HPQWare

[Braaaad]

Hi

Does anyone know what on earth HPQqware is.  Is this a malicious application masqueading as legitimate HP Software, or is it Legitimate HP software acting line malware/Spyware?

it is showing up in a hidden folder in C:\HP\.

The HPQWare folder is fulled with random junk and .exe's signed by HP Inc..

The only reason found the folder is from an installer that tried to run from C:\hpswsetup\sp114136\installer.exe was blocked by my AV.  When it was running it tried resetting the folder permissions on the C:\HP folder as well as quering a bunch or registy Keys and copying text files.

The Virus Total link can be found here https://www.virustotal.com/gui/file/ad18fcd479609dfa41d79225fb31021054b34e9961d23017bf142ee9af74a120....

This file is also signed by HP Inc.  Which I find very concerning.

Going through the EDR Events.  It appears to query HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\ACPI\HPIC000C.

This contains references to HPAnalyticsSoftwareKey, HP Device Health Service, FusionSoftwareKey and HP Application Enabling Services.  Again sounds Like HP Junkware, but there is not much information about what these are or what they do.

Any insight would be helpful as I don't want to be wiping every machine in the office to find out it is acutally just HP Junkware.

Kind Regards

Brad

[Hemant_wagh]

for me also falcon block the IOC on path "C:\hpswsetup\sp114136\install.exe -s"

ad18fcd479609dfa41d79225fb31021054b34e9961d23017bf142ee9af74a120

[Chriis]

Hi,

I logged a support ticket with CrowdStrike for this issue and they have confirmed that this is a false positive caused by an internal issue. This has been fixed at their end.