File name:

wps_wid.cid-179914454.1735277789.exe

Full analysis: https://app.any.run/tasks/51e96738-f40e-4100-a1f6-63f140557435
Verdict: Malicious activity
Analysis date: December 27, 2024, 05:38:45
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
wps
qrcode
maldoc-17
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

C45689F8E17CAD73431F6585B309B9D8

SHA1:

43984B0EA7D3CFA847FC0557FB8C0BF53F644A8E

SHA256:

BF2821EA11776C6B48D08106E401F4F23FF703392937FDCA3A6E47773D4B9454

SSDEEP:

98304:bns0Xwyuvk5cA5bK3dmTtySEHmRqvpQuaYwhL9+FOsWbxFiETcHJJp4ubuExNgt9:cbkUeT1L5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops known malicious document

      • 29368139f1709fe83757f8d2d53918f6-15_setup_XA_mui_Free.exe.500.2083.exe (PID: 3224)

  • SUSPICIOUS

    • WPS mutex has been found

      • wps_wid.cid-179914454.1735277789.exe (PID: 6248)
      • 29368139f1709fe83757f8d2d53918f6-15_setup_XA_mui_Free.exe.500.2083.exe (PID: 3224)

    • Executable content was dropped or overwritten

      • 29368139f1709fe83757f8d2d53918f6-15_setup_XA_mui_Free.exe.500.2083.exe (PID: 3224)

    • Process drops legitimate windows executable

      • 29368139f1709fe83757f8d2d53918f6-15_setup_XA_mui_Free.exe.500.2083.exe (PID: 3224)

    • The process drops C-runtime libraries

      • 29368139f1709fe83757f8d2d53918f6-15_setup_XA_mui_Free.exe.500.2083.exe (PID: 3224)

    • There is functionality for taking screenshot (YARA)

      • 29368139f1709fe83757f8d2d53918f6-15_setup_XA_mui_Free.exe.500.2083.exe (PID: 3224)

    • Write to the desktop.ini file (may be used to cloak folders)

      • 29368139f1709fe83757f8d2d53918f6-15_setup_XA_mui_Free.exe.500.2083.exe (PID: 3224)

    • Reads security settings of Internet Explorer

      • 29368139f1709fe83757f8d2d53918f6-15_setup_XA_mui_Free.exe.500.2083.exe (PID: 3224)

    • Checks Windows Trust Settings

      • 29368139f1709fe83757f8d2d53918f6-15_setup_XA_mui_Free.exe.500.2083.exe (PID: 3224)

    • Process drops SQLite DLL files

      • 29368139f1709fe83757f8d2d53918f6-15_setup_XA_mui_Free.exe.500.2083.exe (PID: 3224)

    • The process creates files with name similar to system file names

      • 29368139f1709fe83757f8d2d53918f6-15_setup_XA_mui_Free.exe.500.2083.exe (PID: 3224)

  • INFO

    • Reads the software policy settings

      • wps_wid.cid-179914454.1735277789.exe (PID: 6248)
      • 29368139f1709fe83757f8d2d53918f6-15_setup_XA_mui_Free.exe.500.2083.exe (PID: 3224)

    • Reads the computer name

      • wps_wid.cid-179914454.1735277789.exe (PID: 6248)
      • 29368139f1709fe83757f8d2d53918f6-15_setup_XA_mui_Free.exe.500.2083.exe (PID: 3224)

    • Creates files or folders in the user directory

      • wps_wid.cid-179914454.1735277789.exe (PID: 6248)
      • 29368139f1709fe83757f8d2d53918f6-15_setup_XA_mui_Free.exe.500.2083.exe (PID: 3224)

    • Checks supported languages

      • wps_wid.cid-179914454.1735277789.exe (PID: 6248)
      • 29368139f1709fe83757f8d2d53918f6-15_setup_XA_mui_Free.exe.500.2083.exe (PID: 3224)

    • Create files in a temporary directory

      • wps_wid.cid-179914454.1735277789.exe (PID: 6248)
      • 29368139f1709fe83757f8d2d53918f6-15_setup_XA_mui_Free.exe.500.2083.exe (PID: 3224)

    • Process checks computer location settings

      • wps_wid.cid-179914454.1735277789.exe (PID: 6248)

    • Reads the machine GUID from the registry

      • wps_wid.cid-179914454.1735277789.exe (PID: 6248)
      • 29368139f1709fe83757f8d2d53918f6-15_setup_XA_mui_Free.exe.500.2083.exe (PID: 3224)

    • The sample compiled with english language support

      • 29368139f1709fe83757f8d2d53918f6-15_setup_XA_mui_Free.exe.500.2083.exe (PID: 3224)

    • The sample compiled with chinese language support

      • 29368139f1709fe83757f8d2d53918f6-15_setup_XA_mui_Free.exe.500.2083.exe (PID: 3224)

    • The sample compiled with japanese language support

      • 29368139f1709fe83757f8d2d53918f6-15_setup_XA_mui_Free.exe.500.2083.exe (PID: 3224)

    • Sends debugging messages

      • 29368139f1709fe83757f8d2d53918f6-15_setup_XA_mui_Free.exe.500.2083.exe (PID: 3224)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (3.6)
.exe | Generic Win/DOS Executable (1.6)
.exe | DOS Executable Generic (1.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:11:11 15:54:01+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 4085248
InitializedDataSize: 1803776
UninitializedDataSize: -
EntryPoint: 0x2756f5
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 12.9.0.18826
ProductVersionNumber: 12.9.0.18826
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Zhuhai Kingsoft Office Software Co.,Ltd
FileDescription: WPS Office Setup
FileVersion: 12,9,0,18826
InternalName: konlinesetup_xa
LegalCopyright: Copyright©2024 Kingsoft Corporation. All rights reserved.
OriginalFileName: konlinesetup_xa.exe
ProductName: WPS Office
ProductVersion: 12,9,0,18826
MIMEType: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
127
Monitored processes
2
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wps_wid.cid-179914454.1735277789.exe 29368139f1709fe83757f8d2d53918f6-15_setup_xa_mui_free.exe.500.2083.exe

Process information

PID
CMD
Path
Indicators
Parent process
3224C:\Users\admin\AppData\Local\Temp\wps_download\29368139f1709fe83757f8d2d53918f6-15_setup_XA_mui_Free.exe.500.2083.exe -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -curlangofinstalledproduct=en_US -notElevateAndDirectlyInstall -D="C:\Users\admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps -enableSetupMuiPkg -appdata="C:\Users\admin\AppData\Roaming"C:\Users\admin\AppData\Local\Temp\wps_download\29368139f1709fe83757f8d2d53918f6-15_setup_XA_mui_Free.exe.500.2083.exe
wps_wid.cid-179914454.1735277789.exe
User:
admin
Company:
Zhuhai Kingsoft Office Software Co.,Ltd
Integrity Level:
MEDIUM
Description:
WPS Install Application
Version:
12,2,0,19307
Modules
Images
c:\users\admin\appdata\local\temp\wps_download\29368139f1709fe83757f8d2d53918f6-15_setup_xa_mui_free.exe.500.2083.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msi.dll
6248"C:\Users\admin\AppData\Local\Temp\wps_wid.cid-179914454.1735277789.exe" C:\Users\admin\AppData\Local\Temp\wps_wid.cid-179914454.1735277789.exe
explorer.exe
User:
admin
Company:
Zhuhai Kingsoft Office Software Co.,Ltd
Integrity Level:
MEDIUM
Description:
WPS Office Setup
Version:
12,9,0,18826
Modules
Images
c:\users\admin\appdata\local\temp\wps_wid.cid-179914454.1735277789.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
10 125
Read events
10 102
Write events
20
Delete events
3

Modification events

(PID) Process:(6248) wps_wid.cid-179914454.1735277789.exeKey:HKEY_CURRENT_USER\SOFTWARE\kingsoft\kwpsonlinesetup
Operation:writeName:onlinesetup_penetrate_id_type
Value:
web
(PID) Process:(6248) wps_wid.cid-179914454.1735277789.exeKey:HKEY_CURRENT_USER\SOFTWARE\kingsoft\kwpsonlinesetup
Operation:writeName:onlinesetup_penetrate_id
Value:
cid-179914454.1735277789
(PID) Process:(6248) wps_wid.cid-179914454.1735277789.exeKey:HKEY_CURRENT_USER\SOFTWARE\kingsoft\Office\6.0\plugins\kdcsdk
Operation:writeName:countrycode
Value:
DE
(PID) Process:(6248) wps_wid.cid-179914454.1735277789.exeKey:HKEY_CURRENT_USER\SOFTWARE\kingsoft\Office\6.0\plugins\kdcsdk
Operation:writeName:lastupdatecountrycode
Value:
1735277932854
(PID) Process:(6248) wps_wid.cid-179914454.1735277789.exeKey:HKEY_CURRENT_USER\SOFTWARE\kingsoft\Office\6.0\Common
Operation:writeName:newGuideShow
Value:
1
(PID) Process:(6248) wps_wid.cid-179914454.1735277789.exeKey:HKEY_CURRENT_USER\SOFTWARE\kingsoft\kwpsonlinesetup
Operation:writeName:infoGuid
Value:
541E01EAB2FA4679A5AC2007F476B027
(PID) Process:(6248) wps_wid.cid-179914454.1735277789.exeKey:HKEY_CURRENT_USER\SOFTWARE\kingsoft\kwpsonlinesetup
Operation:writeName:infoHdid
Value:
c834d836353735e46d746cce8b512504
(PID) Process:(6248) wps_wid.cid-179914454.1735277789.exeKey:HKEY_CURRENT_USER\SOFTWARE\kingsoft\Office\6.0\plugins\kdcsdk
Operation:writeName:lastUpdateDeviceInfoDate
Value:
2024/12/27
(PID) Process:(6248) wps_wid.cid-179914454.1735277789.exeKey:HKEY_CURRENT_USER\SOFTWARE\kingsoft\Office\6.0\Common
Operation:writeName:Version
Value:
12.2.0.19307
(PID) Process:(6248) wps_wid.cid-179914454.1735277789.exeKey:HKEY_CURRENT_USER\SOFTWARE\kingsoft\kwpsonlinesetup\shortlink
Operation:delete keyName:(default)
Value:
Executable files
347
Suspicious files
1 018
Text files
2 415
Unknown types
13

Dropped files

PID
Process
Filename
Type
6248wps_wid.cid-179914454.1735277789.exeC:\Users\admin\AppData\Local\Temp\wps_download\29368139f1709fe83757f8d2d53918f6-15_setup_XA_mui_Free.exe.500.2083.exe —
MD5:—
SHA256:—
322429368139f1709fe83757f8d2d53918f6-15_setup_XA_mui_Free.exe.500.2083.exeC:\Users\admin\AppData\Local\Temp\wps\~14413d\CONTROL\prereadimages_qing.txt —
MD5:—
SHA256:—
322429368139f1709fe83757f8d2d53918f6-15_setup_XA_mui_Free.exe.500.2083.exeC:\Users\admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.logtext
MD5:4DB82E7F42C8B5539F31F5ED5A565CE0
SHA256:6BF65BA42D7EB62E33FD1FB7E5D0E66F11967BE528D029D22A75E26EA85E98B3
322429368139f1709fe83757f8d2d53918f6-15_setup_XA_mui_Free.exe.500.2083.exeC:\Users\admin\AppData\Local\Temp\wps\~14413d\CONTROL\default\background.pngimage
MD5:27B9C403FA884EBF4EA0CC23D69A42D7
SHA256:5479C612C47D5CD3EBDAA11EBF897B6E84D95C364587133E03F778450A51412D
322429368139f1709fe83757f8d2d53918f6-15_setup_XA_mui_Free.exe.500.2083.exeC:\Users\admin\AppData\Local\Temp\wps\~14413d\CONTROL\default\background_without_version.PNGimage
MD5:3205727D046D39384D2987D152D47775
SHA256:2B0893B707B706E3B9BE9ABC43D0F961C37F24E2086E3B42979C420D35BB3913
322429368139f1709fe83757f8d2d53918f6-15_setup_XA_mui_Free.exe.500.2083.exeC:\Users\admin\AppData\Local\Temp\wps\~14413d\CONTROL\default\106.pngimage
MD5:83F3FA276CD75A78053372E32D83DB86
SHA256:F183BCB33059BDAC07040F210AF6ABEB94D2E42DBD3703815893D7AF2D6E49A2
322429368139f1709fe83757f8d2d53918f6-15_setup_XA_mui_Free.exe.500.2083.exeC:\Users\admin\AppData\Local\Temp\wps\~14413d\CONTROL\ja_JP\1002.pngimage
MD5:16AEFB6C1454D76A589385767C066433
SHA256:E42774D8B3819C19F13294B917A93330104BCF33D269B1B8CB46A2865D97061D
322429368139f1709fe83757f8d2d53918f6-15_setup_XA_mui_Free.exe.500.2083.exeC:\Users\admin\AppData\Local\Temp\wps\~14413d\CONTROL\default\background_msgbox.pngimage
MD5:5E288BF431CFBE4205505D24D2DC295D
SHA256:59AC8A457DD919C62821CCC395CBAADEB55A00BA4A7A7846F966083667476908
322429368139f1709fe83757f8d2d53918f6-15_setup_XA_mui_Free.exe.500.2083.exeC:\Users\admin\AppData\Local\Temp\wps\~14413d\CONTROL\ja_JP\1003.pngimage
MD5:2D808B698701B15B33BEC04710A4F7EF
SHA256:3CFD7FA737826AC37D44B79F688B4DD2FE7E61B790A3EB5B90081B7F77446549
322429368139f1709fe83757f8d2d53918f6-15_setup_XA_mui_Free.exe.500.2083.exeC:\Users\admin\AppData\Local\Temp\wps\~14413d\CONTROL\default\background_choose_mode.pngimage
MD5:DFCD86EE5D01A98036E7FAB9634513B7
SHA256:4E595667FFBC31321ED210169F37374123291623ADD8575D6BDD78A4026DA9C2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
40
DNS requests
22
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5448
svchost.exe
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5448
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7160
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7160
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
2.23.209.133:443
www.bing.com
Akamai International B.V.
GB
whitelisted
5448
svchost.exe
2.16.164.120:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
5448
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5064
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4712
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
6248
wps_wid.cid-179914454.1735277789.exe
90.84.175.86:443
api.wps.com
Orange
FR
whitelisted
6248
wps_wid.cid-179914454.1735277789.exe
216.58.206.78:443
www.google-analytics.com
GOOGLE
US
unknown
6248
wps_wid.cid-179914454.1735277789.exe
104.16.83.69:443
wdl1.pcfg.cache.wpscdn.com
CLOUDFLARENET
—
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
whitelisted
google.com
  • 142.250.185.206
whitelisted
www.bing.com
  • 2.23.209.133
  • 2.23.209.182
  • 2.23.209.130
  • 2.23.209.149
whitelisted
crl.microsoft.com
  • 2.16.164.120
  • 2.16.164.49
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
www.google-analytics.com
  • 216.58.206.78
whitelisted
api.wps.com
  • 90.84.175.86
whitelisted
params.wps.com
  • 90.84.175.86
whitelisted
wdl1.pcfg.cache.wpscdn.com
  • 104.16.83.69
  • 104.16.84.69
unknown

Threats

No threats detected
Process
Message
29368139f1709fe83757f8d2d53918f6-15_setup_XA_mui_Free.exe.500.2083.exe
[kscreen] isElide:0 switchRec:0 switchRecElide:1
29368139f1709fe83757f8d2d53918f6-15_setup_XA_mui_Free.exe.500.2083.exe
QLayout: Attempting to add QLayout "" to QWidget "", which already has a layout
29368139f1709fe83757f8d2d53918f6-15_setup_XA_mui_Free.exe.500.2083.exe
QLayout: Attempting to add QLayout "" to QWidget "m_BrandAreaWidget", which already has a layout
29368139f1709fe83757f8d2d53918f6-15_setup_XA_mui_Free.exe.500.2083.exe
QLayout: Attempting to add QLayout "" to QWidget "m_customizeSettingsWidget", which already has a layout
29368139f1709fe83757f8d2d53918f6-15_setup_XA_mui_Free.exe.500.2083.exe
QLayout: Attempting to add QLayout "" to QWidget "m_customizeSettingsWidget", which already has a layout
29368139f1709fe83757f8d2d53918f6-15_setup_XA_mui_Free.exe.500.2083.exe
QLayout: Attempting to add QLayout "" to QWidget "m_customizeSettingsWidget", which already has a layout
29368139f1709fe83757f8d2d53918f6-15_setup_XA_mui_Free.exe.500.2083.exe
QLayout: Attempting to add QLayout "" to QWidget "m_customizeSettingsWidget", which already has a layout
29368139f1709fe83757f8d2d53918f6-15_setup_XA_mui_Free.exe.500.2083.exe
QLayout: Attempting to add QLayout "" to QWidget "m_customizeSettingsWidget", which already has a layout
29368139f1709fe83757f8d2d53918f6-15_setup_XA_mui_Free.exe.500.2083.exe
QLayout: Attempting to add QLayout "" to QWidget "m_customizeSettingsWidget", which already has a layout
29368139f1709fe83757f8d2d53918f6-15_setup_XA_mui_Free.exe.500.2083.exe
QLayout: Attempting to add QLayout "" to QWidget "m_customizeSettingsWidget", which already has a layout
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
wps_wid.cid-179914454.1735277789.exe