File name:

wps_wid.cid-104045182.1718414377.exe

Full analysis: https://app.any.run/tasks/ecadf210-951b-41f0-ac82-e891b9ae5016
Verdict: Malicious activity
Analysis date: June 15, 2024, 01:22:08
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

1C8E9F8FD05D9390E5E315EEF8C1AE2B

SHA1:

9B79E96B4F2702C8DB1D8F651A3E21C89BFAD8E2

SHA256:

C196240FA121F0A443ED424CF9A02F626ACBC0696510863154812093580CD8A6

SSDEEP:

98304:LSs0xsuCgqheF23zUHlItIvO5ElBP+RLixTNaY1DEWI4Cv62DPZmSbqwPG1kutq1:rHsAec

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • wps_wid.cid-104045182.1718414377.exe (PID: 3980)

  • SUSPICIOUS

    • Reads settings of System Certificates

      • wps_wid.cid-104045182.1718414377.exe (PID: 3980)

  • INFO

    • Checks supported languages

      • wps_wid.cid-104045182.1718414377.exe (PID: 3980)
      • wmpnscfg.exe (PID: 4076)

    • Reads the computer name

      • wps_wid.cid-104045182.1718414377.exe (PID: 3980)
      • wmpnscfg.exe (PID: 4076)

    • Process checks computer location settings

      • wps_wid.cid-104045182.1718414377.exe (PID: 3980)

    • Reads the machine GUID from the registry

      • wps_wid.cid-104045182.1718414377.exe (PID: 3980)

    • Reads the software policy settings

      • wps_wid.cid-104045182.1718414377.exe (PID: 3980)

    • Creates files or folders in the user directory

      • wps_wid.cid-104045182.1718414377.exe (PID: 3980)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 4076)

    • Create files in a temporary directory

      • wps_wid.cid-104045182.1718414377.exe (PID: 3980)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (3.6)
.exe | Generic Win/DOS Executable (1.6)
.exe | DOS Executable Generic (1.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:05:30 06:07:28+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.24
CodeSize: 4083712
InitializedDataSize: 1643520
UninitializedDataSize: -
EntryPoint: 0x26e6d7
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 12.2.0.17117
ProductVersionNumber: 12.2.0.17117
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Zhuhai Kingsoft Office Software Co.,Ltd
FileDescription: WPS Office Setup
FileVersion: 12,2,0,17117
InternalName: konlinesetup_xa
LegalCopyright: Copyright©2024 Kingsoft Corporation. All rights reserved.
OriginalFileName: konlinesetup_xa.exe
ProductName: WPS Office
ProductVersion: 12,2,0,17117
MIMEType: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wps_wid.cid-104045182.1718414377.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3980"C:\Users\admin\AppData\Local\Temp\wps_wid.cid-104045182.1718414377.exe" C:\Users\admin\AppData\Local\Temp\wps_wid.cid-104045182.1718414377.exe
explorer.exe
User:
admin
Company:
Zhuhai Kingsoft Office Software Co.,Ltd
Integrity Level:
MEDIUM
Description:
WPS Office Setup
Version:
12,2,0,17117
Modules
Images
c:\users\admin\appdata\local\temp\wps_wid.cid-104045182.1718414377.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
4076"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
8 420
Read events
8 399
Write events
21
Delete events
0

Modification events

(PID) Process:(3980) wps_wid.cid-104045182.1718414377.exeKey:HKEY_CURRENT_USER\Software\kingsoft\kwpsonlinesetup
Operation:writeName:infoGuid
Value:
C73BC875328B47DB821831DF61B72F2E
(PID) Process:(3980) wps_wid.cid-104045182.1718414377.exeKey:HKEY_CURRENT_USER\Software\kingsoft\kwpsonlinesetup
Operation:writeName:infoHdid
Value:
c025f6f8e94d489dbb614d7a940be493
(PID) Process:(3980) wps_wid.cid-104045182.1718414377.exeKey:HKEY_CURRENT_USER\Software\kingsoft\kwpsonlinesetup
Operation:writeName:onlinesetup_penetrate_id_type
Value:
web
(PID) Process:(3980) wps_wid.cid-104045182.1718414377.exeKey:HKEY_CURRENT_USER\Software\kingsoft\kwpsonlinesetup
Operation:writeName:onlinesetup_penetrate_id
Value:
cid-104045182.1718414377
(PID) Process:(3980) wps_wid.cid-104045182.1718414377.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3980) wps_wid.cid-104045182.1718414377.exeKey:HKEY_CURRENT_USER\Software\kingsoft\Office\6.0\plugins\kdcsdk
Operation:writeName:countrycode
Value:
DE
(PID) Process:(3980) wps_wid.cid-104045182.1718414377.exeKey:HKEY_CURRENT_USER\Software\kingsoft\Office\6.0\plugins\kdcsdk
Operation:writeName:lastupdatecountrycode
Value:
1718414536380
(PID) Process:(3980) wps_wid.cid-104045182.1718414377.exeKey:HKEY_CURRENT_USER\Software\kingsoft\Office\6.0\plugins\kdcsdk
Operation:writeName:lastUpdateDeviceInfoDate
Value:
2024/6/15
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
9
DNS requests
3
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3980
wps_wid.cid-104045182.1718414377.exe
142.250.185.78:443
www.google-analytics.com
GOOGLE
US
whitelisted
3980
wps_wid.cid-104045182.1718414377.exe
90.84.175.86:443
api.wps.com
Orange
FR
unknown
3980
wps_wid.cid-104045182.1718414377.exe
104.16.83.69:443
wdl1.pcfg.cache.wpscdn.com
CLOUDFLARENET
—
unknown

DNS requests

Domain
IP
Reputation
www.google-analytics.com
  • 142.250.185.78
whitelisted
api.wps.com
  • 90.84.175.86
unknown
wdl1.pcfg.cache.wpscdn.com
  • 104.16.83.69
  • 104.16.84.69
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
wps_wid.cid-104045182.1718414377.exe