59c995dd4d2e86e4fb4f34f353fd0b8a23f44a2774599a1e864514d0f74e6ae7

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$SYSDIR/DWSHK80.dll
Size 200KB
Sample240620-pczehs1bpr
SHA256 8413fe7000baca9e7a2fdef33922d17d97ef9d16799444b945b3c73fee953c6b
MD5 956041a95acf9738b712c71c55672094
SHA1 84959e2c0b07d631de4f71da32e1c3c301285e68
SHA512 c93085f6e4159e3a75e9167e036214930a3ec3960d5eb3e0812f164a841f60b1c3454bcc7a2227b7d0e80c303db11d322a1e6862d643a614c32e4d6b1798b298
SSDEEP 6144:BE0Jarr0dWt86FKhOO1ITPKFD7Mq0BTv:+0c3mWi6ElKR
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6968E7F-3422-4CB7-8F37-3951F4880511}\Control	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6968E7F-3422-4CB7-8F37-3951F4880511}\ToolboxBitmap32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.MsgList\ = "MsgList PropertyPage"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C866B2C5-14CF-4908-8D11-7FA85FD63EC2}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5FC14064-8342-4D18-947E-3BD813100F99}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Dwshk80.DwshkPropPage\CurVer\ = "Dwshk80.DwshkPropPage.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.RegMsg.1\CLSID\ = "{2FB87680-89AA-454B-BD65-59199E12D14B}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.RegMsg	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.KeyPage\ = "KeyPage PropertyPage"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.KeyList	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7FB96837-674C-407F-BBA0-CDC0D501512C}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5FC14064-8342-4D18-947E-3BD813100F99}\ = "_DDwshkEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6968E7F-3422-4CB7-8F37-3951F4880511}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Dwshk80.DwshkPropPage	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.KeyPage.1\ = "KeyPage PropertyPage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{651520F0-B9D9-46CE-987F-C8697222B4B8}\ = "KeyPage PropertyPage"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{70CA7ADF-1545-4085-A81F-260C365C5EF2}\8.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7FB96837-674C-407F-BBA0-CDC0D501512C}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.WinHook.8\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6968E7F-3422-4CB7-8F37-3951F4880511}\Verb	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Dwshk80.DwshkPropPage.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.RegMsg.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.RegMsg\ = "RegMsg PropertyPage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.HookPage\CurVer\ = "dwshk80.HookPage.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{22939DA9-C473-443F-B465-2F9F4F6A9720}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5FC14064-8342-4D18-947E-3BD813100F99}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6968E7F-3422-4CB7-8F37-3951F4880511}\ = "Desaware dwshk80 v8 Hook Control"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2B8E6757-1A5E-4827-AF68-8A67E83C2D78}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2FB87680-89AA-454B-BD65-59199E12D14B}\ = "RegMsg PropertyPage"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{15985491-68E2-49DD-9F73-BFC0DCAB8584}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{15985491-68E2-49DD-9F73-BFC0DCAB8584}\ = "MsgList PropertyPage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.HookPage.1\ = "HookPage ProppertyPage"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.HookPage\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6968E7F-3422-4CB7-8F37-3951F4880511}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{15985491-68E2-49DD-9F73-BFC0DCAB8584}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$SYSDIR\\DWSHK80.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{70CA7ADF-1545-4085-A81F-260C365C5EF2}\8.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$SYSDIR\\DWSHK80.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7FB96837-674C-407F-BBA0-CDC0D501512C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.WinHook.8	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2B8E6757-1A5E-4827-AF68-8A67E83C2D78}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.MsgList.1\ = "MsgList PropertyPage"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{70CA7ADF-1545-4085-A81F-260C365C5EF2}\8.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7FB96837-674C-407F-BBA0-CDC0D501512C}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7FB96837-674C-407F-BBA0-CDC0D501512C}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2B8E6757-1A5E-4827-AF68-8A67E83C2D78}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$SYSDIR\\DWSHK80.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{651520F0-B9D9-46CE-987F-C8697222B4B8}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$SYSDIR\\DWSHK80.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5FC14064-8342-4D18-947E-3BD813100F99}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5FC14064-8342-4D18-947E-3BD813100F99}\TypeLib\Version = "8.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6968E7F-3422-4CB7-8F37-3951F4880511}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2B8E6757-1A5E-4827-AF68-8A67E83C2D78}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C866B2C5-14CF-4908-8D11-7FA85FD63EC2}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.KeyPage	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6968E7F-3422-4CB7-8F37-3951F4880511}\VersionIndependentProgID\ = "Desaware dwshk80 v8 Hook Control"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6968E7F-3422-4CB7-8F37-3951F4880511}\MiscStatus\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C866B2C5-14CF-4908-8D11-7FA85FD63EC2}\ = "HookPage ProppertyPage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.KeyList\CurVer\ = "dwshk80.KeyList.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7FB96837-674C-407F-BBA0-CDC0D501512C}\ = "Idwshk35"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6968E7F-3422-4CB7-8F37-3951F4880511}\ProgID\ = "dwshk80.WinHook.8"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7FB96837-674C-407F-BBA0-CDC0D501512C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.WinHook\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.RegMsg.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{15985491-68E2-49DD-9F73-BFC0DCAB8584}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{651520F0-B9D9-46CE-987F-C8697222B4B8}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{70CA7ADF-1545-4085-A81F-260C365C5EF2}\8.0\ = "Desaware dwshk80 v8 Hook Control"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.WinHook	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2732	2300	regsvr32.exe	28
PID 2300 wrote to memory of 2732	2300	regsvr32.exe	28
PID 2300 wrote to memory of 2732	2300	regsvr32.exe	28
PID 2300 wrote to memory of 2732	2300	regsvr32.exe	28
PID 2300 wrote to memory of 2732	2300	regsvr32.exe	28
PID 2300 wrote to memory of 2732	2300	regsvr32.exe	28
PID 2300 wrote to memory of 2732	2300	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$SYSDIR\DWSHK80.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$SYSDIR\DWSHK80.dll
  2⤵
  - Modifies registry class
  PID:2732

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads