f3dd9d5995779b08a838549d9b4e509b5199dd24316e136574f4eb48adfc4f7a

Analysis

max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/10/2026, 15:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MyDockFinder.v1.10.4/MyDockFinder.v1.10.4/Mydock_update.exe
Size 228KB
Sample261020-s6y8dsbw8y
SHA256 f3dd9d5995779b08a838549d9b4e509b5199dd24316e136574f4eb48adfc4f7a
MD5 32d5f3634c7e80a6140fae8f183ed125
SHA1 bea003ea4513d049792ad6857273cc862378a7a8
SHA512 c5edcab16095c637c0453bff27b769b503206c295222136cd6714359cfe8354db09c72fe3c3092e9aa8f38786522ff6d214ba288fc84c8b3c8d5546527ea41e2
SSDEEP 3072:Th5CWxXepbEvX6IpQrRXAJ2gzPQGuOfa3baGEVddHrkd2czwcz+eg:t5CWxOBEv2rqsaxdCd2KwK+P
TLSH
T1FA34491237C0C872E6650A3618A09FB15B7DFD203F51DE9B33E8772D4E702D16A2696B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	Dock_64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dockmod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mydock_update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5344	Mydock_update.exe
5344	Mydock_update.exe
4476	Dock_64.exe
4476	Dock_64.exe
4476	Dock_64.exe
4476	Dock_64.exe
4476	Dock_64.exe
4476	Dock_64.exe
4476	Dock_64.exe
4476	Dock_64.exe
4476	Dock_64.exe
4476	Dock_64.exe
4476	Dock_64.exe
4476	Dock_64.exe
4476	Dock_64.exe
4476	Dock_64.exe
4476	Dock_64.exe
4476	Dock_64.exe
1340	Dock_64.exe
1340	Dock_64.exe
1340	Dock_64.exe
1340	Dock_64.exe
1340	Dock_64.exe
1340	Dock_64.exe
1340	Dock_64.exe
1340	Dock_64.exe
1340	Dock_64.exe
1340	Dock_64.exe
1340	Dock_64.exe
1340	Dock_64.exe
1340	Dock_64.exe
1340	Dock_64.exe
1340	Dock_64.exe
1340	Dock_64.exe
1340	Dock_64.exe
1340	Dock_64.exe
1340	Dock_64.exe
1340	Dock_64.exe
1340	Dock_64.exe
1340	Dock_64.exe
1340	Dock_64.exe
1340	Dock_64.exe
1340	Dock_64.exe
1340	Dock_64.exe
1340	Dock_64.exe
1340	Dock_64.exe
1340	Dock_64.exe
1340	Dock_64.exe
1340	Dock_64.exe
1340	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4768	Dock_64.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4768	Dock_64.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4476	Dock_64.exe
Token: SeDebugPrivilege	1340	Dock_64.exe
Token: SeDebugPrivilege	4768	Dock_64.exe
Token: SeShutdownPrivilege	4768	Dock_64.exe
Token: SeCreatePagefilePrivilege	4768	Dock_64.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe
4768	Dock_64.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4268	explorer.exe
4180	explorer.exe
1144	explorer.exe
4768	Dock_64.exe
5644	PickerHost.exe
2404	Dockmod64.exe
2404	Dockmod64.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5344 wrote to memory of 2900	5344	Mydock_update.exe	88
PID 4268 wrote to memory of 4476	4268	explorer.exe	90
PID 5344 wrote to memory of 4524	5344	Mydock_update.exe	91
PID 4180 wrote to memory of 1340	4180	explorer.exe	93
PID 5344 wrote to memory of 4324	5344	Mydock_update.exe	94
PID 1144 wrote to memory of 4768	1144	explorer.exe	96
PID 5688 wrote to memory of 2404	5688	dockmod.exe	101

C:\Users\Admin\AppData\Local\Temp\MyDockFinder.v1.10.4\MyDockFinder.v1.10.4\Mydock_update.exe
"C:\Users\Admin\AppData\Local\Temp\MyDockFinder.v1.10.4\MyDockFinder.v1.10.4\Mydock_update.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5344
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Local\Temp\MyDockFinder.v1.10.4\MyDockFinder.v1.10.4\dock_64.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2900
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Local\Temp\MyDockFinder.v1.10.4\MyDockFinder.v1.10.4\dock_64.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4524
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Local\Temp\MyDockFinder.v1.10.4\MyDockFinder.v1.10.4\dock_64.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4324

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Users\Admin\AppData\Local\Temp\MyDockFinder.v1.10.4\MyDockFinder.v1.10.4\Dock_64.exe
  "C:\Users\Admin\AppData\Local\Temp\MyDockFinder.v1.10.4\MyDockFinder.v1.10.4\Dock_64.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4476

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Users\Admin\AppData\Local\Temp\MyDockFinder.v1.10.4\MyDockFinder.v1.10.4\Dock_64.exe
  "C:\Users\Admin\AppData\Local\Temp\MyDockFinder.v1.10.4\MyDockFinder.v1.10.4\Dock_64.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1340

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Users\Admin\AppData\Local\Temp\MyDockFinder.v1.10.4\MyDockFinder.v1.10.4\Dock_64.exe
  "C:\Users\Admin\AppData\Local\Temp\MyDockFinder.v1.10.4\MyDockFinder.v1.10.4\Dock_64.exe"
  2⤵
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s ConsentUxUserSvc
1⤵
PID:1220

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2668

C:\Users\Admin\AppData\Local\Temp\MyDockFinder.v1.10.4\MyDockFinder.v1.10.4\dockmod.exe
"C:\Users\Admin\AppData\Local\Temp\MyDockFinder.v1.10.4\MyDockFinder.v1.10.4\dockmod.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5688
- C:\Users\Admin\AppData\Local\Temp\MyDockFinder.v1.10.4\MyDockFinder.v1.10.4\Dockmod64.exe
  "C:\Users\Admin\AppData\Local\Temp\MyDockFinder.v1.10.4\MyDockFinder.v1.10.4\Dockmod64.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

config.ini

Path C:\Users\Admin\AppData\Local\Temp\MyDockFinder.v1.10.4\MyDockFinder.v1.10.4\config.ini
Size 1KB
SHA256 789d844c1d7633a2a812c81d6da712d170a28cd3aaef5414bbc093e4fb8c42b8
MD5 f4046f1946909d0477a9adb58e8590d5
SHA1 aa0b91a089ed6e455015e167484e37e3826cc065
SHA512 62f8136dfc21bfa051d0ebde300005ac2653087ce14d0c9e394bfb6692e66b73522ad704979cdb9bb1dac97643dabcace93b7bd5e8ef83a5cbed5a6ebc84c129
TLSH
T1C23124A34AF907B4F2F26664E9BC65701F62B945241EC10CF0D1460E0CE2E819C63BEF
MD5 SHA1 SHA512 TLSH

Submit Download

config.ini

Path C:\Users\Admin\AppData\Local\Temp\MyDockFinder.v1.10.4\MyDockFinder.v1.10.4\config.ini
Size 1KB
SHA256 4c7a4832dac95f0d978dbae46a3d6390664ea8392e7f65fd38bebd2ebfc7c692
MD5 4b52589d3e5d3d8a0dc9dae6711c7d6b
SHA1 43b4c35fa499622798cc10a02612ef359de1089e
SHA512 c3be88351d416fb180f75f5bb62385e9503d8f3a6fbc6c948637e0b510946aa165b099e7c025a51b6b8445e00da1b2dd65e1b8f7eb4a2b6bc6c842b0e345aecd
TLSH
T13B3135A346F90674F2F36A24E9BCA9701F72B945281EC10CF1D1414E0CE5E81AC23BEB
MD5 SHA1 SHA512 TLSH

Submit Download

config.ini

Path C:\Users\Admin\AppData\Local\Temp\MyDockFinder.v1.10.4\MyDockFinder.v1.10.4\config.ini
Size 1KB
SHA256 bba033b4668c20b053e890130a1bda4583338045247d08b8ef02e4d563eb615d
MD5 e4cd15f2161c1c1fda8d72275471acad
SHA1 4b722049e9bcee2fa2d88c8b4544a9add6a7430b
SHA512 70c95514e8ffe1abc8822b8f06b95295468249bc110c46a39f431501ffedef4fe671d5c6882449a56ac676876069ef7f1b0a2193fd44a50c7560ed5dfb7f8bbc
TLSH
T1BE4148A346F90674F2F36A24E9BC69701F72B946281EC10CE0D1414E4DF5E819C237EB
MD5 SHA1 SHA512 TLSH

Submit Download

config.ini

Path C:\Users\Admin\AppData\Local\Temp\MyDockFinder.v1.10.4\MyDockFinder.v1.10.4\config.ini
Size 1KB
SHA256 95b756f8b35e8e54316add9b1c54df8434fe7e9d8b9a1b808723c3eb77cc4d0e
MD5 34ea46219b9834ef496cb422bbc66ad8
SHA1 f351165b2292e6f57c9223dfb17ef27042f262a6
SHA512 0b68ae4933f35b3f3b0c97499157966aa1b4e38367742201f8c5c45f45e8476ec4f274c9bec18765ab26b389cdd70751e8cbc6b8194339cc39ec07633d9e14c5
TLSH
T1123124A34AE91774F2F36664E9BC65711F62B845282EC10CF0D1420E0CE6E819C63BEF
MD5 SHA1 SHA512 TLSH

Submit Download

ico.ini

Path C:\Users\Admin\AppData\Local\Temp\MyDockFinder.v1.10.4\MyDockFinder.v1.10.4\ico.ini
Size 556B
SHA256 8624186c73cf955ad9a05687a83b60ed000d73f590dc9e709b5423c5699f6375
MD5 cd81e42f3c9340823a0e6326aafd23b0
SHA1 917bd5ca117453f14d3f369a63401510e6060bd5
SHA512 b84c5ed0fa10e3f405c0eb9e575f0cad84444436fd11e33ba53a4431cd5f5242c5ac4dce5a79019138784f6e638dbb67ba2cce7bdfc3b02fccf2deedbc69866e
TLSH
T132F074273FEB2609BEB34A42FC74A1B46F7D782D645EC25C02C4564988F7B014912BE7
MD5 SHA1 SHA512 TLSH

Submit Download

ico_back.ini

Path C:\Users\Admin\AppData\Local\Temp\MyDockFinder.v1.10.4\MyDockFinder.v1.10.4\ico_back.ini
Size 684B
SHA256 f092720988a791deb6516276baf91163b5eece9cb2fd48f51abf6e71dfe170b1
MD5 de115f670b54f36384d07e7e46f355eb
SHA1 43fd630e2a0b62de13bde3913701ebb944fb6629
SHA512 139deabce53a7141f8133712054f6f3cbdcc94b2deb91ead80456262cc5bed0362f90abebb13749c5f0a43c882be99509e115df2a1b4f7a30ece5cc871434d07
TLSH
T1A201CD2B3BE72509FEB34A42E87491746B3E7829641EC14C02C4560988F7A115412BE7
MD5 SHA1 SHA512 TLSH

Submit Download

keyboard.ini

Path C:\Users\Admin\AppData\Local\Temp\MyDockFinder.v1.10.4\MyDockFinder.v1.10.4\keyboard.ini
Size 120B
SHA256 1918c9be8999655042e4afcc6fba777b8ffc800ad597721166e82f5667faf69f
MD5 38057ee97834f89a54ffc270dfa9ff8a
SHA1 df2cd88d061f3e691bec87c8bb3f0c706eb03f40
SHA512 23a920dd485fcd0f96b6aaf2480b10fcabf845cbdea3b90a11d2d64652de1a4e9ca7a1669c7615a71f28cec52eeea7dc2dcd237b8d6bd05f30310a911495c2c2
TLSH
T191B0023759E5457F69F31344E8D845B32B517C5A545ED59C1DC0534C10E160105565F3
MD5 SHA1 SHA512 TLSH

Submit Download

achievements.ini

Path C:\Users\Public\Documents\Steam\RUNE\1787090\achievements.ini
Size 32B
SHA256 bd583fdedda922bfc385b7872db9329d4d61c4548852fa8207ebe72b5af8eb2e
MD5 7ebba17ad01ef8b82fe01c5a15a31634
SHA1 29f8ac51d89a7d3f300e765685f5230edb0c9752
SHA512 05bdb5e1d7e4429c0b33b13fd29f43b92d174260480348e12fb3dbe0f603dc44146db142cbf3bbc5ef09e6f7d86a269abba15d4ce0a80bffa9c38e31af33e04e
MD5 SHA1 SHA512

Submit Download

leaderboards.ini

Path C:\Users\Public\Documents\Steam\RUNE\1787090\leaderboards.ini
Size 32B
SHA256 749be0285d916625e06e0b5273889c2ede421b1f16f765cf817870fcec8c2930
MD5 d03f6a84b07a97dd09a27efb9acd8d1d
SHA1 3e27d5f859bdd0822dfacdb5510ee88dd2834496
SHA512 659db10eb03cb17a4dea5190889d9723a7a7cb705b11685f5912f3ea667375ae2502e5c6101b07687ef48f03902e9b1fa890c9e328947626528dca485a21018a
MD5 SHA1 SHA512

Submit Download

memory/1340-53-0x00007FFD2EC50000-0x00007FFD2ED6B000-memory.dmp

Download

memory/1340-49-0x00007FFD2EC50000-0x00007FFD2ED6B000-memory.dmp

Download

memory/4476-54-0x00007FFD2EC50000-0x00007FFD2ED6B000-memory.dmp

Download

memory/4476-0-0x00007FFD2EC50000-0x00007FFD2ED6B000-memory.dmp

Download

memory/4768-55-0x00007FFD322B0000-0x00007FFD323CB000-memory.dmp

Download

memory/4768-413-0x00007FFD322B0000-0x00007FFD323CB000-memory.dmp

Download

memory/4768-424-0x00007FFD322B0000-0x00007FFD323CB000-memory.dmp

Download