File name:

wps_wid.cid-2012264740.1697633534.exe

Full analysis: https://app.any.run/tasks/12ff182d-0c47-4285-987e-00eccedfb11a
Verdict: Malicious activity
Analysis date: October 18, 2023, 12:57:15
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
maldoc-17
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

017FFD746F20A5318C65F6A205564C65

SHA1:

C135373FCA1EA1E21856B1CE329D8D5C4AFA2D90

SHA256:

D2DEFD30C46BD10769CC12E743790C863B039F093B484B8B332CF303E3B6CBE7

SSDEEP:

98304:ls0Tb6R13VlcphPrfyPc2gXETerj06Gfa4APjg1bzIi168Rg+YVOudvFANfMRV9X:zFjg1bKm1plA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 0a1732cddca5ec8304b956f5cebf1278-13_setup_XA_mui_Free.exe.500.2083.exe (PID: 3824)

    • Loads dropped or rewritten executable

      • 0a1732cddca5ec8304b956f5cebf1278-13_setup_XA_mui_Free.exe.500.2083.exe (PID: 3824)

    • Drops known malicious document

      • 0a1732cddca5ec8304b956f5cebf1278-13_setup_XA_mui_Free.exe.500.2083.exe (PID: 3824)

    • Drops the executable file immediately after the start

      • 0a1732cddca5ec8304b956f5cebf1278-13_setup_XA_mui_Free.exe.500.2083.exe (PID: 3824)

  • SUSPICIOUS

    • Reads settings of System Certificates

      • wps_wid.cid-2012264740.1697633534.exe (PID: 4024)
      • 0a1732cddca5ec8304b956f5cebf1278-13_setup_XA_mui_Free.exe.500.2083.exe (PID: 3824)

    • Process drops legitimate windows executable

      • 0a1732cddca5ec8304b956f5cebf1278-13_setup_XA_mui_Free.exe.500.2083.exe (PID: 3824)

    • The process drops C-runtime libraries

      • 0a1732cddca5ec8304b956f5cebf1278-13_setup_XA_mui_Free.exe.500.2083.exe (PID: 3824)

    • Write to the desktop.ini file (may be used to cloak folders)

      • 0a1732cddca5ec8304b956f5cebf1278-13_setup_XA_mui_Free.exe.500.2083.exe (PID: 3824)

  • INFO

    • Reads the computer name

      • wps_wid.cid-2012264740.1697633534.exe (PID: 4024)
      • 0a1732cddca5ec8304b956f5cebf1278-13_setup_XA_mui_Free.exe.500.2083.exe (PID: 3824)

    • Process checks computer location settings

      • wps_wid.cid-2012264740.1697633534.exe (PID: 4024)

    • Checks supported languages

      • wps_wid.cid-2012264740.1697633534.exe (PID: 4024)
      • 0a1732cddca5ec8304b956f5cebf1278-13_setup_XA_mui_Free.exe.500.2083.exe (PID: 3824)

    • Reads the machine GUID from the registry

      • wps_wid.cid-2012264740.1697633534.exe (PID: 4024)
      • 0a1732cddca5ec8304b956f5cebf1278-13_setup_XA_mui_Free.exe.500.2083.exe (PID: 3824)

    • Create files in a temporary directory

      • wps_wid.cid-2012264740.1697633534.exe (PID: 4024)
      • 0a1732cddca5ec8304b956f5cebf1278-13_setup_XA_mui_Free.exe.500.2083.exe (PID: 3824)

    • Creates files or folders in the user directory

      • 0a1732cddca5ec8304b956f5cebf1278-13_setup_XA_mui_Free.exe.500.2083.exe (PID: 3824)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (3.6)
.exe | Generic Win/DOS Executable (1.6)
.exe | DOS Executable Generic (1.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:09:06 12:58:18+02:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.24
CodeSize: 3719168
InitializedDataSize: 1830912
UninitializedDataSize: -
EntryPoint: 0x17eb48
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 11.2.0.11434
ProductVersionNumber: 11.2.0.11434
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Zhuhai Kingsoft Office Software Co.,Ltd
FileDescription: WPS Office Setup
FileVersion: 11,2,0,11434
InternalName: konlinesetup_xa
LegalCopyright: Copyright©2022 Kingsoft Corporation. All rights reserved.
OriginalFileName: konlinesetup_xa.exe
ProductName: WPS Office
ProductVersion: 11,2,0,11434
MIMEType: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
2
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wps_wid.cid-2012264740.1697633534.exe 0a1732cddca5ec8304b956f5cebf1278-13_setup_xa_mui_free.exe.500.2083.exe

Process information

PID
CMD
Path
Indicators
Parent process
3824"C:\Users\admin\Desktop\wps_download\0a1732cddca5ec8304b956f5cebf1278-13_setup_XA_mui_Free.exe.500.2083.exe" -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -createIcons -curlangofinstalledproduct=en_US -notElevateAndDirectlyInstall -D="C:\Users\admin\AppData\Local\Kingsoft\WPS Office" -notautostartwpsC:\Users\admin\Desktop\wps_download\0a1732cddca5ec8304b956f5cebf1278-13_setup_XA_mui_Free.exe.500.2083.exe
wps_wid.cid-2012264740.1697633534.exe
User:
admin
Company:
Zhuhai Kingsoft Office Software Co.,Ltd
Integrity Level:
MEDIUM
Description:
WPS Install Application
Exit code:
0
Version:
12,2,0,13266
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
4024"C:\Users\admin\Desktop\wps_wid.cid-2012264740.1697633534.exe" C:\Users\admin\Desktop\wps_wid.cid-2012264740.1697633534.exe
explorer.exe
User:
admin
Company:
Zhuhai Kingsoft Office Software Co.,Ltd
Integrity Level:
MEDIUM
Description:
WPS Office Setup
Exit code:
0
Version:
11,2,0,11434
Modules
Images
c:\users\admin\desktop\wps_wid.cid-2012264740.1697633534.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
Total events
28 496
Read events
28 471
Write events
25
Delete events
0

Modification events

(PID) Process:(4024) wps_wid.cid-2012264740.1697633534.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\178\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3824) 0a1732cddca5ec8304b956f5cebf1278-13_setup_XA_mui_Free.exe.500.2083.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\178\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
87
Suspicious files
695
Text files
2 158
Unknown types
0

Dropped files

PID
Process
Filename
Type
38240a1732cddca5ec8304b956f5cebf1278-13_setup_XA_mui_Free.exe.500.2083.exeC:\Users\admin\AppData\Local\Temp\wps\~1f2e0e\CONTROL\prereadimages_qing.txt —
MD5:—
SHA256:—
38240a1732cddca5ec8304b956f5cebf1278-13_setup_XA_mui_Free.exe.500.2083.exeC:\Users\admin\AppData\Local\Temp\wps\~1f2e0e\CONTROL\ja_JP\1001.pngimage
MD5:5EEEC3F5D97544FCDE962ABF2A0B13B1
SHA256:0546DA7F432486E30F320D2BE0CBB9BBF9075CF2762D2A384FF5A6EA5B3DFC10
38240a1732cddca5ec8304b956f5cebf1278-13_setup_XA_mui_Free.exe.500.2083.exeC:\Users\admin\AppData\Local\Temp\wps\~1f2e0e\CONTROL\ja_JP\1002.pngimage
MD5:16AEFB6C1454D76A589385767C066433
SHA256:E42774D8B3819C19F13294B917A93330104BCF33D269B1B8CB46A2865D97061D
38240a1732cddca5ec8304b956f5cebf1278-13_setup_XA_mui_Free.exe.500.2083.exeC:\Users\admin\AppData\Local\Temp\wps\~1f2e0e\CONTROL\default\106.pngimage
MD5:83F3FA276CD75A78053372E32D83DB86
SHA256:F183BCB33059BDAC07040F210AF6ABEB94D2E42DBD3703815893D7AF2D6E49A2
38240a1732cddca5ec8304b956f5cebf1278-13_setup_XA_mui_Free.exe.500.2083.exeC:\Users\admin\AppData\Local\Temp\wps\~1f2e0e\CONTROL\ja_JP\1003.pngimage
MD5:2D808B698701B15B33BEC04710A4F7EF
SHA256:3CFD7FA737826AC37D44B79F688B4DD2FE7E61B790A3EB5B90081B7F77446549
38240a1732cddca5ec8304b956f5cebf1278-13_setup_XA_mui_Free.exe.500.2083.exeC:\Users\admin\AppData\Local\Temp\wps\~1f2e0e\CONTROL\default\background.pngimage
MD5:27B9C403FA884EBF4EA0CC23D69A42D7
SHA256:5479C612C47D5CD3EBDAA11EBF897B6E84D95C364587133E03F778450A51412D
38240a1732cddca5ec8304b956f5cebf1278-13_setup_XA_mui_Free.exe.500.2083.exeC:\Users\admin\AppData\Local\Temp\wps\~1f2e0e\CONTROL\default\background_msgbox.pngimage
MD5:5E288BF431CFBE4205505D24D2DC295D
SHA256:59AC8A457DD919C62821CCC395CBAADEB55A00BA4A7A7846F966083667476908
38240a1732cddca5ec8304b956f5cebf1278-13_setup_XA_mui_Free.exe.500.2083.exeC:\Users\admin\AppData\Local\Temp\wps\~1f2e0e\CONTROL\default\background_choose_mode.pngimage
MD5:DFCD86EE5D01A98036E7FAB9634513B7
SHA256:4E595667FFBC31321ED210169F37374123291623ADD8575D6BDD78A4026DA9C2
38240a1732cddca5ec8304b956f5cebf1278-13_setup_XA_mui_Free.exe.500.2083.exeC:\Users\admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.logtext
MD5:A8AF086FFDAC6A285F40CA0093F3C3D8
SHA256:0486142FF6467CF2672BE31EA7C24794574AD8F171D8813C826E9554F075AF4F
38240a1732cddca5ec8304b956f5cebf1278-13_setup_XA_mui_Free.exe.500.2083.exeC:\Users\admin\AppData\Local\Temp\wps\~1f2e0e\CONTROL\ja_JP\1004.pngimage
MD5:46B7F99F4DF13B446570B0157A75C5EE
SHA256:CCEDD187E6A9F4A703395A539F0598E44C985F544EABFCDA96909ED66AE6BA0D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
22
DNS requests
5
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2656
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4024
wps_wid.cid-2012264740.1697633534.exe
52.32.152.192:443
event.wps.com
AMAZON-02
US
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
4024
wps_wid.cid-2012264740.1697633534.exe
104.17.187.189:443
wdl1.pcfg.cache.wpscdn.com
CLOUDFLARENET
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4024
wps_wid.cid-2012264740.1697633534.exe
90.84.175.86:443
params.wps.com
Orange
FR
unknown
3824
0a1732cddca5ec8304b956f5cebf1278-13_setup_XA_mui_Free.exe.500.2083.exe
216.239.34.178:443
www.google-analytics.com
GOOGLE
US
unknown
3824
0a1732cddca5ec8304b956f5cebf1278-13_setup_XA_mui_Free.exe.500.2083.exe
90.84.175.86:443
params.wps.com
Orange
FR
unknown

DNS requests

Domain
IP
Reputation
event.wps.com
  • 52.32.152.192
  • 44.234.195.79
  • 44.235.124.26
  • 54.68.37.140
  • 52.12.32.147
  • 34.208.225.175
  • 52.10.107.171
  • 52.33.90.79
unknown
wdl1.pcfg.cache.wpscdn.com
  • 104.17.187.189
  • 104.17.188.189
unknown
params.wps.com
  • 90.84.175.86
unknown
www.google-analytics.com
  • 216.239.34.178
  • 216.239.38.178
  • 216.239.32.178
  • 216.239.36.178
whitelisted
api.wps.com
  • 90.84.175.86
unknown

Threats

No threats detected
Process
Message
0a1732cddca5ec8304b956f5cebf1278-13_setup_XA_mui_Free.exe.500.2083.exe
[kscreen] isElide:0 switchRec:0 switchRecElide:1
0a1732cddca5ec8304b956f5cebf1278-13_setup_XA_mui_Free.exe.500.2083.exe
QLayout: Attempting to add QLayout "" to QWidget "m_customizeSettingsWidget", which already has a layout
0a1732cddca5ec8304b956f5cebf1278-13_setup_XA_mui_Free.exe.500.2083.exe
QLayout: Attempting to add QLayout "" to QWidget "m_customizeSettingsWidget", which already has a layout
0a1732cddca5ec8304b956f5cebf1278-13_setup_XA_mui_Free.exe.500.2083.exe
QLayout: Attempting to add QLayout "" to QWidget "m_customizeSettingsWidget", which already has a layout
0a1732cddca5ec8304b956f5cebf1278-13_setup_XA_mui_Free.exe.500.2083.exe
QLayout: Attempting to add QLayout "" to QWidget "m_customizeSettingsWidget", which already has a layout
0a1732cddca5ec8304b956f5cebf1278-13_setup_XA_mui_Free.exe.500.2083.exe
QLayout: Attempting to add QLayout "" to QWidget "m_customizeSettingsWidget", which already has a layout
0a1732cddca5ec8304b956f5cebf1278-13_setup_XA_mui_Free.exe.500.2083.exe
QLayout: Attempting to add QLayout "" to QWidget "m_customizeSettingsWidget", which already has a layout
0a1732cddca5ec8304b956f5cebf1278-13_setup_XA_mui_Free.exe.500.2083.exe
QLayout: Attempting to add QLayout "" to QWidget "m_customizeSettingsWidget", which already has a layout
0a1732cddca5ec8304b956f5cebf1278-13_setup_XA_mui_Free.exe.500.2083.exe
QLayout: Attempting to add QLayout "" to QWidget "m_customizeSettingsWidget", which already has a layout
0a1732cddca5ec8304b956f5cebf1278-13_setup_XA_mui_Free.exe.500.2083.exe
QLayout: Attempting to add QLayout "" to QWidget "m_BrandAreaWidget", which already has a layout
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
wps_wid.cid-2012264740.1697633534.exe