Overview

overview

10

Static

static

1

PPT_WPS-of...64.msi

windows7-x64

6

PPT_WPS-of...64.msi

windows10-1703-x64

6

PPT_WPS-of...64.msi

windows10-2004-x64

6

PPT_WPS-of...64.msi

windows11-21h2-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    141s
  • platform
    windows10-1703_x64
  • resource
    win10-20240611-en
  • resource tags

    arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
  • submitted
    22/06/2024, 02:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    PPT_WPS-offce_WIN64.msi
  • Size 221.7MB
  • Sample240622-cx13maxdpj
  • SHA256 d20a66f15530e9d2dbc74567d30a8b839f0b5a68f43387aaf16291802ebd0049
  • MD5 SHA1 SHA512 SSDEEP
Score
6/10
persistenceprivilege_escalation

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 8 IoCs
  • Drops file in Windows directory 8 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 1 TTPs 1 IoCs
    persistenceprivilege_escalation
  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\PPT_WPS-offce_WIN64.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1176
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4568
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:4408
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding F5A105954706AED51B691F074FA0740E
        2⤵
        • Drops file in Program Files directory
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:4468
        • C:\Program Files\Windows Defenderr\lop.exe
          "C:\Program Files\Windows Defenderr\lop.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4808
          • C:\ProgramData\kingsoft\20240622_23040\lop.exe
            "C:\ProgramData\kingsoft\20240622_23040\lop.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            PID:2144
        • C:\Program Files\Windows Defenderr\Phone.exe
          "C:\Program Files\Windows Defenderr\Phone.exe"
          3⤵
          • Executes dropped EXE
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:196
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 196 -s 1456
            4⤵
            • Program crash
            PID:3548
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4560
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
      1⤵
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:1324
    • C:\ProgramData\kingsoft\20240622_23040\lop.exe
      "C:\ProgramData\kingsoft\20240622_23040\lop.exe" -downpower -msgwndname=wpssetup_message_E58D702 -curinstalltemppath=C:\Users\Admin\AppData\Local\Temp\wps\~e58cfbf\
      1⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:3928
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:3440
      • C:\ProgramData\{6C001415-B77E-442d-9A79-A8xv31w51D8E}\{FFB6DE3B-56E0-4eb6-A578-B8xvC5w56CD8}.exe
        "C:\ProgramData\{6C001415-B77E-442d-9A79-A8xv31w51D8E}\{FFB6DE3B-56E0-4eb6-A578-B8xvC5w56CD8}.exe" /s "C:\ProgramData\{6C001415-B77E-442d-9A79-A8xv31w51D8E}\{33189879-52C1-4586-9B59-AFxv1Cw587E8}"
        1⤵
        • Adds Run key to start application
        • Executes dropped EXE
        • Modifies registry class
        PID:3980
      • C:\ProgramData\{6C001415-B77E-442d-9A79-A8xv31w51D8E}\{2ECED591-505C-4b3d-8E20-CAxvF1w59E97}\Phone.exe
        C:\ProgramData\{6C001415-B77E-442d-9A79-A8xv31w51D8E}\{2ECED591-505C-4b3d-8E20-CAxvF1w59E97}\Phone.exe
        1⤵
        • Executes dropped EXE
        PID:1480

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e588f7c.rbs
            • Path C:\Config.Msi\e588f7c.rbs
            • Size 8KB
            • SHA256 5f928efe15155a3b37cabae33fdbaa9c14dcf6789ba7ebb9d02abcc93f82e962
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            1
            • Path C:\Program Files\Windows Defenderr\1
            • Size 483KB
            • SHA256 cad9fcfa069fc7de9f5d2b7c66bd5c4ca714777bf5db253418a664e7723026d1
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            2
            • Path C:\Program Files\Windows Defenderr\2
            • Size 337KB
            • SHA256 95763e1a2e24b815c5b370c43664ad36a85a7be0f56ccbadb4d774cf07e539c2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            oem.ini
            • Path C:\ProgramData\kingsoft\20240622_23040\oem.ini
            • Size 300B
            • SHA256 ac4222cad36842b78351bcdd9bf49450082ee99c9e99305e4c9bf05a34e59fa5
            • MD5 SHA1 SHA512
            Submit Download

            RegWorkshop.ini
            • Path C:\ProgramData\{6C001415-B77E-442d-9A79-A8xv31w51D8E}\RegWorkshop.ini
            • Size 1012B
            • SHA256 14e2a26ea50a75ed1f71bdbee187a9e436ba479e9e630e8a6c6473c05f7f8315
            • MD5 SHA1 SHA512
            Submit Download

            RegWorkshop.ini
            • Path C:\ProgramData\{6C001415-B77E-442d-9A79-A8xv31w51D8E}\RegWorkshop.ini
            • Size 1KB
            • SHA256 321f7eee9d6b206f084b2036ba8b4cedf18a01ce1946dcc4b4cbd3f1bd77c434
            • MD5 SHA1 SHA512
            Submit Download

            RegWorkshop.ini
            • Path C:\ProgramData\{6C001415-B77E-442d-9A79-A8xv31w51D8E}\RegWorkshop.ini
            • Size 1KB
            • SHA256 4e2898c521e6ca2d26d23089f59a1ae30f094980757e69ae6ddc6cb8898618d5
            • MD5 SHA1 SHA512
            Submit Download

            RegWorkshop.ini
            • Path C:\ProgramData\{6C001415-B77E-442d-9A79-A8xv31w51D8E}\RegWorkshop.ini
            • Size 2KB
            • SHA256 02af5cb061fd8075e9475c45ab20e86cf2bb4ca9511ddad348645ed5183b9fc7
            • MD5 SHA1 SHA512
            Submit Download

            {33189879-52C1-4586-9B59-AFxv1Cw587E8}
            • Path C:\ProgramData\{6C001415-B77E-442d-9A79-A8xv31w51D8E}\{33189879-52C1-4586-9B59-AFxv1Cw587E8}
            • Size 429B
            • SHA256 7f84677be32a7ad7f6b4be6a056d0c6a999b7a2caa2560da33893c8b6b9613c5
            • MD5 SHA1 SHA512
            Submit Download

            {FFB6DE3B-56E0-4eb6-A578-B8xvC5w56CD8}.exe
            • Path C:\ProgramData\{6C001415-B77E-442d-9A79-A8xv31w51D8E}\{FFB6DE3B-56E0-4eb6-A578-B8xvC5w56CD8}.exe
            • Size 1.0MB
            • SHA256 27c8bd76150ddda5b09d6db11f67269cee2eecac345df67f93aab3e3aaabde7c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            vcruntime140.dll
            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e58cfbf\CONTROL\office6\vcruntime140.dll
            • Size 81KB
            • SHA256 ff9c1123cff493a8f5eacb91115611b6c1c808b30c82af9b6f388c0ef1f6b46d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            product.dat
            • Path C:\Users\Admin\AppData\Local\Temp\wps\~e58cfbf\CONTROL\product.dat
            • Size 52KB
            • SHA256 fd675d3fb5922605e367d99bab20efd1d9e4b4ad8decf67071035d3a8976e502
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            tempinstall.ini
            • Path C:\Users\Admin\AppData\Local\tempinstall.ini
            • Size 363B
            • SHA256 90b2af69f94515f67f5c8ba104ab2ac467988da2b1b10ec6286e1a8206ce4093
            • MD5 SHA1 SHA512
            Submit Download

            tempinstall.ini
            • Path C:\Users\Admin\AppData\Local\tempinstall.ini
            • Size 409B
            • SHA256 7fa5672cb5ed1900b611ef0485165df2702c611445d94150598fa1b3ed7c8037
            • MD5 SHA1 SHA512
            Submit Download

            wpssetup.log
            • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
            • Size 27KB
            • SHA256 7feb18c2e0b3ba548f47ea9a899e7cbe41c880ba54560bf8963a78293fb61d60
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wpssetup.log
            • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
            • Size 28KB
            • SHA256 0208d42ba6fc28fdb7fcbd17d1c0d441c04f5ac074706776d8fae0773a551f33
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wpssetup.log
            • Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
            • Size 45KB
            • SHA256 462a97e87dc7c10ee571704feb221cb01c775ba9e8939ecc44f2810566f274d7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            metadata-2
            • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
            • Size 26.0MB
            • SHA256 0637e00afdae21020f1ff46814aa6e012f702953a4ff4bbcb61ed6ec3c4ef8d9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            {029c2d0c-1e53-4e42-9f25-a40ffea00069}_OnDiskSnapshotProp
            • Path \??\Volume{4f38e779-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{029c2d0c-1e53-4e42-9f25-a40ffea00069}_OnDiskSnapshotProp
            • Size 5KB
            • SHA256 e94f8052d31de65c1cb7cb835dc3826fed2ee2e2251df51a68977e4bafe1870a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            System.dll
            • Path \Users\Admin\AppData\Local\Temp\nssBD03.tmp\System.dll
            • Size 11KB
            • SHA256 ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            v6svc_oem.dll
            • Path \Users\Admin\AppData\Local\Temp\nssBD03.tmp\v6svc_oem.dll
            • Size 192KB
            • SHA256 d3378ee739debcaee8c715963403d96bf025db98bfbb55e54635429890db85c6
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Qt5CoreKso.dll
            • Path \Users\Admin\AppData\Local\Temp\wps\~e58cfbf\CONTROL\office6\Qt5CoreKso.dll
            • Size 5.0MB
            • SHA256 07dbecf0fa0d79d2d4237d53e8b905677a977a3cf3c43f251cbddcc032cd6c2d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Qt5GuiKso.dll
            • Path \Users\Admin\AppData\Local\Temp\wps\~e58cfbf\CONTROL\office6\Qt5GuiKso.dll
            • Size 5.3MB
            • SHA256 fe999e848637dcf8f209181baf71c590197af2dbd01b30f976179fd5809bfcd6
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Qt5SvgKso.dll
            • Path \Users\Admin\AppData\Local\Temp\wps\~e58cfbf\CONTROL\office6\Qt5SvgKso.dll
            • Size 359KB
            • SHA256 dfbcba58ce097a2fd3a5df4465ddecb13a1cdf5800e3bc4755170aaf25749725
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Qt5WidgetsKso.dll
            • Path \Users\Admin\AppData\Local\Temp\wps\~e58cfbf\CONTROL\office6\Qt5WidgetsKso.dll
            • Size 4.4MB
            • SHA256 0bfe39d7de0c08f8c60d746167777954575f626d041bc7c3faccaa7ef6ceb2fc
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Qt5WinExtrasKso.dll
            • Path \Users\Admin\AppData\Local\Temp\wps\~e58cfbf\CONTROL\office6\Qt5WinExtrasKso.dll
            • Size 388KB
            • SHA256 e6ee77a78ec2b374acc9757670e4f295948171d300fb2bf2d3e4fa702aa4f844
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            kpacketui.dll
            • Path \Users\Admin\AppData\Local\Temp\wps\~e58cfbf\CONTROL\office6\kpacketui.dll
            • Size 1.5MB
            • SHA256 de0ec3555a4764225803f50088971ea77e2499db9be1834efb35ae77d43e6fe3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msvcp140.dll
            • Path \Users\Admin\AppData\Local\Temp\wps\~e58cfbf\CONTROL\office6\msvcp140.dll
            • Size 439KB
            • SHA256 02c7259456eac8cbadfb460377ba68e98282400c7a4a9d0bf49b3313ef6d554d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            qsvgicon.dll
            • Path \Users\Admin\AppData\Local\Temp\wps\~e58cfbf\CONTROL\office6\qt\plugins\iconengines\qsvgicon.dll
            • Size 56KB
            • SHA256 ab6aa9da2fb9d18729b088dc1f62c1ad3c69e76f81909e3aa2d77534c71175ec
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            qsvg.dll
            • Path \Users\Admin\AppData\Local\Temp\wps\~e58cfbf\CONTROL\office6\qt\plugins\imageformats\qsvg.dll
            • Size 35KB
            • SHA256 2f58c9bd2798c1b3751ce8cd0496c0809e405b1f23b3017f63ed63f35c072b29
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            qwindows.dll
            • Path \Users\Admin\AppData\Local\Temp\wps\~e58cfbf\CONTROL\office6\qt\plugins\platforms\qwindows.dll
            • Size 1.3MB
            • SHA256 e57ec14808e775223cff206d176ac182f2e0d45868ab27d4cf4bb0f1a5b7ea8c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            qwindowsvistastyle.dll
            • Path \Users\Admin\AppData\Local\Temp\wps\~e58cfbf\CONTROL\office6\qt\plugins\styles\qwindowsvistastyle.dll
            • Size 140KB
            • SHA256 3f516ee7950d1702bf8ba5cea0d658fe5f19c0c23fdad2a005e6e4a4f28f7688
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ucrtbase.dll
            • Path \Users\Admin\AppData\Local\Temp\wps\~e58cfbf\CONTROL\office6\ucrtbase.dll
            • Size 1.1MB
            • SHA256 2ad9a105a9caa24f41e7b1a6f303c07e6faeceaf3aaf43ebd644d9d5746a4359
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/196-514-0x0000000000D50000-0x0000000000DD7000-memory.dmp
            Download

            memory/196-680-0x0000000000D50000-0x0000000000DD7000-memory.dmp
            Download

            memory/1480-679-0x0000000001120000-0x00000000011A7000-memory.dmp
            Download