577a7ec9e58665b9b840ce9618e2d330c065dc9a7d7b2109f52e392b77e839c4

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 03:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$SYSDIR/DWSHK80.dll
Size

200KB
MD5

956041a95acf9738b712c71c55672094
SHA1

84959e2c0b07d631de4f71da32e1c3c301285e68
SHA256

8413fe7000baca9e7a2fdef33922d17d97ef9d16799444b945b3c73fee953c6b
SHA512

c93085f6e4159e3a75e9167e036214930a3ec3960d5eb3e0812f164a841f60b1c3454bcc7a2227b7d0e80c303db11d322a1e6862d643a614c32e4d6b1798b298
SSDEEP

6144:BE0Jarr0dWt86FKhOO1ITPKFD7Mq0BTv:+0c3mWi6ElKR

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.MsgList	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{651520F0-B9D9-46CE-987F-C8697222B4B8}\ = "KeyPage PropertyPage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6968E7F-3422-4CB7-8F37-3951F4880511}\ProgID\ = "dwshk80.WinHook.8"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Dwshk80.DwshkPropPage	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Dwshk80.DwshkPropPage\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.RegMsg.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.MsgList\CurVer\ = "dwshk80.MsgList.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.HookPage.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C866B2C5-14CF-4908-8D11-7FA85FD63EC2}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6968E7F-3422-4CB7-8F37-3951F4880511}\MiscStatus\1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.HookPage.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C866B2C5-14CF-4908-8D11-7FA85FD63EC2}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$SYSDIR\\DWSHK80.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.KeyPage\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{22939DA9-C473-443F-B465-2F9F4F6A9720}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5FC14064-8342-4D18-947E-3BD813100F99}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6968E7F-3422-4CB7-8F37-3951F4880511}\VersionIndependentProgID\ = "Desaware dwshk80 v8 Hook Control"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2B8E6757-1A5E-4827-AF68-8A67E83C2D78}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$SYSDIR\\DWSHK80.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{15985491-68E2-49DD-9F73-BFC0DCAB8584}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.HookPage.1\CLSID\ = "{C866B2C5-14CF-4908-8D11-7FA85FD63EC2}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.KeyPage	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{70CA7ADF-1545-4085-A81F-260C365C5EF2}\8.0\ = "Desaware dwshk80 v8 Hook Control"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7FB96837-674C-407F-BBA0-CDC0D501512C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2FB87680-89AA-454B-BD65-59199E12D14B}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.MsgList.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{15985491-68E2-49DD-9F73-BFC0DCAB8584}\ = "MsgList PropertyPage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.HookPage\ = "HookPage ProppertyPage"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.KeyPage.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.HookPage\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{651520F0-B9D9-46CE-987F-C8697222B4B8}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{22939DA9-C473-443F-B465-2F9F4F6A9720}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5FC14064-8342-4D18-947E-3BD813100F99}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5FC14064-8342-4D18-947E-3BD813100F99}\ = "_DDwshkEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5FC14064-8342-4D18-947E-3BD813100F99}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.RegMsg\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2FB87680-89AA-454B-BD65-59199E12D14B}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2B8E6757-1A5E-4827-AF68-8A67E83C2D78}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2B8E6757-1A5E-4827-AF68-8A67E83C2D78}\ = "DwshkPropPage PropertyPage"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.RegMsg	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.MsgList.1\ = "MsgList PropertyPage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.MsgList\ = "MsgList PropertyPage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.KeyList\CurVer\ = "dwshk80.KeyList.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{70CA7ADF-1545-4085-A81F-260C365C5EF2}\8.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Dwshk80.DwshkPropPage\ = "DwshkPropPage PropertyPage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5FC14064-8342-4D18-947E-3BD813100F99}\ = "_DDwshkEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6968E7F-3422-4CB7-8F37-3951F4880511}\MiscStatus	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{22939DA9-C473-443F-B465-2F9F4F6A9720}\ = "KeyList PropertyPage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{70CA7ADF-1545-4085-A81F-260C365C5EF2}\8.0\FLAGS\ = "2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5FC14064-8342-4D18-947E-3BD813100F99}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5FC14064-8342-4D18-947E-3BD813100F99}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6968E7F-3422-4CB7-8F37-3951F4880511}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{15985491-68E2-49DD-9F73-BFC0DCAB8584}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C866B2C5-14CF-4908-8D11-7FA85FD63EC2}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.KeyList.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7FB96837-674C-407F-BBA0-CDC0D501512C}\ = "Idwshk35"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7FB96837-674C-407F-BBA0-CDC0D501512C}\TypeLib\ = "{70CA7ADF-1545-4085-A81F-260C365C5EF2}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6968E7F-3422-4CB7-8F37-3951F4880511}\MiscStatus\1\ = "132497"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.RegMsg\ = "RegMsg PropertyPage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6968E7F-3422-4CB7-8F37-3951F4880511}\Verb\0\ = "P&roperties,0,2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{15985491-68E2-49DD-9F73-BFC0DCAB8584}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.KeyPage.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.KeyPage\CurVer\ = "dwshk80.KeyPage.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.KeyList\ = "KeyList PropertyPage"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{70CA7ADF-1545-4085-A81F-260C365C5EF2}\8.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6968E7F-3422-4CB7-8F37-3951F4880511}\MiscStatus\ = "0"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 2292	1340	regsvr32.exe	28
PID 1340 wrote to memory of 2292	1340	regsvr32.exe	28
PID 1340 wrote to memory of 2292	1340	regsvr32.exe	28
PID 1340 wrote to memory of 2292	1340	regsvr32.exe	28
PID 1340 wrote to memory of 2292	1340	regsvr32.exe	28
PID 1340 wrote to memory of 2292	1340	regsvr32.exe	28
PID 1340 wrote to memory of 2292	1340	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$SYSDIR\DWSHK80.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$SYSDIR\DWSHK80.dll
  2⤵
  - Modifies registry class
  PID:2292

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads