577a7ec9e58665b9b840ce9618e2d330c065dc9a7d7b2109f52e392b77e839c4

Analysis

max time kernel
139s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 03:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$SYSDIR/DWSHK80.dll
Size

200KB
MD5

956041a95acf9738b712c71c55672094
SHA1

84959e2c0b07d631de4f71da32e1c3c301285e68
SHA256

8413fe7000baca9e7a2fdef33922d17d97ef9d16799444b945b3c73fee953c6b
SHA512

c93085f6e4159e3a75e9167e036214930a3ec3960d5eb3e0812f164a841f60b1c3454bcc7a2227b7d0e80c303db11d322a1e6862d643a614c32e4d6b1798b298
SSDEEP

6144:BE0Jarr0dWt86FKhOO1ITPKFD7Mq0BTv:+0c3mWi6ElKR

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.KeyPage.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{651520F0-B9D9-46CE-987F-C8697222B4B8}\ = "KeyPage PropertyPage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6968E7F-3422-4CB7-8F37-3951F4880511}\TypeLib\ = "{70CA7ADF-1545-4085-A81F-260C365C5EF2}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{15985491-68E2-49DD-9F73-BFC0DCAB8584}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$SYSDIR\\DWSHK80.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C866B2C5-14CF-4908-8D11-7FA85FD63EC2}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{651520F0-B9D9-46CE-987F-C8697222B4B8}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.KeyList.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{22939DA9-C473-443F-B465-2F9F4F6A9720}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.RegMsg.1\ = "RegMsg PropertyPage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2FB87680-89AA-454B-BD65-59199E12D14B}\ = "RegMsg PropertyPage"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2FB87680-89AA-454B-BD65-59199E12D14B}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.HookPage.1\CLSID\ = "{C866B2C5-14CF-4908-8D11-7FA85FD63EC2}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.KeyPage\ = "KeyPage PropertyPage"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{651520F0-B9D9-46CE-987F-C8697222B4B8}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{70CA7ADF-1545-4085-A81F-260C365C5EF2}\8.0\ = "Desaware dwshk80 v8 Hook Control"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5FC14064-8342-4D18-947E-3BD813100F99}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.WinHook.8	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6968E7F-3422-4CB7-8F37-3951F4880511}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B8E6757-1A5E-4827-AF68-8A67E83C2D78}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.MsgList\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.WinHook.8\ = "Desaware dwshk80 v8 Hook Control"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6968E7F-3422-4CB7-8F37-3951F4880511}\MiscStatus\1\ = "132497"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B8E6757-1A5E-4827-AF68-8A67E83C2D78}\ = "DwshkPropPage PropertyPage"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.RegMsg\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{70CA7ADF-1545-4085-A81F-260C365C5EF2}\8.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$SYSDIR\\DWSHK80.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5FC14064-8342-4D18-947E-3BD813100F99}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6968E7F-3422-4CB7-8F37-3951F4880511}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6968E7F-3422-4CB7-8F37-3951F4880511}\MiscStatus\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6968E7F-3422-4CB7-8F37-3951F4880511}\MiscStatus\1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Dwshk80.DwshkPropPage\ = "DwshkPropPage PropertyPage"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.MsgList.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{70CA7ADF-1545-4085-A81F-260C365C5EF2}\8.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{70CA7ADF-1545-4085-A81F-260C365C5EF2}\8.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6968E7F-3422-4CB7-8F37-3951F4880511}\Control	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6968E7F-3422-4CB7-8F37-3951F4880511}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{651520F0-B9D9-46CE-987F-C8697222B4B8}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7FB96837-674C-407F-BBA0-CDC0D501512C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5FC14064-8342-4D18-947E-3BD813100F99}\TypeLib\ = "{70CA7ADF-1545-4085-A81F-260C365C5EF2}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.WinHook	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{22939DA9-C473-443F-B465-2F9F4F6A9720}\ = "KeyList PropertyPage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{22939DA9-C473-443F-B465-2F9F4F6A9720}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$SYSDIR\\DWSHK80.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6968E7F-3422-4CB7-8F37-3951F4880511}\Version\ = "8.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.HookPage\CurVer\ = "dwshk80.HookPage.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{651520F0-B9D9-46CE-987F-C8697222B4B8}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{22939DA9-C473-443F-B465-2F9F4F6A9720}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6968E7F-3422-4CB7-8F37-3951F4880511}\ = "Desaware dwshk80 v8 Hook Control"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C866B2C5-14CF-4908-8D11-7FA85FD63EC2}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C866B2C5-14CF-4908-8D11-7FA85FD63EC2}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$SYSDIR\\DWSHK80.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.KeyPage\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.KeyList.1\ = "KeyList PropertyPage"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{70CA7ADF-1545-4085-A81F-260C365C5EF2}\8.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5FC14064-8342-4D18-947E-3BD813100F99}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B8E6757-1A5E-4827-AF68-8A67E83C2D78}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2FB87680-89AA-454B-BD65-59199E12D14B}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2FB87680-89AA-454B-BD65-59199E12D14B}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$SYSDIR\\DWSHK80.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.HookPage\ = "HookPage ProppertyPage"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.HookPage\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.KeyList	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.KeyList\ = "KeyList PropertyPage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7FB96837-674C-407F-BBA0-CDC0D501512C}\ = "Idwshk35"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Dwshk80.DwshkPropPage.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5FC14064-8342-4D18-947E-3BD813100F99}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{651520F0-B9D9-46CE-987F-C8697222B4B8}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$SYSDIR\\DWSHK80.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{70CA7ADF-1545-4085-A81F-260C365C5EF2}\8.0\FLAGS\ = "2"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 2708	4412	regsvr32.exe	90
PID 4412 wrote to memory of 2708	4412	regsvr32.exe	90
PID 4412 wrote to memory of 2708	4412	regsvr32.exe	90

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$SYSDIR\DWSHK80.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$SYSDIR\DWSHK80.dll
  2⤵
  - Modifies registry class
  PID:2708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1304,i,8660989700097327804,17931739887231169645,262144 --variations-seed-version --mojo-platform-channel-handle=1300 /prefetch:8
1⤵
PID:3108

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads