Analysis
- max time kernel
149s - max time network
118s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
20/04/2026, 06:17
Static task
static1
Behavioral task
behavioral1
Sample
wps_office_inst.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
wps_office_inst.exe
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target wps_office_inst.exe
- Size 7.2MB
- Sample260420-g2dkcaey8w
- SHA256 721ffbbf0e715404e3a9a5514f06c67e6aded29d4db2c30ecaafabccf34992c4
- MD5 23226bfb50f180511911060dfd27c272
- SHA1 e159bb03e7ab6dabd322b6cabc1e81a4c66b998b
- SHA512 961070673d13fe388b10f0ad1b82649cc11e39554267232d48fd2818035d5a4465e817399dcfc8bfed3cc15925acbbeb771f8d49120b95c9916ae479a73f2e21
- SSDEEP 98304:oa+gWlYBmE1h0OM8mcR7NxkSzDU1ZUXf363Qlmt/0SjR0jhyvyS5BW/v:znWlYBmEn0OM8/hq91IXjhsyS5B6v
- TLSH T1D3768E57A3E801E8D0B7D17CC9569613E7B2B85913709BCF16E0867A0F63AE25E3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 wps_office_inst.exe - Modifies system certificate store 2 TTPs 40 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CTLs wps_office_inst.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\FlightRoot\CRLs wps_office_inst.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\FlightRoot\CTLs wps_office_inst.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CRLs wps_office_inst.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CTLs wps_office_inst.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\Certificates wps_office_inst.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CTLs wps_office_inst.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CRLs wps_office_inst.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\FlightRoot wps_office_inst.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots wps_office_inst.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CTLs wps_office_inst.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\Certificates wps_office_inst.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer wps_office_inst.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\OemEsim\Certificates wps_office_inst.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\Certificates wps_office_inst.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CRLs wps_office_inst.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CTLs wps_office_inst.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CTLs wps_office_inst.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer wps_office_inst.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs wps_office_inst.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\Certificates wps_office_inst.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CTLs wps_office_inst.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CRLs wps_office_inst.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\OemEsim\CRLs wps_office_inst.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\TestSignRoot wps_office_inst.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\TestSignRoot\Certificates wps_office_inst.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CRLs wps_office_inst.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs wps_office_inst.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices wps_office_inst.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates wps_office_inst.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\FlightRoot\Certificates wps_office_inst.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\OemEsim wps_office_inst.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\OemEsim\CTLs wps_office_inst.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CRLs wps_office_inst.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot wps_office_inst.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CRLs wps_office_inst.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates wps_office_inst.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities wps_office_inst.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\TrustedDevices wps_office_inst.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\TrustedDevices\Certificates wps_office_inst.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3112 wps_office_inst.exe 3112 wps_office_inst.exe 3112 wps_office_inst.exe 3112 wps_office_inst.exe