42b18379c5e638184ed4a8fda01926eaa0583ab0a4a37f42c995fe18cb64b93b

Analysis

max time kernel
146s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 13:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42b18379c5e638184ed4a8fda01926eaa0583ab0a4a37f42c995fe18cb64b93b.exe
Size

38.0MB
MD5

7174690c3be785ad79e2d8260febff79
SHA1

d1134571ed3ac91da130e5c11765eb2ed7d29865
SHA256

42b18379c5e638184ed4a8fda01926eaa0583ab0a4a37f42c995fe18cb64b93b
SHA512

d0b4f8a47f8f486d7edffa059a1c86563680264f99776a0c7f2f275e1a07128bf88bcdc9c3a71900721923effe1bd2c963367040e206e1efd080b57e1280caba
SSDEEP

786432:YSmXO8MHAyltfQktxY23oHzOkSBf3OOw9:lm+86tfQuxCikW/O5

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
780	Docklight.v1.9.21_setup.exe

Loads dropped DLL 1 IoCs

pid	Process
1308	42b18379c5e638184ed4a8fda01926eaa0583ab0a4a37f42c995fe18cb64b93b.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	42b18379c5e638184ed4a8fda01926eaa0583ab0a4a37f42c995fe18cb64b93b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\42b18379c5e638184ed4a8fda01926eaa0583ab0a4a37f42c995fe18cb64b93b = "C:\\Users\\Public\\Iebft\\Ieesp.exe /42b18379c5e638184ed4a8fda01926eaa0583ab0a4a37f42c995fe18cb64b93b"	42b18379c5e638184ed4a8fda01926eaa0583ab0a4a37f42c995fe18cb64b93b.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	Docklight.v1.9.21_setup.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
780	Docklight.v1.9.21_setup.exe
780	Docklight.v1.9.21_setup.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 780	1308	42b18379c5e638184ed4a8fda01926eaa0583ab0a4a37f42c995fe18cb64b93b.exe	28
PID 1308 wrote to memory of 780	1308	42b18379c5e638184ed4a8fda01926eaa0583ab0a4a37f42c995fe18cb64b93b.exe	28
PID 1308 wrote to memory of 780	1308	42b18379c5e638184ed4a8fda01926eaa0583ab0a4a37f42c995fe18cb64b93b.exe	28
PID 1308 wrote to memory of 780	1308	42b18379c5e638184ed4a8fda01926eaa0583ab0a4a37f42c995fe18cb64b93b.exe	28
PID 1308 wrote to memory of 780	1308	42b18379c5e638184ed4a8fda01926eaa0583ab0a4a37f42c995fe18cb64b93b.exe	28
PID 1308 wrote to memory of 780	1308	42b18379c5e638184ed4a8fda01926eaa0583ab0a4a37f42c995fe18cb64b93b.exe	28
PID 1308 wrote to memory of 780	1308	42b18379c5e638184ed4a8fda01926eaa0583ab0a4a37f42c995fe18cb64b93b.exe	28

C:\Users\Admin\AppData\Local\Temp\42b18379c5e638184ed4a8fda01926eaa0583ab0a4a37f42c995fe18cb64b93b.exe
"C:\Users\Admin\AppData\Local\Temp\42b18379c5e638184ed4a8fda01926eaa0583ab0a4a37f42c995fe18cb64b93b.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Users\Admin\AppData\Local\Temp\Ohgus853\Docklight.v1.9.21_setup.exe
  C:\Users\Admin\AppData\Local\Temp\Ohgus853\Docklight.v1.9.21_setup.exe
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:780

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Ohgus853\Docklight.v1.9.21_setup.exe

Filesize
3.0MB

MD5
55c14944083ced29441b6e91bab10d3a

SHA1
0df0c8a5d8ba562b7906ef91cb652875e87551c3

SHA256
a67f22826cd9a82b4a557d1d8c332ae01660f3924cd9c3c568a1b00cdf5b59cc

SHA512
1e08d633d020975d33162728b77bdff1512598d454ab4994692f07cdde0c56699bbd68d3adb752c2ce114a20f9e185570403932f4d78b87b13ff2ec22e06621f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ohgus853\Docklight.v1.9.21_setup.exe

Filesize
3.0MB

MD5
55c14944083ced29441b6e91bab10d3a

SHA1
0df0c8a5d8ba562b7906ef91cb652875e87551c3

SHA256
a67f22826cd9a82b4a557d1d8c332ae01660f3924cd9c3c568a1b00cdf5b59cc

SHA512
1e08d633d020975d33162728b77bdff1512598d454ab4994692f07cdde0c56699bbd68d3adb752c2ce114a20f9e185570403932f4d78b87b13ff2ec22e06621f

Download Submit
\Users\Admin\AppData\Local\Temp\Ohgus853\Docklight.v1.9.21_setup.exe

Filesize
3.0MB

MD5
55c14944083ced29441b6e91bab10d3a

SHA1
0df0c8a5d8ba562b7906ef91cb652875e87551c3

SHA256
a67f22826cd9a82b4a557d1d8c332ae01660f3924cd9c3c568a1b00cdf5b59cc

SHA512
1e08d633d020975d33162728b77bdff1512598d454ab4994692f07cdde0c56699bbd68d3adb752c2ce114a20f9e185570403932f4d78b87b13ff2ec22e06621f

Download Submit
memory/780-56-0x0000000000000000-mapping.dmp

Download
memory/1308-54-0x0000000076941000-0x0000000076943000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads