\redist\2022\concrt140.dll
    • Size 314KB
    • SHA256 b2faf3b85b23c840b654e57d5497a0ad31acd02fb01856cad4725a1715d5f78e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral11behavioral12
    • Target
      AutoClicker\redist\2022\msvcp140.dll
    • Size 540KB
    • SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral13behavioral14
    • Target
      AutoClicker\redist\2022\vccorlib140.dll
    • Size 342KB
    • SHA256 6b8d8a76c3e6664293407553650e60b94df9aaafc7c92057ea83032bd228e44f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral15behavioral16
    • Target
      AutoClicker\redist\2022\vcomp140.dll
    • Size 1.1MB
    • SHA256 1ce7da6f2813c2ad1d2e496be6714e08cd618e6d9fe2df26c2bd4d894c9a6ec1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    discoveryransomware

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral17behavioral18
    • Target
      AutoClicker\redist\2022\vcruntime140.dll
    • Size 120KB
    • SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral19behavioral20
    • Target
      AutoClicker\redist\msvcp_win.dll
    • Size 626KB
    • SHA256 940a41d9d78c2d2d0ece8d8e4735630735f57ffb95466e350dae3535b40a698a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral21
    • Target
      AutoClicker\redist\msvcrt.dll
    • Size 683KB
    • SHA256 744606e3d245647943ab7be0d4132ead491c719b908c207afb775e1ed30299f0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral22
    • Target
      AutoClicker\redist\ucrtbase.dll
    • Size 1.3MB
    • SHA256 5e7709a6b71bb818260b6f05c5bb3b6ca0c3ca9bc2f58c6242c1cd9d826d0079
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral23

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

JavaScript

1
T1059.007

Windows Command Shell

1
T1059.003

Persistence

Boot or Logon Autostart Execution

2
T1547

Authentication Package

1
T1547.002

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Authentication Package

1
T1547.002

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

1
T1120

Query Registry

3
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

System Time Discovery

1
T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

Score
5/10

behavioral1

discoverypersistenceprivilege_escalationrevoked_codesign
Score
8/10

behavioral2

discoveryexecutionpersistenceprivilege_escalationrevoked_codesign
Score
8/10

behavioral3

discoverypersistenceprivilege_escalationrevoked_codesign
Score
8/10

behavioral4

discoveryexecutionpersistenceprivilege_escalationrevoked_codesign
Score
8/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

discoveryransomware
Score
6/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10