File name: | AutoClicker.exe |
Full analysis: | https://app.any.run/tasks/f0b0c843-fb05-472e-b384-cdd327f4379b |
Verdict: | Malicious activity |
Analysis date: | June 16, 2019, 05:35:09 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | 7ECFC8CD7455DD9998F7DAD88F2A8A9D |
SHA1: | 1751D9389ADB1E7187AFA4938A3559E58739DCE6 |
SHA256: | 2E67D5E7D96AEC62A9DDA4C0259167A44908AF863C2B3AF2A019723205ABBA9E |
SSDEEP: | 12288:GaWzgMg7v3qnCiWErQohh0F49CJ8lnybQg9BFg9UmTRHlM:BaHMv6CGrjBnybQg+mmhG |
.exe | | | Win64 Executable (generic) (64.6) |
---|---|---|
.dll | | | Win32 Dynamic Link Library (generic) (15.4) |
.exe | | | Win32 Executable (generic) (10.5) |
.exe | | | Generic Win/DOS Executable (4.6) |
.exe | | | DOS Executable Generic (4.6) |
ProductVersion: | 3 |
---|---|
ProductName: | OP Auto Clicker |
LegalCopyright: | www.opautoclicker.com |
FileVersion: | 3 |
FileDescription: | OP Auto Clicker |
Comments: | www.opautoclicker.com |
CharacterSet: | Unicode |
LanguageCode: | English (U.S.) |
FileSubtype: | - |
ObjectFileType: | Unknown |
FileOS: | Win32 |
FileFlags: | (none) |
FileFlagsMask: | 0x0000 |
ProductVersionNumber: | 3.0.0.0 |
FileVersionNumber: | 3.0.0.0 |
Subsystem: | Windows GUI |
SubsystemVersion: | 5 |
ImageVersion: | - |
OSVersion: | 5 |
EntryPoint: | 0x16310 |
UninitializedDataSize: | - |
InitializedDataSize: | 126976 |
CodeSize: | 524800 |
LinkerVersion: | 9 |
PEType: | PE32 |
TimeStamp: | 2019:03:14 21:01:24+01:00 |
MachineType: | Intel 386 or later, and compatibles |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2116 | "C:\Users\admin\AppData\Local\Temp\AutoClicker.exe" | C:\Users\admin\AppData\Local\Temp\AutoClicker.exe | — | explorer.exe |
User: admin Integrity Level: MEDIUM Description: OP Auto Clicker Version: 3.0 | ||||
2164 | "C:\Windows\system32\UserAccountControlSettings.exe" | C:\Windows\system32\UserAccountControlSettings.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: UserAccountControlSettings Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3104 | C:\Windows\system32\DllHost.exe /Processid:{EA2C6B24-C590-457B-BAC8-4A0F9B13B5B8} | C:\Windows\system32\DllHost.exe | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: COM Surrogate Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1512 | C:\Windows\system32\DllHost.exe /Processid:{06C792F8-6212-4F39-BF70-E8C0AC965C23} | C:\Windows\system32\DllHost.exe | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: COM Surrogate Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3536 | "C:\Windows\system32\UserAccountControlSettings.exe" /applySettings | C:\Windows\system32\UserAccountControlSettings.exe | DllHost.exe | |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: UserAccountControlSettings Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3628 | "C:\Windows\system32\UserAccountControlSettings.exe" | C:\Windows\system32\UserAccountControlSettings.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: UserAccountControlSettings Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
124 | C:\Windows\system32\DllHost.exe /Processid:{EA2C6B24-C590-457B-BAC8-4A0F9B13B5B8} | C:\Windows\system32\DllHost.exe | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: COM Surrogate Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2152 | C:\Windows\system32\DllHost.exe /Processid:{06C792F8-6212-4F39-BF70-E8C0AC965C23} | C:\Windows\system32\DllHost.exe | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: COM Surrogate Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2148 | "C:\Windows\system32\UserAccountControlSettings.exe" /applySettings | C:\Windows\system32\UserAccountControlSettings.exe | DllHost.exe | |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: UserAccountControlSettings Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
(PID) Process: | (1512) DllHost.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
(PID) Process: | (1512) DllHost.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 1 | |||
(PID) Process: | (3104) DllHost.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System |
Operation: | write | Name: | EnableLUA |
Value: 0 | |||
(PID) Process: | (3104) DllHost.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System |
Operation: | write | Name: | ConsentPromptBehaviorAdmin |
Value: 0 | |||
(PID) Process: | (3104) DllHost.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System |
Operation: | write | Name: | PromptOnSecureDesktop |
Value: 0 | |||
(PID) Process: | (2152) DllHost.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
(PID) Process: | (2152) DllHost.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 1 | |||
(PID) Process: | (124) DllHost.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System |
Operation: | write | Name: | EnableLUA |
Value: 1 | |||
(PID) Process: | (124) DllHost.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System |
Operation: | write | Name: | ConsentPromptBehaviorAdmin |
Value: 2 | |||
(PID) Process: | (124) DllHost.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System |
Operation: | write | Name: | PromptOnSecureDesktop |
Value: 1 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2116 | AutoClicker.exe | C:\Users\admin\AppData\Local\Temp\uuehsle | — | |
MD5:— | SHA256:— | |||
2116 | AutoClicker.exe | C:\Users\admin\AppData\Local\Temp\ACLib\stop.ico | image | |
MD5:7824CEFAD2522BE614AE5B7BDBF88339 | SHA256:9E869F60EA0A0DE06C7D562FF56D1AC53C534849C919E4B12344E73513649483 | |||
2116 | AutoClicker.exe | C:\Users\admin\AppData\Local\Temp\ACLib\record.ico | image | |
MD5:1111E06679F96FF28C1E229B06CE7B41 | SHA256:59D5E9106E907FA61A560294A51C14ABCDE024FDD690E41A7F4D6C88DB7287A6 | |||
2116 | AutoClicker.exe | C:\Users\admin\AppData\Local\Temp\ACLib\playback.ico | image | |
MD5:A20254EA7F9EF810C1681FA314EDAA28 | SHA256:5375290E66A20BFF81FB4D80346756F2D442184789681297CD1B84446A3FE80D |