File name:

wps_wid.cid-.exe

Full analysis: https://app.any.run/tasks/d29e6aff-b4fe-4633-a760-6126a1525af5
Verdict: Malicious activity
Analysis date: February 14, 2024, 13:22:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
qrcode
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

43E30FC99691B7CCFC2BDC3AE558082D

SHA1:

81471213011DF3C4353C96EBD8953D828F98E47A

SHA256:

965C585B9B557E97EBF8A04BFF6F641F2F919126DF320D71D57C5FD62440C9B2

SSDEEP:

98304:Ks0cyNQlDUkUjnA2W22m8v58OE6yc5VrMg+m9J+/94xZJd4s4CLC7Q5QLaPS+98k:NjpCp8

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • wps_wid.cid-.exe (PID: 3240)
      • 147bdc5e5aed5521ff69ab9243cf7cf5-14_setup_XA_mui_Free.exe.500.2086.exe (PID: 2572)

  • SUSPICIOUS

    • Reads settings of System Certificates

      • wps_wid.cid-.exe (PID: 3240)
      • 147bdc5e5aed5521ff69ab9243cf7cf5-14_setup_XA_mui_Free.exe.500.2086.exe (PID: 2572)

    • Executable content was dropped or overwritten

      • 147bdc5e5aed5521ff69ab9243cf7cf5-14_setup_XA_mui_Free.exe.500.2086.exe (PID: 2572)

    • Process drops legitimate windows executable

      • 147bdc5e5aed5521ff69ab9243cf7cf5-14_setup_XA_mui_Free.exe.500.2086.exe (PID: 2572)

    • The process drops C-runtime libraries

      • 147bdc5e5aed5521ff69ab9243cf7cf5-14_setup_XA_mui_Free.exe.500.2086.exe (PID: 2572)

  • INFO

    • Checks supported languages

      • wps_wid.cid-.exe (PID: 3240)
      • 147bdc5e5aed5521ff69ab9243cf7cf5-14_setup_XA_mui_Free.exe.500.2086.exe (PID: 2572)

    • Reads the computer name

      • wps_wid.cid-.exe (PID: 3240)
      • 147bdc5e5aed5521ff69ab9243cf7cf5-14_setup_XA_mui_Free.exe.500.2086.exe (PID: 2572)

    • Process checks computer location settings

      • wps_wid.cid-.exe (PID: 3240)

    • Reads the machine GUID from the registry

      • wps_wid.cid-.exe (PID: 3240)
      • 147bdc5e5aed5521ff69ab9243cf7cf5-14_setup_XA_mui_Free.exe.500.2086.exe (PID: 2572)

    • Reads the software policy settings

      • wps_wid.cid-.exe (PID: 3240)
      • 147bdc5e5aed5521ff69ab9243cf7cf5-14_setup_XA_mui_Free.exe.500.2086.exe (PID: 2572)

    • Creates files or folders in the user directory

      • wps_wid.cid-.exe (PID: 3240)
      • 147bdc5e5aed5521ff69ab9243cf7cf5-14_setup_XA_mui_Free.exe.500.2086.exe (PID: 2572)

    • Create files in a temporary directory

      • wps_wid.cid-.exe (PID: 3240)
      • 147bdc5e5aed5521ff69ab9243cf7cf5-14_setup_XA_mui_Free.exe.500.2086.exe (PID: 2572)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (18)
.exe | Win32 Executable (generic) (2.9)
.exe | Generic Win/DOS Executable (1.3)
.exe | DOS Executable Generic (1.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:01:02 18:31:30+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.24
CodeSize: 3853824
InitializedDataSize: 1704448
UninitializedDataSize: -
EntryPoint: 0x18a8a8
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 12.2.0.13411
ProductVersionNumber: 12.2.0.13411
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Zhuhai Kingsoft Office Software Co.,Ltd
FileDescription: WPS Office Setup
FileVersion: 12,2,0,13411
InternalName: konlinesetup_xa
LegalCopyright: Copyright©2024 Kingsoft Corporation. All rights reserved.
OriginalFileName: konlinesetup_xa.exe
ProductName: WPS Office
ProductVersion: 12,2,0,13411
MIMEType: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
2
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wps_wid.cid-.exe 147bdc5e5aed5521ff69ab9243cf7cf5-14_setup_xa_mui_free.exe.500.2086.exe

Process information

PID
CMD
Path
Indicators
Parent process
2572"C:\Users\admin\AppData\Local\Temp\wps_download\147bdc5e5aed5521ff69ab9243cf7cf5-14_setup_XA_mui_Free.exe.500.2086.exe" -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -createIcons -curlangofinstalledproduct=en_US -notElevateAndDirectlyInstall -D="C:\Users\admin\AppData\Local\Kingsoft\WPS Office" -notautostartwpsC:\Users\admin\AppData\Local\Temp\wps_download\147bdc5e5aed5521ff69ab9243cf7cf5-14_setup_XA_mui_Free.exe.500.2086.exe
wps_wid.cid-.exe
User:
admin
Company:
Zhuhai Kingsoft Office Software Co.,Ltd
Integrity Level:
MEDIUM
Description:
WPS Install Application
Exit code:
0
Version:
12,2,0,13431
Modules
Images
c:\users\admin\appdata\local\temp\wps_download\147bdc5e5aed5521ff69ab9243cf7cf5-14_setup_xa_mui_free.exe.500.2086.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
3240"C:\Users\admin\AppData\Local\Temp\wps_wid.cid-.exe" C:\Users\admin\AppData\Local\Temp\wps_wid.cid-.exe
explorer.exe
User:
admin
Company:
Zhuhai Kingsoft Office Software Co.,Ltd
Integrity Level:
MEDIUM
Description:
WPS Office Setup
Exit code:
0
Version:
12,2,0,13411
Modules
Images
c:\users\admin\appdata\local\temp\wps_wid.cid-.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
Total events
9 715
Read events
9 669
Write events
44
Delete events
2

Modification events

(PID) Process:(3240) wps_wid.cid-.exeKey:HKEY_CURRENT_USER\Software\kingsoft\kwpsonlinesetup
Operation:writeName:infoGuid
Value:
EA6E950C23904BCF81C61385429D7A3D
(PID) Process:(3240) wps_wid.cid-.exeKey:HKEY_CURRENT_USER\Software\kingsoft\kwpsonlinesetup
Operation:writeName:infoHdid
Value:
C025F6F8E94D489DBB614D7A940BE493
(PID) Process:(3240) wps_wid.cid-.exeKey:HKEY_CURRENT_USER\Software\kingsoft\kwpsonlinesetup
Operation:writeName:onlinesetup_penetrate_id_type
Value:
web
(PID) Process:(3240) wps_wid.cid-.exeKey:HKEY_CURRENT_USER\Software\kingsoft\kwpsonlinesetup
Operation:writeName:onlinesetup_penetrate_id
Value:
cid-
(PID) Process:(3240) wps_wid.cid-.exeKey:HKEY_CURRENT_USER\Software\kingsoft\Office\6.0\Common
Operation:writeName:newGuideShow
Value:
1
(PID) Process:(3240) wps_wid.cid-.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3240) wps_wid.cid-.exeKey:HKEY_CURRENT_USER\Software\kingsoft\Office\6.0\plugins\kdcsdk
Operation:writeName:countrycode
Value:
DE
(PID) Process:(3240) wps_wid.cid-.exeKey:HKEY_CURRENT_USER\Software\kingsoft\Office\6.0\plugins\kdcsdk
Operation:writeName:lastupdatecountrycode
Value:
1707916933217
(PID) Process:(3240) wps_wid.cid-.exeKey:HKEY_CURRENT_USER\Software\kingsoft\Office\6.0\plugins\kdcsdk
Operation:writeName:lastUpdateDeviceInfoDate
Value:
2024/2/14
(PID) Process:(2572) 147bdc5e5aed5521ff69ab9243cf7cf5-14_setup_XA_mui_Free.exe.500.2086.exeKey:HKEY_CURRENT_USER\Software\kingsoft\Office\6.0\Common
Operation:delete valueName:user_agree_protocol
Value:
Executable files
67
Suspicious files
32
Text files
1 250
Unknown types
3

Dropped files

PID
Process
Filename
Type
3240wps_wid.cid-.exeC:\Users\admin\AppData\Local\Temp\wps_download\147bdc5e5aed5521ff69ab9243cf7cf5-14_setup_XA_mui_Free.exe.500.2086.exe —
MD5:—
SHA256:—
2572147bdc5e5aed5521ff69ab9243cf7cf5-14_setup_XA_mui_Free.exe.500.2086.exeC:\Users\admin\AppData\Local\Temp\wps\~1b91dc\CONTROL\prereadimages_et.txt —
MD5:—
SHA256:—
2572147bdc5e5aed5521ff69ab9243cf7cf5-14_setup_XA_mui_Free.exe.500.2086.exeC:\Users\admin\AppData\Local\Temp\wps\~1b91dc\CONTROL\prereadimages_pdf.txt —
MD5:—
SHA256:—
2572147bdc5e5aed5521ff69ab9243cf7cf5-14_setup_XA_mui_Free.exe.500.2086.exeC:\Users\admin\AppData\Local\Temp\wps\~1b91dc\CONTROL\prereadimages_prometheus.txt —
MD5:—
SHA256:—
2572147bdc5e5aed5521ff69ab9243cf7cf5-14_setup_XA_mui_Free.exe.500.2086.exeC:\Users\admin\AppData\Local\Temp\wps\~1b91dc\CONTROL\prereadimages_prome_init.txt —
MD5:—
SHA256:—
2572147bdc5e5aed5521ff69ab9243cf7cf5-14_setup_XA_mui_Free.exe.500.2086.exeC:\Users\admin\AppData\Local\Temp\wps\~1b91dc\CONTROL\prereadimages_qing.txt —
MD5:—
SHA256:—
2572147bdc5e5aed5521ff69ab9243cf7cf5-14_setup_XA_mui_Free.exe.500.2086.exeC:\Users\admin\AppData\Local\Temp\wps\~1b91dc\CONTROL\prereadimages_wpp.txt —
MD5:—
SHA256:—
2572147bdc5e5aed5521ff69ab9243cf7cf5-14_setup_XA_mui_Free.exe.500.2086.exeC:\Users\admin\AppData\Local\Temp\wps\~1b91dc\CONTROL\prereadimages_wps.txt —
MD5:—
SHA256:—
2572147bdc5e5aed5521ff69ab9243cf7cf5-14_setup_XA_mui_Free.exe.500.2086.exeC:\Users\admin\AppData\Local\Temp\wps\~1b91dc\CONTROL\default\background.pngimage
MD5:27B9C403FA884EBF4EA0CC23D69A42D7
SHA256:5479C612C47D5CD3EBDAA11EBF897B6E84D95C364587133E03F778450A51412D
2572147bdc5e5aed5521ff69ab9243cf7cf5-14_setup_XA_mui_Free.exe.500.2086.exeC:\Users\admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.logtext
MD5:394428DDE1009EE3C857D767203B4D31
SHA256:384C191166D08BD7019BAA4E16BBD4E32E0C1AEA3F6B989DFC79F1A1F16FEEEF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
15
DNS requests
6
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3240
wps_wid.cid-.exe
142.250.184.238:443
www.google-analytics.com
GOOGLE
US
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3240
wps_wid.cid-.exe
185.23.181.26:443
wdl1.pcfg.cache.wpscdn.com
Kaopu Cloud HK Limited
DE
unknown
3240
wps_wid.cid-.exe
90.84.175.86:443
api.wps.com
Orange
FR
unknown
3240
wps_wid.cid-.exe
185.23.181.28:443
wdl1.pcfg.cache.wpscdn.com
Kaopu Cloud HK Limited
DE
unknown
2572
147bdc5e5aed5521ff69ab9243cf7cf5-14_setup_XA_mui_Free.exe.500.2086.exe
172.217.16.206:443
www.google-analytics.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
www.google-analytics.com
  • 142.250.184.238
  • 172.217.16.206
whitelisted
wdl1.pcfg.cache.wpscdn.com
  • 185.23.181.26
  • 185.23.181.28
unknown
api.wps.com
  • 90.84.175.86
unknown
params.wps.com
  • 90.84.175.86
unknown

Threats

No threats detected
Process
Message
147bdc5e5aed5521ff69ab9243cf7cf5-14_setup_XA_mui_Free.exe.500.2086.exe
[kscreen] isElide:0 switchRec:0 switchRecElide:1
147bdc5e5aed5521ff69ab9243cf7cf5-14_setup_XA_mui_Free.exe.500.2086.exe
QLayout: Attempting to add QLayout "" to QWidget "m_BrandAreaWidget", which already has a layout
147bdc5e5aed5521ff69ab9243cf7cf5-14_setup_XA_mui_Free.exe.500.2086.exe
QLayout: Attempting to add QLayout "" to QWidget "", which already has a layout
147bdc5e5aed5521ff69ab9243cf7cf5-14_setup_XA_mui_Free.exe.500.2086.exe
QLayout: Attempting to add QLayout "" to QWidget "m_customizeSettingsWidget", which already has a layout
147bdc5e5aed5521ff69ab9243cf7cf5-14_setup_XA_mui_Free.exe.500.2086.exe
QLayout: Attempting to add QLayout "" to QWidget "m_customizeSettingsWidget", which already has a layout
147bdc5e5aed5521ff69ab9243cf7cf5-14_setup_XA_mui_Free.exe.500.2086.exe
QLayout: Attempting to add QLayout "" to QWidget "m_customizeSettingsWidget", which already has a layout
147bdc5e5aed5521ff69ab9243cf7cf5-14_setup_XA_mui_Free.exe.500.2086.exe
QLayout: Attempting to add QLayout "" to QWidget "m_customizeSettingsWidget", which already has a layout
147bdc5e5aed5521ff69ab9243cf7cf5-14_setup_XA_mui_Free.exe.500.2086.exe
Unknown property font-color
147bdc5e5aed5521ff69ab9243cf7cf5-14_setup_XA_mui_Free.exe.500.2086.exe
QLayout: Attempting to add QLayout "" to QWidget "m_customizeSettingsWidget", which already has a layout
147bdc5e5aed5521ff69ab9243cf7cf5-14_setup_XA_mui_Free.exe.500.2086.exe
QLayout: Attempting to add QLayout "" to QWidget "m_customizeSettingsWidget", which already has a layout
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
wps_wid.cid-.exe