File name:

wps_wid.cid-1665049766.1698655127.exe

Full analysis: https://app.any.run/tasks/e3d4555e-ef17-4b1a-b771-bbb507724e48
Verdict: Malicious activity
Analysis date: October 30, 2023, 12:49:20
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

427661E120220CDDCD9B40F2E70E5DCA

SHA1:

420BE7C94BEDADF1351BE7B67911E7B77FE559F2

SHA256:

F975DF2D72358D9798F505832929E6A0CD82B04ADB63F36E45D112FD7A6F4AC2

SSDEEP:

98304:is0Aaylvr3qLguK49xEtRvqq1ch6+G8H2eGAE27aeFjuyqI4zTTCUIM00jQMkES4:oi4a5N

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • 09db699b58b0ad591392bc08cea3cab3-13_setup_XA_mui_Free.exe.500.2079.exe (PID: 272)

    • Drops the executable file immediately after the start

      • 09db699b58b0ad591392bc08cea3cab3-13_setup_XA_mui_Free.exe.500.2079.exe (PID: 272)

  • SUSPICIOUS

    • Reads settings of System Certificates

      • wps_wid.cid-1665049766.1698655127.exe (PID: 1824)
      • 09db699b58b0ad591392bc08cea3cab3-13_setup_XA_mui_Free.exe.500.2079.exe (PID: 272)

    • Process drops legitimate windows executable

      • 09db699b58b0ad591392bc08cea3cab3-13_setup_XA_mui_Free.exe.500.2079.exe (PID: 272)

    • The process drops C-runtime libraries

      • 09db699b58b0ad591392bc08cea3cab3-13_setup_XA_mui_Free.exe.500.2079.exe (PID: 272)

    • Write to the desktop.ini file (may be used to cloak folders)

      • 09db699b58b0ad591392bc08cea3cab3-13_setup_XA_mui_Free.exe.500.2079.exe (PID: 272)

  • INFO

    • Checks supported languages

      • wps_wid.cid-1665049766.1698655127.exe (PID: 1824)
      • wmpnscfg.exe (PID: 3940)
      • 09db699b58b0ad591392bc08cea3cab3-13_setup_XA_mui_Free.exe.500.2079.exe (PID: 272)

    • Reads the computer name

      • wps_wid.cid-1665049766.1698655127.exe (PID: 1824)
      • wmpnscfg.exe (PID: 3940)
      • 09db699b58b0ad591392bc08cea3cab3-13_setup_XA_mui_Free.exe.500.2079.exe (PID: 272)

    • Process checks computer location settings

      • wps_wid.cid-1665049766.1698655127.exe (PID: 1824)

    • Reads the machine GUID from the registry

      • wps_wid.cid-1665049766.1698655127.exe (PID: 1824)
      • wmpnscfg.exe (PID: 3940)
      • 09db699b58b0ad591392bc08cea3cab3-13_setup_XA_mui_Free.exe.500.2079.exe (PID: 272)

    • Create files in a temporary directory

      • wps_wid.cid-1665049766.1698655127.exe (PID: 1824)
      • 09db699b58b0ad591392bc08cea3cab3-13_setup_XA_mui_Free.exe.500.2079.exe (PID: 272)

    • Creates files or folders in the user directory

      • wps_wid.cid-1665049766.1698655127.exe (PID: 1824)
      • 09db699b58b0ad591392bc08cea3cab3-13_setup_XA_mui_Free.exe.500.2079.exe (PID: 272)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3940)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (3.6)
.exe | Generic Win/DOS Executable (1.6)
.exe | DOS Executable Generic (1.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:09:09 23:53:41+02:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.24
CodeSize: 3830272
InitializedDataSize: 1705984
UninitializedDataSize: -
EntryPoint: 0x185458
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 12.2.0.13208
ProductVersionNumber: 12.2.0.13208
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Zhuhai Kingsoft Office Software Co.,Ltd
FileDescription: WPS Office Setup
FileVersion: 12,2,0,13208
InternalName: konlinesetup_xa
LegalCopyright: Copyright©2023 Kingsoft Corporation. All rights reserved.
OriginalFileName: konlinesetup_xa.exe
ProductName: WPS Office
ProductVersion: 12,2,0,13208
MIMEType: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wps_wid.cid-1665049766.1698655127.exe wmpnscfg.exe no specs 09db699b58b0ad591392bc08cea3cab3-13_setup_xa_mui_free.exe.500.2079.exe

Process information

PID
CMD
Path
Indicators
Parent process
272"C:\Users\admin\AppData\Local\Temp\wps_download\09db699b58b0ad591392bc08cea3cab3-13_setup_XA_mui_Free.exe.500.2079.exe" -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -createIcons -curlangofinstalledproduct=en_US -notElevateAndDirectlyInstall -D="C:\Users\admin\AppData\Local\Kingsoft\WPS Office"C:\Users\admin\AppData\Local\Temp\wps_download\09db699b58b0ad591392bc08cea3cab3-13_setup_XA_mui_Free.exe.500.2079.exe
wps_wid.cid-1665049766.1698655127.exe
User:
admin
Company:
Zhuhai Kingsoft Office Software Co.,Ltd
Integrity Level:
MEDIUM
Description:
WPS Install Application
Exit code:
0
Version:
12,2,0,13266
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\wps_download\09db699b58b0ad591392bc08cea3cab3-13_setup_xa_mui_free.exe.500.2079.exe
c:\windows\system32\msi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
1824"C:\Users\admin\AppData\Local\Temp\wps_wid.cid-1665049766.1698655127.exe" C:\Users\admin\AppData\Local\Temp\wps_wid.cid-1665049766.1698655127.exe
explorer.exe
User:
admin
Company:
Zhuhai Kingsoft Office Software Co.,Ltd
Integrity Level:
MEDIUM
Description:
WPS Office Setup
Exit code:
0
Version:
12,2,0,13208
Modules
Images
c:\users\admin\appdata\local\temp\wps_wid.cid-1665049766.1698655127.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\imm32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
3940"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
11 266
Read events
11 238
Write events
25
Delete events
3

Modification events

(PID) Process:(1824) wps_wid.cid-1665049766.1698655127.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\178\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3940) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{374F19BF-59A7-4EE9-831B-CE9821C18E99}\{CFC0FB71-D3BE-40AE-B18C-6EF9FC4CE0D1}
Operation:delete keyName:(default)
Value:
(PID) Process:(3940) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{374F19BF-59A7-4EE9-831B-CE9821C18E99}
Operation:delete keyName:(default)
Value:
(PID) Process:(3940) wmpnscfg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Health\{46F44855-CEE5-4AC3-899D-1220A4E8C9DA}
Operation:delete keyName:(default)
Value:
(PID) Process:(272) 09db699b58b0ad591392bc08cea3cab3-13_setup_XA_mui_Free.exe.500.2079.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\178\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
84
Suspicious files
137
Text files
1 854
Unknown types
0

Dropped files

PID
Process
Filename
Type
1824wps_wid.cid-1665049766.1698655127.exeC:\Users\admin\AppData\Local\Temp\wps_download\09db699b58b0ad591392bc08cea3cab3-13_setup_XA_mui_Free.exe.500.2079.exe —
MD5:—
SHA256:—
27209db699b58b0ad591392bc08cea3cab3-13_setup_XA_mui_Free.exe.500.2079.exeC:\Users\admin\AppData\Local\Temp\wps\~21c62d\CONTROL\prereadimages_qing.txt —
MD5:—
SHA256:—
27209db699b58b0ad591392bc08cea3cab3-13_setup_XA_mui_Free.exe.500.2079.exeC:\Users\admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.logtext
MD5:1A40FA77BB31CEF5978778B2CF21BCED
SHA256:1BBB30AD54D09B182D2745732CF650DB65A218A49E4CF62ABEEDC6B1CADBD617
27209db699b58b0ad591392bc08cea3cab3-13_setup_XA_mui_Free.exe.500.2079.exeC:\Users\admin\AppData\Local\Temp\wps\~21c62d\CONTROL\default\106.pngimage
MD5:83F3FA276CD75A78053372E32D83DB86
SHA256:F183BCB33059BDAC07040F210AF6ABEB94D2E42DBD3703815893D7AF2D6E49A2
27209db699b58b0ad591392bc08cea3cab3-13_setup_XA_mui_Free.exe.500.2079.exeC:\Users\admin\AppData\Local\Temp\wps\~21c62d\CONTROL\ja_JP\1001.pngimage
MD5:5EEEC3F5D97544FCDE962ABF2A0B13B1
SHA256:0546DA7F432486E30F320D2BE0CBB9BBF9075CF2762D2A384FF5A6EA5B3DFC10
27209db699b58b0ad591392bc08cea3cab3-13_setup_XA_mui_Free.exe.500.2079.exeC:\Users\admin\AppData\Local\Temp\wps\~21c62d\CONTROL\default\background_msgbox.pngimage
MD5:5E288BF431CFBE4205505D24D2DC295D
SHA256:59AC8A457DD919C62821CCC395CBAADEB55A00BA4A7A7846F966083667476908
27209db699b58b0ad591392bc08cea3cab3-13_setup_XA_mui_Free.exe.500.2079.exeC:\Users\admin\AppData\Local\Temp\wps\~21c62d\CONTROL\ja_JP\1003.pngimage
MD5:2D808B698701B15B33BEC04710A4F7EF
SHA256:3CFD7FA737826AC37D44B79F688B4DD2FE7E61B790A3EB5B90081B7F77446549
27209db699b58b0ad591392bc08cea3cab3-13_setup_XA_mui_Free.exe.500.2079.exeC:\Users\admin\AppData\Local\Temp\wps\~21c62d\CONTROL\default\background.pngimage
MD5:27B9C403FA884EBF4EA0CC23D69A42D7
SHA256:5479C612C47D5CD3EBDAA11EBF897B6E84D95C364587133E03F778450A51412D
27209db699b58b0ad591392bc08cea3cab3-13_setup_XA_mui_Free.exe.500.2079.exeC:\Users\admin\AppData\Local\Temp\wps\~21c62d\CONTROL\ja_JP\1002.pngimage
MD5:16AEFB6C1454D76A589385767C066433
SHA256:E42774D8B3819C19F13294B917A93330104BCF33D269B1B8CB46A2865D97061D
27209db699b58b0ad591392bc08cea3cab3-13_setup_XA_mui_Free.exe.500.2079.exeC:\Users\admin\AppData\Local\Temp\wps\~21c62d\CONTROL\default\background_xa.pngimage
MD5:367C2059F78AB2055CF62C373A94876D
SHA256:89B8259727FA09E45DF119A1B812A3343EB0B7A5F86EB58D952934472E8F02B0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
20
DNS requests
5
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2656
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
1824
wps_wid.cid-1665049766.1698655127.exe
216.58.213.110:443
www.google-analytics.com
GOOGLE
US
whitelisted
1824
wps_wid.cid-1665049766.1698655127.exe
104.17.188.189:443
wdl1.pcfg.cache.wpscdn.com
CLOUDFLARENET
—
unknown
1824
wps_wid.cid-1665049766.1698655127.exe
90.84.175.86:443
api.wps.com
Orange
FR
unknown
272
09db699b58b0ad591392bc08cea3cab3-13_setup_XA_mui_Free.exe.500.2079.exe
216.58.212.14:443
www.google-analytics.com
GOOGLE
US
whitelisted
272
09db699b58b0ad591392bc08cea3cab3-13_setup_XA_mui_Free.exe.500.2079.exe
90.84.175.86:443
api.wps.com
Orange
FR
unknown

DNS requests

Domain
IP
Reputation
www.google-analytics.com
  • 216.58.213.110
  • 216.58.212.14
whitelisted
wdl1.pcfg.cache.wpscdn.com
  • 104.17.188.189
  • 104.17.187.189
unknown
api.wps.com
  • 90.84.175.86
unknown

Threats

No threats detected
Process
Message
09db699b58b0ad591392bc08cea3cab3-13_setup_XA_mui_Free.exe.500.2079.exe
[kscreen] isElide:0 switchRec:0 switchRecElide:1
09db699b58b0ad591392bc08cea3cab3-13_setup_XA_mui_Free.exe.500.2079.exe
QLayout: Attempting to add QLayout "" to QWidget "m_BrandAreaWidget", which already has a layout
09db699b58b0ad591392bc08cea3cab3-13_setup_XA_mui_Free.exe.500.2079.exe
QLayout: Attempting to add QLayout "" to QWidget "m_customizeSettingsWidget", which already has a layout
09db699b58b0ad591392bc08cea3cab3-13_setup_XA_mui_Free.exe.500.2079.exe
QLayout: Attempting to add QLayout "" to QWidget "m_customizeSettingsWidget", which already has a layout
09db699b58b0ad591392bc08cea3cab3-13_setup_XA_mui_Free.exe.500.2079.exe
QLayout: Attempting to add QLayout "" to QWidget "", which already has a layout
09db699b58b0ad591392bc08cea3cab3-13_setup_XA_mui_Free.exe.500.2079.exe
QLayout: Attempting to add QLayout "" to QWidget "m_customizeSettingsWidget", which already has a layout
09db699b58b0ad591392bc08cea3cab3-13_setup_XA_mui_Free.exe.500.2079.exe
QLayout: Attempting to add QLayout "" to QWidget "m_customizeSettingsWidget", which already has a layout
09db699b58b0ad591392bc08cea3cab3-13_setup_XA_mui_Free.exe.500.2079.exe
QLayout: Attempting to add QLayout "" to QWidget "m_customizeSettingsWidget", which already has a layout
09db699b58b0ad591392bc08cea3cab3-13_setup_XA_mui_Free.exe.500.2079.exe
QLayout: Attempting to add QLayout "" to QWidget "m_customizeSettingsWidget", which already has a layout
09db699b58b0ad591392bc08cea3cab3-13_setup_XA_mui_Free.exe.500.2079.exe
QLayout: Attempting to add QLayout "" to QWidget "m_customizeSettingsWidget", which already has a layout
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
wps_wid.cid-1665049766.1698655127.exe