analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

AutoClicker.exe

Full analysis: https://app.any.run/tasks/e39c6d07-9d3b-487c-a2c9-ac330d4e1f7f
Verdict: Malicious activity
Analysis date: September 30, 2020, 14:06:08
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

7ECFC8CD7455DD9998F7DAD88F2A8A9D

SHA1:

1751D9389ADB1E7187AFA4938A3559E58739DCE6

SHA256:

2E67D5E7D96AEC62A9DDA4C0259167A44908AF863C2B3AF2A019723205ABBA9E

SSDEEP:

12288:GaWzgMg7v3qnCiWErQohh0F49CJ8lnybQg9BFg9UmTRHlM:BaHMv6CGrjBnybQg+mmhG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • reg.exe (PID: 1208)

  • SUSPICIOUS

    • Application launched itself

      • Skype.exe (PID: 2576)
      • Skype.exe (PID: 464)
      • Skype.exe (PID: 2888)

    • Reads CPU info

      • Skype.exe (PID: 2576)

    • Uses REG.EXE to modify Windows registry

      • Skype.exe (PID: 2576)

    • Modifies the open verb of a shell class

      • Skype.exe (PID: 2576)

    • Creates files in the user directory

      • Skype.exe (PID: 464)
      • Skype.exe (PID: 2576)
      • Skype.exe (PID: 2888)

  • INFO

    • Manual execution by user

      • Skype.exe (PID: 2576)

    • Reads the hosts file

      • Skype.exe (PID: 2576)

    • Reads settings of System Certificates

      • Skype.exe (PID: 2576)

    • Dropped object may contain Bitcoin addresses

      • Skype.exe (PID: 2576)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:03:14 21:01:24+01:00
PEType: PE32
LinkerVersion: 9
CodeSize: 524800
InitializedDataSize: 126976
UninitializedDataSize: -
EntryPoint: 0x16310
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 3.0.0.0
ProductVersionNumber: 3.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: www.opautoclicker.com
FileDescription: OP Auto Clicker
FileVersion: 3
LegalCopyright: www.opautoclicker.com
ProductName: OP Auto Clicker
ProductVersion: 3
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
9
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start autoclicker.exe no specs skype.exe skype.exe reg.exe skype.exe no specs reg.exe no specs skype.exe skype.exe no specs skype.exe

Process information

PID
CMD
Path
Indicators
Parent process
2524"C:\Users\admin\AppData\Local\Temp\AutoClicker.exe" C:\Users\admin\AppData\Local\Temp\AutoClicker.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
OP Auto Clicker
Version:
3.0
2576"C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" C:\Program Files\Microsoft\Skype for Desktop\Skype.exe
explorer.exe
User:
admin
Company:
Skype Technologies S.A.
Integrity Level:
MEDIUM
Description:
Skype
Version:
8.29.0.50
2968"C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" --reporter-url=https://rink.hockeyapp.net/api/2/apps/a741743329d94bc08826af367733939d/crashes/upload --application-name=skype-preview "--crashes-directory=C:\Users\admin\AppData\Local\Temp\skype-preview Crashes" --v=1C:\Program Files\Microsoft\Skype for Desktop\Skype.exe
Skype.exe
User:
admin
Company:
Skype Technologies S.A.
Integrity Level:
MEDIUM
Description:
Skype
Version:
8.29.0.50
1208C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Skype for Desktop" /t REG_SZ /d "C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" /fC:\Windows\system32\reg.exe
Skype.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
464"C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" --type=renderer --ms-disable-indexeddb-transaction-timeout --no-sandbox --service-pipe-token=FE245D8BABEB464ED52345C8254B201A --lang=en-US --app-user-model-id=Microsoft.Skype.SkypeDesktop --app-path="C:\Program Files\Microsoft\Skype for Desktop\resources\app.asar" --node-integration=false --webview-tag=true --no-sandbox --preload="C:\Program Files\Microsoft\Skype for Desktop\resources\app.asar\Preload.js" --context-id=2 --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --disable-accelerated-video-decode --disable-gpu-compositing --enable-gpu-async-worker-context --service-request-channel-token=FE245D8BABEB464ED52345C8254B201A --renderer-client-id=3 --mojo-platform-channel-handle=1576 /prefetch:1C:\Program Files\Microsoft\Skype for Desktop\Skype.exe—Skype.exe
User:
admin
Company:
Skype Technologies S.A.
Integrity Level:
MEDIUM
Description:
Skype
Exit code:
0
Version:
8.29.0.50
2076C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Skype /v RestartForUpdateC:\Windows\system32\reg.exe—Skype.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2864"C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" --reporter-url=https://rink.hockeyapp.net/api/2/apps/a741743329d94bc08826af367733939d/crashes/upload --application-name=skype-preview "--crashes-directory=C:\Users\admin\AppData\Local\Temp\skype-preview Crashes" --v=1C:\Program Files\Microsoft\Skype for Desktop\Skype.exe
Skype.exe
User:
admin
Company:
Skype Technologies S.A.
Integrity Level:
MEDIUM
Description:
Skype
Exit code:
2
Version:
8.29.0.50
2888"C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" --type=renderer --ms-disable-indexeddb-transaction-timeout --no-sandbox --service-pipe-token=967BBBD85EF91AB64C862260086F7827 --lang=en-US --app-user-model-id=Microsoft.Skype.SkypeDesktop --app-path="C:\Program Files\Microsoft\Skype for Desktop\resources\app.asar" --node-integration=false --webview-tag=true --no-sandbox --preload="C:\Program Files\Microsoft\Skype for Desktop\resources\app.asar\Preload.js" --context-id=1 --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --disable-accelerated-video-decode --disable-gpu-compositing --enable-gpu-async-worker-context --service-request-channel-token=967BBBD85EF91AB64C862260086F7827 --renderer-client-id=4 --mojo-platform-channel-handle=2660 /prefetch:1C:\Program Files\Microsoft\Skype for Desktop\Skype.exe—Skype.exe
User:
admin
Company:
Skype Technologies S.A.
Integrity Level:
MEDIUM
Description:
Skype
Version:
8.29.0.50
3816"C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" --reporter-url=https://rink.hockeyapp.net/api/2/apps/a741743329d94bc08826af367733939d/crashes/upload --application-name=skype-preview "--crashes-directory=C:\Users\admin\AppData\Local\Temp\skype-preview Crashes" --v=1C:\Program Files\Microsoft\Skype for Desktop\Skype.exe
Skype.exe
User:
admin
Company:
Skype Technologies S.A.
Integrity Level:
MEDIUM
Description:
Skype
Exit code:
2
Version:
8.29.0.50
Total events
203
Read events
189
Write events
14
Delete events
0

Modification events

(PID) Process:(1208) reg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Skype for Desktop
Value:
C:\Program Files\Microsoft\Skype for Desktop\Skype.exe
(PID) Process:(2576) Skype.exeKey:HKEY_CLASSES_ROOT\skype
Operation:writeName:URL Protocol
Value:
(PID) Process:(2576) Skype.exeKey:HKEY_CLASSES_ROOT\skype
Operation:writeName:(default)
Value:
URL:skype
(PID) Process:(2576) Skype.exeKey:HKEY_CLASSES_ROOT\skype\shell\open\command
Operation:writeName:(default)
Value:
"C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" -- "%1"
(PID) Process:(2576) Skype.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
0
Suspicious files
6
Text files
17
Unknown types
0

Dropped files

PID
Process
Filename
Type
2524AutoClicker.exeC:\Users\admin\AppData\Local\Temp\ymnqcxd —
MD5:—
SHA256:—
2576Skype.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\G9WGZC7PIYA3OWIPQD96.temp —
MD5:—
SHA256:—
2576Skype.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b916037c1e115fe0.customDestinations-msbinary
MD5:830334DFFAC1D267CEFAA944EAF598DC
SHA256:E53573DE6A7326431572B877A149D26A1708BA49EA0D83AAEF626A69C265F8BE
2864Skype.exeC:\Users\admin\AppData\Local\Temp\skype-preview Crashes\operation_log.txttext
MD5:08CEE36ABFA5F8DDC196616E336A9148
SHA256:A8BCCC26F8D39A461BCE475E57A4FFFBAE4D4A3EFF745C59FFDDE85B54A7D1A4
2576Skype.exeC:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\f_000005compressed
MD5:2D13B9ABA64F53725898C384C41C87ED
SHA256:BED4846EBE63F5E5B7F8754D93816F97B767C6ED05C12F2C5FB3BAE8CA5BA609
2524AutoClicker.exeC:\Users\admin\AppData\Local\Temp\ACLib\playback.icoimage
MD5:A20254EA7F9EF810C1681FA314EDAA28
SHA256:5375290E66A20BFF81FB4D80346756F2D442184789681297CD1B84446A3FE80D
2576Skype.exeC:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\ecscache.jsontext
MD5:EE60595B1D19C9CE3AF19CA04A3B40A4
SHA256:140E47394F0ACBCDA932225D92D7D1C346E92FEC9AA123B8FB58CE8AD4802CEC
2576Skype.exeC:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\IndexedDB\file__0.indexeddb.leveldb\000003.logbinary
MD5:8E4044620496A58BF07101249A1E91AC
SHA256:C2CABBC61B43BF20BD2F146A170DDA438D7640D412F7761950AB3AA08CAC6E2F
2888Skype.exeC:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\slimcore-1-1351157025.blogbinary
MD5:4893F35B7FBBD309964654795BB548E3
SHA256:C7CE4AA141B14927AA3870FF756F59B9A060A2101AE30681B207AD39419A5C55
2576Skype.exeC:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\IndexedDB\file__0.indexeddb.leveldb\LOGtext
MD5:299B7B6EB840222FC9BB7CA9FFC8EB91
SHA256:1AF581C4E287182830747D9C6856D1CAABD58532DE9B5AFB2D79CED5CA2CAF9F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
11
DNS requests
9
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2576
Skype.exe
216.58.205.234:443
www.googleapis.com
Google Inc.
US
whitelisted
2576
Skype.exe
23.210.249.5:443
download.skype.com
Akamai International B.V.
NL
whitelisted
2576
Skype.exe
52.114.75.78:443
pipe.skype.com
Microsoft Corporation
NL
unknown
2576
Skype.exe
13.107.42.23:443
a.config.skype.com
Microsoft Corporation
US
suspicious
—
—
52.174.193.75:443
get.skype.com
Microsoft Corporation
NL
whitelisted
2576
Skype.exe
152.199.19.160:443
bot-framework.azureedge.net
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2576
Skype.exe
52.233.180.130:443
avatar.skype.com
Microsoft Corporation
NL
unknown
2576
Skype.exe
52.114.76.35:443
browser.pipe.aria.microsoft.com
Microsoft Corporation
IE
whitelisted

DNS requests

Domain
IP
Reputation
get.skype.com
  • 52.174.193.75
whitelisted
a.config.skype.com
  • 13.107.42.23
whitelisted
download.skype.com
  • 23.210.249.5
whitelisted
pipe.skype.com
  • 52.114.75.78
whitelisted
www.googleapis.com
  • 216.58.205.234
  • 216.58.206.10
  • 172.217.18.170
  • 216.58.207.42
  • 172.217.22.106
  • 172.217.16.202
  • 172.217.21.234
  • 172.217.16.170
  • 216.58.210.10
  • 172.217.23.106
  • 216.58.212.138
  • 172.217.22.42
  • 172.217.16.138
  • 172.217.18.106
  • 172.217.22.10
  • 216.58.212.170
whitelisted
avatar.skype.com
  • 52.233.180.130
whitelisted
bot-framework.azureedge.net
  • 152.199.19.160
whitelisted
config.edge.skype.com
  • 13.107.42.23
whitelisted
browser.pipe.aria.microsoft.com
  • 52.114.76.35
whitelisted

Threats

No threats detected
Process
Message
Skype.exe
[2864:2852:0930/150642.685:VERBOSE1:crash_service_main.cc(78)] Session start. cmdline is [--reporter-url=https://rink.hockeyapp.net/api/2/apps/a741743329d94bc08826af367733939d/crashes/upload --application-name=skype-preview "--crashes-directory=C:\Users\admin\AppData\Local\Temp\skype-preview Crashes" --v=1]
Skype.exe
[2864:2852:0930/150642.686:VERBOSE1:crash_service.cc(145)] window handle is 000101D0
Skype.exe
[2864:2852:0930/150642.687:VERBOSE1:crash_service.cc(300)] pipe name is \\.\pipe\skype-preview Crash Service dumps at C:\Users\admin\AppData\Local\Temp\skype-preview Crashes
Skype.exe
[2864:2852:0930/150642.687:VERBOSE1:crash_service.cc(304)] checkpoint is C:\Users\admin\AppData\Local\Temp\skype-preview Crashes\crash_checkpoint.txt server is https://rink.hockeyapp.net/api/2/apps/a741743329d94bc08826af367733939d/crashes/upload maximum 128 reports/day reporter is electron-crash-service
Skype.exe
[2864:2852:0930/150642.687:ERROR:crash_service.cc(311)] could not start dumper
Skype.exe
[3816:4068:0930/150647.713:VERBOSE1:crash_service_main.cc(78)] Session start. cmdline is [--reporter-url=https://rink.hockeyapp.net/api/2/apps/a741743329d94bc08826af367733939d/crashes/upload --application-name=skype-preview "--crashes-directory=C:\Users\admin\AppData\Local\Temp\skype-preview Crashes" --v=1]
Skype.exe
[3816:4068:0930/150647.714:VERBOSE1:crash_service.cc(145)] window handle is 000101D8
Skype.exe
[3816:4068:0930/150647.714:VERBOSE1:crash_service.cc(300)] pipe name is \\.\pipe\skype-preview Crash Service dumps at C:\Users\admin\AppData\Local\Temp\skype-preview Crashes
Skype.exe
[3816:4068:0930/150647.715:VERBOSE1:crash_service.cc(304)] checkpoint is C:\Users\admin\AppData\Local\Temp\skype-preview Crashes\crash_checkpoint.txt server is https://rink.hockeyapp.net/api/2/apps/a741743329d94bc08826af367733939d/crashes/upload maximum 128 reports/day reporter is electron-crash-service
Skype.exe
[3816:4068:0930/150647.715:ERROR:crash_service.cc(311)] could not start dumper
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
AutoClicker.exe