Analysis
- max time kernel
9s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
08/07/2026, 11:13
General
- Target 2026-07-08_992765fc02c394343b72a9ab15b9b546_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
- Size 5.7MB
- Sample260708-nbgyeaex3t
- SHA256 fb4e43372ac500f056ce8d4bdde86366fe288e5a3a9e8e8ee124016698ebc9d9
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Network Service Discovery 1 TTPs 1 IoCs
Attempt to gather information on host's network.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 24 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 1 IoCs
- Modifies registry class 7 IoCs
- Modifies system certificate store 2 TTPs 40 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_992765fc02c394343b72a9ab15b9b546_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_992765fc02c394343b72a9ab15b9b546_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\WPS\Installers\34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1074.exe"C:\ProgramData\WPS\Installers\34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1074.exe" -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct=en_US -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps -enableSetupMuiPkg -appdata="C:\Users\Admin\AppData\Roaming"2⤵
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -checkInstallEnvironment3⤵
-
-
C:\Program Files\Kingsoft\office6\wpscloudsvr.exe"C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" InstallService3⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -addFirewallRule3⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\wpsoffice.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\wpsoffice.exe" Run addons/kpluginwrapper/kpluginwrapper.dll run_plugin -plugin_name=klangmanager -dll_name=klangmanager.dll downloadlang en_US3⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regmtfont3⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\\office6\ksomisc.exe" -setappcap3⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -sendinstalldyn 53⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regPreviewHandler wps.exe et.exe wpp.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\\office6\ksomisc.exe" -registerqingshellext 13⤵
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\qingshellext64.dll"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regkwpsshellext admin3⤵
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\kwpsshellext64.dll"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\kwinappinstaller.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\kwinappinstaller.exe" -i "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\menuext" wpsappext1 wpsappext2 wpsappext33⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regqingdriveshellext_install3⤵
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*install "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\qingnse64.dll"4⤵
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*thumbnail "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\qingnse64.dll"4⤵
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*drivebho "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\qingnse64.dll"4⤵
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*contextmenu "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\qingnse64.dll"4⤵
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /n /i:nsemenu*user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\qingnse64.dll"4⤵
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /n /i:qingdriveshellext*onlinefile "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\qingnse64.dll"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regpdfwspv3⤵
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\pdfwspv\pdfwspv.dll"4⤵
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\pdfwspv\pdfwspv.dll"4⤵
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\pdfwspv\pdfwspv.dll"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\\office6\ksomisc.exe" -setappcap3⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\\office6\ksomisc.exe" -assoepub -source=13⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -clearmso2pdfplugins3⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -uninstalldatarecover3⤵
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\WPS\Installers\34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1074.exe"C:\ProgramData\WPS\Installers\34425abd5dec1a45d9118359a5f09d34-22_Personal_Office_i18n_Free.exe.601.1074.exe" -downpower -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct="en_US" -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -enableSetupMuiPkg="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -appdata="C:\Users\Admin\AppData\Roaming" -msgwndname=wpssetup_message_E5AD9A8 -curinstalltemppath=C:\Users\Admin\AppData\Local\Temp\wps\~e5ad478\3⤵
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -setlng en_US4⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -getonlineparam 00601.00001074 -forceperusermode4⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -getabtest -forceperusermode4⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -fixoldversionassostatus4⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -setservers4⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -register4⤵
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x86\kmso2pdfplugins_1.dll"5⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x86\kmso2pdfplugins_1.dll"6⤵
-
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Kingsoft\office6\msoaddins\x64\kmso2pdfplugins64_1.dll"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regprogid true4⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -assowordexcelpowerpnt 1 1 1 -source=14⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -compatiblemso -source=14⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -checkcompatiblemso4⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -saveas_mso4⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -distsrc 00601.000010744⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -updatetaskbarpin 2097152 -forceperusermode -source=14⤵
- Network Service Discovery
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\pinTaskbar.exe" "C:\Users\Admin\AppData\Local\Temp\Kingsoft\WPS Office.lnk" 53865⤵
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -addcontextmenushellnew4⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regvascontextmenushellnew4⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\wtoolex\wpsupdate.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\wtoolex\wpsupdate.exe" /from:setup4⤵
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -collectfileassoinfo -module=1;2;4;8 -daily -source=15⤵
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\wtoolex\wpsupdate.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\wtoolex\wpsupdate.exe" -createtask4⤵
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\kdesktopshellext\kdesktopshellext.dll"4⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\addons\kdesktopshellext\kdesktopshellext.dll"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regyunpanfornew -forceperusermode4⤵
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /u /n /i:user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\qingnse64.dll"5⤵
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /u /n /i:overlayicon "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\qingnse64.dll"5⤵
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /u /n /i:contextmenu "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\qingnse64.dll"5⤵
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /u /n /i:nsemenu*user "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\qingnse64.dll"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -setup_assopdf -source=14⤵
-
C:\Windows\System32\openwith.exe"C:\Windows\System32\openwith.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -assofdf -source=14⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -externaltask create -forceperusermode4⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -createsubmodulelink desktop prometheus -source=14⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -createsubmodulelink startmenu prometheus -source=14⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -assoofd -source=14⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -assoopg -source=14⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regcadfileasso4⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regemailfileasso4⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regarchivefileasso4⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -installbrowserextensionhost4⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regvideoeditsetupfileasso4⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regemmxfileasso4⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regeddxfileasso4⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regposfileasso4⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regxmindfileasso4⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -regvsdfileasso4⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -repair3rdlink4⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -createexternstartmenu "WPS Office"4⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -rebuildicon4⤵
-
-
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe"C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.26886\office6\ksomisc.exe" -addJsapiCert4⤵
-
-
-
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-515251955-468707340-1782030364-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-515251955-468707340-1782030364-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 948 1880 2196 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 948 2984 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Program Files\Kingsoft\office6\wpscloudsvr.exe"C:\Program Files\Kingsoft\office6\wpscloudsvr.exe" LocalService1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Pre-OS Boot
1Bootkit
1Defense Evasion
Modify Registry
2Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
OSE.EXE
elevation_service.exe
Windows.db-wal
698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
8EC9B1D0ABBD7F98B401D425828828CE_79D3677070847D1A03E095C0DB0A41EF
C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Qt5NetworkKso.dll
logo-small.png
logo.png
run.ini
index.html
index.js
errPage.html
favicon.ico
run.ini
close-secondary.svg
kwpsaibasetypo.qm
kwpsaibasetypo.qm
element-icons.ttf
element-icons.woff
app.css
chunk-vendors.css
app.js
chunk-vendors.js
chunk-vendors.js
index.js
index.js
index.js
apm-init.js
default_ava.svg
desk-sync.svg
loading.svg
setup.cfg
kdesign.dll
krt.dll
ksolite.dll
ksomisc.exe
kwinappinstaller.exe
libcrypto-kso-1_1-x64.dll
error-net-72.png
presetLayout_16.pptx
wpscloudsvr.exe
wpsoffice.exe
install.ini
install.ini
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
APPX.13iid47axnm6cdbx_giuo5a1d.tmp
APPX.250r7zrbvtc_eed_h34rkkxle.tmp
APPX.3k2vqogxggcb07gxqdixozt5d.tmp
APPX.4yv3uslw4by1e01w0963m8pp.tmp
APPX.dxi_mgnv9_6xw26e4s4ji7m9f.tmp
APPX.lq1a34c99wvw_8t9g6jg97c8c.tmp
APPX.q78w_aecbhexbrodwp9poyx4.tmp
APPX.yo9ye6wfqhx_hs6e126xjdbeh.tmp
APPX.yzptg14ulc8zm4hx4__996g5g.tmp
Qt5CoreKso.dll
Qt5GuiKso.dll
Qt5SvgKso.dll
Qt5WidgetsKso.dll
Qt5WinExtrasKso.dll
kpacketui.dll
msvcp140.dll
qsvgicon.dll
qsvg.dll
qskia.dll
qwindows.dll
qwindowsvistastyle.dll
ucrtbase.dll
vcruntime140.dll
vcruntime140_1.dll
style.xml
product.dat
product_new.dat
style.xml
tempinstall.ini
tempinstall.ini
ksomisc_2026_07_08.log
ksomisc_2026_07_08.log
wpssetup.log
wpssetup.log
wpssetup.log
wpssetup.log
wpssetup.log
wpssetup.log
mdbx.dat
dcsdk_dpv3.data
dcsdk_dpv3.data
perfhost.exe
AgentService.exe
ssh-agent.exe
PerceptionSimulationService.exe
ReFsDedupSvc.exe
SearchIndexer.exe
SensorDataService.exe
memory/52-8-0x0000000000C60000-0x0000000000CC6000-memory.dmp
memory/52-7-0x0000000000C60000-0x0000000000CC6000-memory.dmp
memory/52-1-0x0000000000C60000-0x0000000000CC6000-memory.dmp
memory/52-0-0x0000000000400000-0x00000000009C1000-memory.dmp
memory/52-85-0x0000000000400000-0x00000000009C1000-memory.dmp
memory/1488-318-0x00000000007F0000-0x0000000000850000-memory.dmp
memory/1488-105-0x00000000007F0000-0x0000000000850000-memory.dmp
memory/1488-111-0x00000000007F0000-0x0000000000850000-memory.dmp
memory/1488-320-0x0000000140000000-0x00000001401BA000-memory.dmp
memory/1488-104-0x0000000140000000-0x00000001401BA000-memory.dmp
memory/3460-128-0x0000000140000000-0x00000001402D4000-memory.dmp
memory/3460-37-0x00000000006E0000-0x0000000000740000-memory.dmp
memory/3460-29-0x00000000006E0000-0x0000000000740000-memory.dmp
memory/3460-28-0x0000000140000000-0x00000001402D4000-memory.dmp
memory/4280-124-0x00000000007F0000-0x0000000000850000-memory.dmp
memory/4280-116-0x0000000140000000-0x000000014013E000-memory.dmp
memory/4280-456-0x0000000140000000-0x000000014013E000-memory.dmp
memory/4704-21-0x0000000000D70000-0x0000000000DD0000-memory.dmp
memory/4704-20-0x0000000140000000-0x00000001402E9000-memory.dmp
memory/4704-23-0x0000000000D70000-0x0000000000DD0000-memory.dmp
memory/4704-91-0x0000000140000000-0x00000001402E9000-memory.dmp
memory/4704-14-0x0000000000D70000-0x0000000000DD0000-memory.dmp
memory/4780-498-0x0000000140000000-0x0000000140172000-memory.dmp
memory/4780-153-0x0000000000620000-0x0000000000680000-memory.dmp
memory/4780-147-0x0000000000620000-0x0000000000680000-memory.dmp
memory/4780-146-0x0000000140000000-0x0000000140172000-memory.dmp
memory/4948-53-0x0000000001B90000-0x0000000001BF0000-memory.dmp
memory/4948-49-0x0000000001B90000-0x0000000001BF0000-memory.dmp
memory/4948-42-0x0000000140000000-0x00000001400D5000-memory.dmp
memory/4948-66-0x0000000140000000-0x00000001400D5000-memory.dmp
memory/4948-43-0x0000000001B90000-0x0000000001BF0000-memory.dmp
memory/5092-998-0x00007FFA84BB0000-0x00007FFA8513E000-memory.dmp
memory/5364-63-0x0000000000890000-0x00000000008F0000-memory.dmp
memory/5364-56-0x0000000140000000-0x00000001400CF000-memory.dmp
memory/5364-57-0x0000000000890000-0x00000000008F0000-memory.dmp
memory/5364-284-0x0000000140000000-0x00000001400CF000-memory.dmp
memory/5424-321-0x000001F7B2870000-0x000001F7B2970000-memory.dmp
memory/5424-352-0x000001F7917B0000-0x000001F7918B0000-memory.dmp
memory/5424-353-0x000001F781450000-0x000001F781470000-memory.dmp
memory/5424-351-0x000001F781350000-0x000001F781370000-memory.dmp
memory/5424-367-0x000001F791AB0000-0x000001F791AD0000-memory.dmp
memory/5464-86-0x0000000000400000-0x0000000000497000-memory.dmp
memory/5464-80-0x00000000007C0000-0x0000000000826000-memory.dmp
memory/5464-87-0x00000000007C0000-0x0000000000826000-memory.dmp
memory/5464-314-0x0000000000400000-0x0000000000497000-memory.dmp
memory/5656-144-0x0000000140000000-0x0000000140168000-memory.dmp
memory/5656-131-0x0000000000CB0000-0x0000000000D10000-memory.dmp
memory/5656-137-0x0000000000CB0000-0x0000000000D10000-memory.dmp
memory/5656-130-0x0000000140000000-0x0000000140168000-memory.dmp
memory/5656-142-0x0000000000CB0000-0x0000000000D10000-memory.dmp
memory/5860-93-0x00000000007B0000-0x0000000000810000-memory.dmp
memory/5860-501-0x0000000140000000-0x00000001402C9000-memory.dmp
memory/5860-499-0x00000000007B0000-0x0000000000810000-memory.dmp
memory/5860-99-0x00000000007B0000-0x0000000000810000-memory.dmp
memory/5860-92-0x0000000140000000-0x00000001402C9000-memory.dmp
memory/5860-317-0x0000000140000000-0x00000001402C9000-memory.dmp
memory/5988-76-0x0000000000C70000-0x0000000000CD0000-memory.dmp
memory/5988-299-0x0000000140000000-0x00000001400CB000-memory.dmp
memory/5988-68-0x0000000140000000-0x00000001400CB000-memory.dmp
memory/5988-70-0x0000000000C70000-0x0000000000CD0000-memory.dmp
memory/6000-455-0x00000243F6340000-0x00000243F69D1000-memory.dmp
memory/6000-536-0x00000243F6340000-0x00000243F69D1000-memory.dmp
memory/6000-8216-0x00000243F6340000-0x00000243F69D1000-memory.dmp
memory/6000-494-0x00000243F6340000-0x00000243F69D1000-memory.dmp
memory/6000-497-0x00000243F6340000-0x00000243F69D1000-memory.dmp
memory/6000-8258-0x00000243F6340000-0x00000243F69D1000-memory.dmp
memory/8568-8745-0x00007FF7B2CE0000-0x00007FF7B308E000-memory.dmp
memory/9048-8663-0x00007FFA837A0000-0x00007FFA843EE000-memory.dmp
memory/9048-8672-0x00007FFA6A490000-0x00007FFA6A4A0000-memory.dmp
memory/9048-8666-0x00007FFA6A490000-0x00007FFA6A4A0000-memory.dmp
memory/9048-8668-0x00007FFA6A490000-0x00007FFA6A4A0000-memory.dmp
memory/9048-8661-0x00007FFA84760000-0x00007FFA848A4000-memory.dmp
memory/9048-8675-0x00007FFA6A490000-0x00007FFA6A4A0000-memory.dmp
memory/9048-8662-0x00007FFA83210000-0x00007FFA8379E000-memory.dmp
memory/9048-8665-0x00007FFA6AC60000-0x00007FFA6AC70000-memory.dmp
memory/9048-8667-0x00007FFA6A490000-0x00007FFA6A4A0000-memory.dmp
memory/9048-8664-0x00007FF7B2CE0000-0x00007FF7B308E000-memory.dmp
memory/9048-8669-0x00007FFA6A490000-0x00007FFA6A4A0000-memory.dmp
memory/9048-8670-0x00007FFA6A490000-0x00007FFA6A4A0000-memory.dmp
memory/9048-8671-0x00007FFA6A490000-0x00007FFA6A4A0000-memory.dmp
memory/9048-8674-0x00007FFA6A490000-0x00007FFA6A4A0000-memory.dmp
memory/9048-8673-0x00007FFA6A490000-0x00007FFA6A4A0000-memory.dmp
memory/10568-9411-0x0000000140000000-0x00000001401AD000-memory.dmp
memory/10568-9710-0x0000000140000000-0x00000001401AD000-memory.dmp
memory/18844-8718-0x00007FFA83C60000-0x00007FFA848AE000-memory.dmp
memory/18844-8734-0x00007FFA79580000-0x00007FFA7B280000-memory.dmp
memory/18844-8717-0x00007FFA83210000-0x00007FFA8379E000-memory.dmp
memory/18844-8719-0x00007FFA83B10000-0x00007FFA83C54000-memory.dmp
memory/18844-8716-0x00007FF7B2CE0000-0x00007FF7B308E000-memory.dmp
memory/19108-8687-0x00007FFA83B10000-0x00007FFA83C54000-memory.dmp
memory/19108-8686-0x00007FFA83C60000-0x00007FFA848AE000-memory.dmp
memory/19108-8688-0x00007FFA83210000-0x00007FFA8379E000-memory.dmp
memory/19108-8685-0x00007FF7B2CE0000-0x00007FF7B308E000-memory.dmp
memory/19108-8703-0x00007FFA79580000-0x00007FFA7B280000-memory.dmp
memory/22888-9519-0x0000000004A30000-0x0000000004A56000-memory.dmp
memory/22888-9508-0x00000000049C0000-0x00000000049CA000-memory.dmp
memory/22888-9498-0x0000000000090000-0x0000000000098000-memory.dmp