download:

wps_office_inst.exe

Full analysis: https://app.any.run/tasks/db37411a-5ec9-4a64-a73a-57166fe976c6
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: December 27, 2019, 10:58:22
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
maldoc-17
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

8567026E0C345FB9C3B95812A255B857

SHA1:

A24BADF67392570EE9116F6CB5D7C9295177C488

SHA256:

A58DA52B5BBE80C1A49C4465E4E6C14ECB787195D7D2B788DA8D74772B96B665

SSDEEP:

49152:UYBcb17LBWNd8QmU/BjLgfHgX5dtXD/wkjATdjnjcMRr:XBcp7LOP/BofHgXBD/wrj1R

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops known malicious document

      • setup_urls_default.500.2014.exe (PID: 1780)

    • Application was dropped or rewritten from another process

      • ksomisc.exe (PID: 2496)
      • ksomisc.exe (PID: 3468)
      • ksomisc.exe (PID: 2584)
      • ksomisc.exe (PID: 1756)
      • ksomisc.exe (PID: 2132)
      • ksomisc.exe (PID: 3860)
      • wps.exe (PID: 896)
      • ksomisc.exe (PID: 2624)
      • ksomisc.exe (PID: 2424)
      • wpscloudsvr.exe (PID: 3076)
      • wpscloudsvr.exe (PID: 2608)
      • wpscloudsvr.exe (PID: 444)
      • ksomisc.exe (PID: 640)
      • ksomisc.exe (PID: 2112)
      • ksomisc.exe (PID: 1812)
      • ksomisc.exe (PID: 1016)
      • ksomisc.exe (PID: 2860)
      • ksomisc.exe (PID: 320)
      • ksomisc.exe (PID: 3196)
      • wps.exe (PID: 2108)
      • wps.exe (PID: 3636)
      • ksomisc.exe (PID: 2996)
      • wpscloudsvr.exe (PID: 3960)
      • wps.exe (PID: 3908)
      • wps.exe (PID: 4052)
      • ksomisc.exe (PID: 3436)
      • ksomisc.exe (PID: 2304)
      • wps.exe (PID: 2396)
      • ksomisc.exe (PID: 2260)
      • wpscloudsvr.exe (PID: 2344)
      • wpsupdate.exe (PID: 2068)
      • wpsupdate.exe (PID: 3900)
      • wpscloudsvr.exe (PID: 1820)
      • wps.exe (PID: 3348)
      • ksomisc.exe (PID: 1608)
      • promecefpluginhost.exe (PID: 3628)
      • wpscloudsvr.exe (PID: 2812)
      • wps.exe (PID: 2192)
      • promecefpluginhost.exe (PID: 2120)
      • ksomisc.exe (PID: 3176)

    • Loads dropped or rewritten executable

      • ksomisc.exe (PID: 3468)
      • ksomisc.exe (PID: 2584)
      • ksomisc.exe (PID: 2496)
      • ksomisc.exe (PID: 1756)
      • ksomisc.exe (PID: 2132)
      • ksomisc.exe (PID: 3860)
      • ksomisc.exe (PID: 2624)
      • wps.exe (PID: 896)
      • wpscloudsvr.exe (PID: 444)
      • wpscloudsvr.exe (PID: 3076)
      • ksomisc.exe (PID: 2424)
      • ksomisc.exe (PID: 640)
      • ksomisc.exe (PID: 2112)
      • ksomisc.exe (PID: 1812)
      • ksomisc.exe (PID: 1016)
      • ksomisc.exe (PID: 2860)
      • ksomisc.exe (PID: 320)
      • ksomisc.exe (PID: 3176)
      • ksomisc.exe (PID: 3196)
      • ksomisc.exe (PID: 2996)
      • wps.exe (PID: 2108)
      • wps.exe (PID: 3908)
      • wps.exe (PID: 3636)
      • ksomisc.exe (PID: 3436)
      • wps.exe (PID: 4052)
      • ksomisc.exe (PID: 2304)
      • explorer.exe (PID: 352)
      • wps.exe (PID: 2396)
      • ksomisc.exe (PID: 2260)
      • wpsupdate.exe (PID: 2068)
      • wpscloudsvr.exe (PID: 2344)
      • regsvr32.exe (PID: 2472)
      • wpsupdate.exe (PID: 3900)
      • wpscloudsvr.exe (PID: 2812)
      • promecefpluginhost.exe (PID: 3628)
      • ksomisc.exe (PID: 1608)
      • wps.exe (PID: 3348)
      • wps.exe (PID: 2192)
      • promecefpluginhost.exe (PID: 2120)

    • Downloads executable files from the Internet

      • wps_office_inst.exe (PID: 2824)

    • Loads the Task Scheduler COM API

      • wps.exe (PID: 4052)
      • wps.exe (PID: 2108)
      • wpsupdate.exe (PID: 3900)

    • Registers / Runs the DLL via REGSVR32.EXE

      • setup_urls_default.500.2014.exe (PID: 1780)

  • SUSPICIOUS

    • Creates files in the user directory

      • setup_urls_default.500.2014.exe (PID: 1780)
      • wps_office_inst.exe (PID: 2824)
      • ksomisc.exe (PID: 2496)
      • ksomisc.exe (PID: 2860)
      • ksomisc.exe (PID: 3176)
      • ksomisc.exe (PID: 2304)
      • wpsupdate.exe (PID: 2068)
      • wps.exe (PID: 3348)
      • ksomisc.exe (PID: 320)

    • Application launched itself

      • wpscloudsvr.exe (PID: 444)
      • wps.exe (PID: 2108)

    • Creates COM task schedule object

      • ksomisc.exe (PID: 2584)
      • regsvr32.exe (PID: 2472)

    • Modifies the open verb of a shell class

      • ksomisc.exe (PID: 2584)
      • ksomisc.exe (PID: 3860)
      • ksomisc.exe (PID: 2624)
      • ksomisc.exe (PID: 2424)
      • ksomisc.exe (PID: 2304)
      • setup_urls_default.500.2014.exe (PID: 1780)

    • Creates a software uninstall entry

      • setup_urls_default.500.2014.exe (PID: 1780)

    • Creates files in the Windows directory

      • wpscloudsvr.exe (PID: 2608)
      • wpscloudsvr.exe (PID: 1820)
      • wpscloudsvr.exe (PID: 3960)

    • Executed as Windows Service

      • wpscloudsvr.exe (PID: 2608)
      • wpscloudsvr.exe (PID: 3960)
      • wpscloudsvr.exe (PID: 1820)

    • Removes files from Windows directory

      • wpscloudsvr.exe (PID: 2608)
      • wpscloudsvr.exe (PID: 3960)
      • wpscloudsvr.exe (PID: 1820)

    • Executable content was dropped or overwritten

      • setup_urls_default.500.2014.exe (PID: 1780)

    • Starts itself from another location

      • wps.exe (PID: 3348)

  • INFO

    • Reads settings of System Certificates

      • setup_urls_default.500.2014.exe (PID: 1780)
      • wps_office_inst.exe (PID: 2824)
      • wpsupdate.exe (PID: 2068)
      • wpsupdate.exe (PID: 3900)

    • Dropped object may contain Bitcoin addresses

      • setup_urls_default.500.2014.exe (PID: 1780)

    • Reads the hosts file

      • wps.exe (PID: 3348)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (18)
.exe | Win32 Executable (generic) (2.9)
.exe | Generic Win/DOS Executable (1.3)
.exe | DOS Executable Generic (1.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:12:04 05:19:12+01:00
PEType: PE32
LinkerVersion: 10
CodeSize: 1789440
InitializedDataSize: 857088
UninitializedDataSize: -
EntryPoint: 0x180417
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 11.2.0.9085
ProductVersionNumber: 11.2.0.9085
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Zhuhai Kingsoft Office Software Co.,Ltd
FileDescription: WPS Office Setup
FileVersion: 11,2,0,9085
InternalName: konlinesetup_xa
LegalCopyright: Copyright©1988-2019 Kingsoft Corporation. All rights reserved.
OriginalFileName: konlinesetup_xa.exe
ProductName: WPS Office
ProductVersion: 11,2,0,9085
MIMEType: -

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 04-Dec-2019 04:19:12
Detected languages:
  • Chinese - PRC
  • English - United States
Debug artifacts:
  • E:\rc_v11_i18_kpr_20191215\Build\Release\WPSOffice\office6\addons\konlinesetup_xa\konlinesetup_xa.pdb
CompanyName: Zhuhai Kingsoft Office Software Co.,Ltd
FileDescription: WPS Office Setup
FileVersion: 11,2,0,9085
InternalName: konlinesetup_xa
LegalCopyright: Copyright©1988-2019 Kingsoft Corporation. All rights reserved.
OriginalFilename: konlinesetup_xa.exe
ProductName: WPS Office
ProductVersion: 11,2,0,9085
MIMEType: -

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000100

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 04-Dec-2019 04:19:12
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x001B4CF2
0x001B4E00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.65483
.rdata
0x001B6000
0x000467A8
0x00046800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.59867
.data
0x001FD000
0x0000D7E0
0x00007C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.95181
.rsrc
0x0020B000
0x00062340
0x00062400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.2191
.reloc
0x0026E000
0x00020AEE
0x00020C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
4.79948

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.04637
885
Latin 1 / Western European
English - United States
RT_MANIFEST
2
5.21516
1128
Latin 1 / Western European
Chinese - PRC
RT_ICON
3
4.59644
2440
Latin 1 / Western European
Chinese - PRC
RT_ICON
4
7.95999
15814
Latin 1 / Western European
Chinese - PRC
RT_ICON
5
4.41725
4264
Latin 1 / Western European
Chinese - PRC
RT_ICON
6
3.87235
9640
Latin 1 / Western European
Chinese - PRC
RT_ICON
7
3.57405
38056
Latin 1 / Western European
Chinese - PRC
RT_ICON
101
7.99513
260553
Latin 1 / Western European
Chinese - PRC
ZIPRES
102
2.91176
104
Latin 1 / Western European
Chinese - PRC
RT_GROUP_ICON

Imports

KERNEL32.dll
USER32.dll (delay-loaded)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
84
Monitored processes
44
Malicious processes
41
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start wps_office_inst.exe setup_urls_default.500.2014.exe ksomisc.exe wpscloudsvr.exe no specs wpscloudsvr.exe ksomisc.exe ksomisc.exe ksomisc.exe wps.exe no specs wpscloudsvr.exe ksomisc.exe ksomisc.exe ksomisc.exe ksomisc.exe ksomisc.exe ksomisc.exe ksomisc.exe ksomisc.exe ksomisc.exe ksomisc.exe ksomisc.exe ksomisc.exe ksomisc.exe wps.exe no specs wps.exe no specs wps.exe no specs wpscloudsvr.exe wps.exe no specs ksomisc.exe ksomisc.exe wps.exe no specs explorer.exe no specs wpscloudsvr.exe no specs ksomisc.exe wpsupdate.exe wpscloudsvr.exe no specs wpsupdate.exe wpscloudsvr.exe no specs regsvr32.exe no specs ksomisc.exe wps.exe promecefpluginhost.exe no specs wps.exe no specs promecefpluginhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
320"C:\Users\admin\AppData\Local\Kingsoft\WPS Office\11.2.0.9107\office6\ksomisc.exe" -createexternstartmenu "WPS Office"C:\Users\admin\AppData\Local\Kingsoft\WPS Office\11.2.0.9107\office6\ksomisc.exe
setup_urls_default.500.2014.exe
User:
admin
Company:
Zhuhai Kingsoft Office Software Co.,Ltd
Integrity Level:
MEDIUM
Description:
WPS Office Module
Exit code:
0
Version:
11,2,0,9107
Modules
Images
c:\users\admin\appdata\local\kingsoft\wps office\11.2.0.9107\office6\ksomisc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
352C:\Windows\Explorer.EXEC:\Windows\explorer.exe——
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\winanr.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
444"C:\Users\admin\AppData\Local\Kingsoft\WPS Office\\wpscloudsvr.exe" InstallServiceC:\Users\admin\AppData\Local\Kingsoft\WPS Office\wpscloudsvr.exe—setup_urls_default.500.2014.exe
User:
admin
Company:
Zhuhai Kingsoft Office Software Co.,Ltd
Integrity Level:
MEDIUM
Description:
WPS Office service program for service such as login and Cloud storage
Exit code:
0
Version:
11,2,0,9107
Modules
Images
c:\users\admin\appdata\local\kingsoft\wps office\wpscloudsvr.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
640"C:\Users\admin\AppData\Local\Kingsoft\WPS Office\11.2.0.9107\office6\ksomisc.exe" -compatiblemsoC:\Users\admin\AppData\Local\Kingsoft\WPS Office\11.2.0.9107\office6\ksomisc.exe
setup_urls_default.500.2014.exe
User:
admin
Company:
Zhuhai Kingsoft Office Software Co.,Ltd
Integrity Level:
MEDIUM
Description:
WPS Office Module
Exit code:
0
Version:
11,2,0,9107
Modules
Images
c:\users\admin\appdata\local\kingsoft\wps office\11.2.0.9107\office6\ksomisc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
896"C:\Users\admin\AppData\Local\Kingsoft\WPS Office\11.2.0.9107\\office6\wps.exe" Run -User=Admin "C:\Users\admin\AppData\Local\Kingsoft\WPS Office\11.2.0.9107\\office6\ksomisc.exe" -setappcapC:\Users\admin\AppData\Local\Kingsoft\WPS Office\11.2.0.9107\office6\wps.exe—setup_urls_default.500.2014.exe
User:
admin
Company:
Zhuhai Kingsoft Office Software Co.,Ltd
Integrity Level:
MEDIUM
Description:
WPS Writer
Exit code:
0
Version:
11,2,0,9107
Modules
Images
c:\users\admin\appdata\local\kingsoft\wps office\11.2.0.9107\office6\wps.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\kingsoft\wps office\11.2.0.9107\office6\krpt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\users\admin\appdata\local\kingsoft\wps office\11.2.0.9107\office6\msvcr100.dll
1016"C:\Users\admin\AppData\Local\Kingsoft\WPS Office\11.2.0.9107\office6\ksomisc.exe" -distsrc 00500.00002014C:\Users\admin\AppData\Local\Kingsoft\WPS Office\11.2.0.9107\office6\ksomisc.exe
setup_urls_default.500.2014.exe
User:
admin
Company:
Zhuhai Kingsoft Office Software Co.,Ltd
Integrity Level:
MEDIUM
Description:
WPS Office Module
Exit code:
0
Version:
11,2,0,9107
Modules
Images
c:\users\admin\appdata\local\kingsoft\wps office\11.2.0.9107\office6\ksomisc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
1608"C:\Users\admin\AppData\Local\Kingsoft\WPS Office\11.2.0.9107\office6\ksomisc.exe" -rebuildiconC:\Users\admin\AppData\Local\Kingsoft\WPS Office\11.2.0.9107\office6\ksomisc.exe
setup_urls_default.500.2014.exe
User:
admin
Company:
Zhuhai Kingsoft Office Software Co.,Ltd
Integrity Level:
MEDIUM
Description:
WPS Office Module
Exit code:
0
Version:
11,2,0,9107
Modules
Images
c:\users\admin\appdata\local\kingsoft\wps office\11.2.0.9107\office6\ksomisc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
1756"C:\Users\admin\AppData\Local\Kingsoft\WPS Office\11.2.0.9107\office6\ksomisc.exe" -regmtfontC:\Users\admin\AppData\Local\Kingsoft\WPS Office\11.2.0.9107\office6\ksomisc.exe
setup_urls_default.500.2014.exe
User:
admin
Company:
Zhuhai Kingsoft Office Software Co.,Ltd
Integrity Level:
MEDIUM
Description:
WPS Office Module
Exit code:
0
Version:
11,2,0,9107
Modules
Images
c:\users\admin\appdata\local\kingsoft\wps office\11.2.0.9107\office6\ksomisc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
1780"C:\Users\admin\AppData\Roaming\konlinesetup\down\041E6C27DD216D621065C572405E23F8\setup_urls_default.500.2014.exe" -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -createIcons -curlangofinstalledproduct=en_US -notElevateAndDirectlyInstall -D="C:\Users\admin\AppData\Local\Kingsoft\WPS Office"C:\Users\admin\AppData\Roaming\konlinesetup\down\041E6C27DD216D621065C572405E23F8\setup_urls_default.500.2014.exe
wps_office_inst.exe
User:
admin
Company:
Zhuhai Kingsoft Office Software Co.,Ltd
Integrity Level:
MEDIUM
Description:
WPS Install Application
Exit code:
0
Version:
11,2,0,9107
Modules
Images
c:\users\admin\appdata\roaming\konlinesetup\down\041e6c27dd216d621065c572405e23f8\setup_urls_default.500.2014.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
1812"C:\Users\admin\AppData\Local\Kingsoft\WPS Office\11.2.0.9107\office6\ksomisc.exe" -saveas_msoC:\Users\admin\AppData\Local\Kingsoft\WPS Office\11.2.0.9107\office6\ksomisc.exe
setup_urls_default.500.2014.exe
User:
admin
Company:
Zhuhai Kingsoft Office Software Co.,Ltd
Integrity Level:
MEDIUM
Description:
WPS Office Module
Exit code:
0
Version:
11,2,0,9107
Modules
Images
c:\users\admin\appdata\local\kingsoft\wps office\11.2.0.9107\office6\ksomisc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
Total events
13 817
Read events
5 731
Write events
8 071
Delete events
15

Modification events

(PID) Process:(2824) wps_office_inst.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\wps_office_inst_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2824) wps_office_inst.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\wps_office_inst_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2824) wps_office_inst.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\wps_office_inst_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(2824) wps_office_inst.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\wps_office_inst_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(2824) wps_office_inst.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\wps_office_inst_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2824) wps_office_inst.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\wps_office_inst_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(2824) wps_office_inst.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\wps_office_inst_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2824) wps_office_inst.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\wps_office_inst_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2824) wps_office_inst.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\wps_office_inst_RASMANCS
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(2824) wps_office_inst.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\wps_office_inst_RASMANCS
Operation:writeName:ConsoleTracingMask
Value:
4294901760
Executable files
170
Suspicious files
354
Text files
2 590
Unknown types
494

Dropped files

PID
Process
Filename
Type
2824wps_office_inst.exeC:\Users\admin\AppData\Roaming\konlinesetup\down\041E6C27DD216D621065C572405E23F8\setup_urls_default.500.2014.exe —
MD5:—
SHA256:—
1780setup_urls_default.500.2014.exeC:\Users\admin\AppData\Local\Temp\wps\~3b2173\CONTROL\prereadimages_et.txt —
MD5:—
SHA256:—
1780setup_urls_default.500.2014.exeC:\Users\admin\AppData\Local\Temp\wps\~3b2173\CONTROL\prereadimages_prometheus.txt —
MD5:—
SHA256:—
1780setup_urls_default.500.2014.exeC:\Users\admin\AppData\Local\Temp\wps\~3b2173\CONTROL\prereadimages_wpp.txt —
MD5:—
SHA256:—
1780setup_urls_default.500.2014.exeC:\Users\admin\AppData\Local\Temp\wps\~3b2173\CONTROL\prereadimages_wps.txt —
MD5:—
SHA256:—
1780setup_urls_default.500.2014.exeC:\Users\admin\AppData\Local\Temp\wps\~3b2173\CONTROL\en_US\1004.pngimage
MD5:—
SHA256:—
2824wps_office_inst.exeC:\Users\admin\AppData\Roaming\konlinesetup\down\index.initext
MD5:—
SHA256:—
1780setup_urls_default.500.2014.exeC:\Users\admin\AppData\Local\Temp\wps\~3b2173\CONTROL\default\background.pngimage
MD5:—
SHA256:—
1780setup_urls_default.500.2014.exeC:\Users\admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.logtext
MD5:—
SHA256:—
1780setup_urls_default.500.2014.exeC:\Users\admin\AppData\Local\Temp\wps\~3b2173\CONTROL\en_US\1002.pngimage
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
27
DNS requests
13
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2824
wps_office_inst.exe
HEAD
200
103.38.144.120:80
http://wdl1.pcfg.cache.wpscdn.com/wpsdl/wpsoffice/onlinesetup/package/setup_XA_mui_Free.exe
HK
—
—
malicious
2824
wps_office_inst.exe
GET
200
52.196.163.120:80
http://haiwai-ic.ksosoft.com/infos.ads?v=D1S1E2&d=arMFlS7SpzoOibMPkHtBhzcRibcRbDNPqL7Sc4sOqbsRkrpQlv6RfvMPpL6Tr1d9mvMTjrZDc07CzGZG4bpC15pCnW3CrGZHr0JE6bZDrOJDqS3E3HJHq0pCyXZGvOKHmKKDm4ZG3XJGvGaDuG4CpGZDnGKCuKpGn0JDyPZOnKJPbL6CZXJEpSZOtKsDtOJPYHpOr8MDsGJCtGZOc0NCz4JCk8ZBmuIEmWJDc0dCz83CmuICm4pCc0tCzO2SqqpSq5cSqzLOcHNPozrSezsTc0NDzOMOiDNP
JP
—
—
unknown
2824
wps_office_inst.exe
HEAD
200
103.38.144.120:80
http://wdl1.pcfg.cache.wpscdn.com/wpsdl/wpsoffice/onlinesetup/distsrc/200.1013/index.ini
HK
—
—
malicious
2824
wps_office_inst.exe
GET
200
52.196.163.120:80
http://haiwai-ic.ksosoft.com/infos.ads?v=D1S1E2&d=arMFlS7SpzoOibMPkHtBhzcRibcRbDNPqL7Sc4sOqbsRkrpQlv6RfvMPpL6Tr1d9mvMTjrZDc07CzGZG4bpC15pCnW3CrGZHr0JE6bZDrOJDqS3E3HJHq0pCyXZGvOKHmKKDm4ZG3XJGvGaDuG4CpGZDnGKCuKpGn0JDyPZOnKJPbL6CZXJEpSZOtKsDtOJPYHpOr8MDsGJCtGZOc0NCz4JCk8ZBmuIEmWJDc0dCz83CmuICm4pCc0tCzO2SqqpSq5cSqL7SVrsRaLc9mLJFbnMPs56TbT5QbvcJbDMPpDNOob7
JP
—
—
unknown
2824
wps_office_inst.exe
GET
200
52.196.163.120:80
http://haiwai-ic.ksosoft.com/infos.ads?v=D1S1E2&d=arMFlS7SpzoOibMPkHtBhzcRibcRbDNPqL7Sc4sOqbsRkrpQlv6RfvMPpL6Tr1d9mvMTjrZDc07CzGZG4bpC15pCnW3CrGZHr0JE6bZDrOJDqS3E3HJHq0pCyXZGvOKHmKKDm4ZG3XJGvGaDuG4CpGZDnGKCuKpGn0JDyPZOnKJPbL6CZXJEpSZOtKsDtOJPYHpOr8MDsGJCtGZOc0NCz4JCk8ZBmuIEmWJDc0dCz83CmuICm4pCc0tCzO2SqqZOqvsNZnMQZjc9mLJFpHNOoH7
JP
—
—
unknown
2824
wps_office_inst.exe
GET
200
52.196.163.120:80
http://haiwai-ic.ksosoft.com/infos.ads?v=D1S1E2&d=arMFlS7SpzoOibMPkHtBhzcRibcRbDNPqL7Sc4sOqbsRkrpQlv6RfvMPpL6Tr1d9mvMTjrZDc07CzGZG4bpC15pCnW3CrGZHr0JE6bZDrOJDqS3E3HJHq0pCyXZGvOKHmKKDm4ZG3XJGvGaDuG4CpGZDnGKCuKpGn0JDyPZOnKJPbL6CZXJEpSZOtKsDtOJPYHpOr8MDsGJCtGZOc0NCz4JCk8ZBmuIEmWJDc0dCz83CmuICm4pCc0tCzO2Sqq3PlTdRizMOaDLTZDMPpDd9mLJFeH7TmfpBlS7Pi5ZBmDcPdvoOXD6QbvoTmDtOavcBZzMRlS7SpH6RlS7SpzcPcbsObzoRknMQkLsSbHNTmz2SXDsQXTMPlCNPqL7SVXLGVrMTfzbHoLMPkK6Ub1
JP
—
—
unknown
2608
wpscloudsvr.exe
GET
—
23.37.43.27:80
http://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c%3D
NL
—
—
whitelisted
2824
wps_office_inst.exe
GET
200
52.196.163.120:80
http://haiwai-ic.ksosoft.com/infos.ads?v=D1S1E2&d=arMFlS7SpzoOibMPkHtBhzcRibcRbDNPqL7Sc4sOqbsRkrpQlv6RfvMPpL6Tr1d9mvMTjrJDc07CzGZG4bpC15pCnW3CrGZHr0JE6bZDrOJDqS3E3HJHq0pCyXZGvOKHmKKDm4ZG3XJGvGaDuG4CpGZDnGKCuKpGn0JDyPZOnKJPbL6CZXJEpSZOtKsDtOJPYHpOr8MDsGJCtGZOc0NCz4JCk8ZBmuIEmWJDc0dCz83CmuICm4pCc0tCzO2SqqpSezsT
JP
—
—
unknown
2824
wps_office_inst.exe
GET
200
52.196.163.120:80
http://haiwai-ic.ksosoft.com/infos.ads?v=D1S1E2&d=arMFlS7SpzoOibMPkHtBhzcRibcRbDNPqL7Sc4sOqbsRkrpQlv6RfvMPpL6Tr1d9mvMTjrZDc07CzGZG4bpC15pCnW3CrGZHr0JE6bZDrOJDqS3E3HJHq0pCyXZGvOKHmKKDm4ZG3XJGvGaDuG4CpGZDnGKCuKpGn0JDyPZOnKJPbL6CZXJEpSZOtKsDtOJPYHpOr8MDsGJCtGZOc0NCz4JCk8ZBmuIEmWJDc0dCz83CmuICm4pCc0tCzO2SqqJQkD7TXn6Rqb7SbP2SrqZRlHNHiLcTXHNP1v6P4bcSbD6TibNIkD7TXn6R
JP
—
—
unknown
2608
wpscloudsvr.exe
GET
—
93.184.220.29:80
http://crl.verisign.com/pca3-g5.crl
US
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2860
ksomisc.exe
18.196.78.8:80
dw-online.ksosoft.com
Amazon.com, Inc.
DE
unknown
2824
wps_office_inst.exe
18.196.172.192:80
dw-online.ksosoft.com
Amazon.com, Inc.
DE
unknown
2824
wps_office_inst.exe
52.196.163.120:80
haiwai-ic.ksosoft.com
Amazon.com, Inc.
JP
unknown
2824
wps_office_inst.exe
18.185.158.22:443
shuc-pc.ksord.com
—
US
unknown
2824
wps_office_inst.exe
103.38.144.120:80
wdl1.pcfg.cache.wpscdn.com
Livecom Limited
HK
suspicious
1780
setup_urls_default.500.2014.exe
52.39.184.64:443
api-web-param-us.wps.com
Amazon.com, Inc.
US
unknown
3960
wpscloudsvr.exe
23.37.43.27:80
ocsp.verisign.com
Akamai Technologies, Inc.
NL
whitelisted
2068
wpsupdate.exe
18.185.158.22:443
shuc-pc.ksord.com
—
US
unknown
3900
wpsupdate.exe
18.185.158.22:443
shuc-pc.ksord.com
—
US
unknown
3348
wps.exe
18.185.158.22:443
shuc-pc.ksord.com
—
US
unknown

DNS requests

Domain
IP
Reputation
dw-online.ksosoft.com
  • 18.196.172.192
  • 18.195.82.208
  • 18.196.78.8
  • 35.156.103.70
  • 35.157.20.203
  • 52.29.94.189
unknown
haiwai-ic.ksosoft.com
  • 52.196.163.120
  • 3.115.136.68
unknown
shuc-pc.ksord.com
  • 18.185.158.22
  • 18.197.114.103
unknown
wdl1.pcfg.cache.wpscdn.com
  • 103.38.144.120
malicious
api-web-param-us.wps.com
  • 52.39.184.64
  • 52.33.71.145
  • 52.42.2.67
  • 54.69.133.166
  • 54.149.208.187
  • 52.37.149.136
suspicious
ocsp.verisign.com
  • 23.37.43.27
whitelisted
crl.verisign.com
  • 93.184.220.29
whitelisted
dyn.kingsoftstore.com
  • 54.69.14.161
suspicious
sf.symcd.com
  • 23.37.43.27
whitelisted

Threats

PID
Process
Class
Message
2824
wps_office_inst.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
Process
Message
setup_urls_default.500.2014.exe
[kscreen] isElide:0 switchRec:0 switchRecElide:1
setup_urls_default.500.2014.exe
[kscreen] now screensaver is
setup_urls_default.500.2014.exe
unregister dll path:qingshellext.dll
setup_urls_default.500.2014.exe
unregister dll path:qingshellext.dll
setup_urls_default.500.2014.exe
unInstall qingshellex success!
ksomisc.exe
2019/12/27 11:00:37 I ksomisc 000009c0:00000588 [wWinMain][ksomisc begin] cmdline:-setlng en_US FL:E:\rc_v11_i18_kpr_20191215\Coding\support\ksomisc\ksomisc.cpp(475)
ksomisc.exe
2019/12/27 11:00:39 I ksomisc 00000d8c:00000d48 [wWinMain][ksomisc begin] cmdline:-setservers FL:E:\rc_v11_i18_kpr_20191215\Coding\support\ksomisc\ksomisc.cpp(475)
ksomisc.exe
2019/12/27 11:00:40 I ksomisc 00000a18:00000b38 [wWinMain][ksomisc begin] cmdline:-register FL:E:\rc_v11_i18_kpr_20191215\Coding\support\ksomisc\ksomisc.cpp(475)
ksomisc.exe
2019/12/27 11:00:50 E ksomisc 00000a18:00000b38 [Run]RegisterModule(0, true) faild! FL:E:\rc_v11_i18_kpr_20191215\Coding\support\ksomisc\ksomisc.cpp(84)
ksomisc.exe
2019/12/27 11:00:51 I ksomisc 000006dc:000009e0 [wWinMain][ksomisc begin] cmdline:-regmtfont FL:E:\rc_v11_i18_kpr_20191215\Coding\support\ksomisc\ksomisc.cpp(475)
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
wps_office_inst.exe