File name:

cloud.exe

Full analysis: https://app.any.run/tasks/b9b99209-4c36-42c4-b5a1-4e3c42c4733c
Verdict: Malicious activity
Analysis date: November 09, 2023, 23:54:54
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

27A074CD4F7908BBC73EFD5262351449

SHA1:

D38BB4AA05392CAB9DB0576A91B1C70C165A9E20

SHA256:

6EEC926E1E70542A355A8BE392A4D948610ADCCE4FAA7484E551D4CEA5F8F0B1

SSDEEP:

49152:x6h4gV2kJgU9hgf5f5XAKig8z96vAEfYF2wt/umw8zcQKCAiszne:x614dhdAXOHfYFRQ8zPmS

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • cloud.exe (PID: 3416)
      • zskcwrwoyh.exe (PID: 3164)
      • zskcwrwoyh.exe (PID: 3668)
      • pwpsvmcizr.exe (PID: 3544)

    • Known privilege escalation attack

      • dllhost.exe (PID: 3580)

    • Runs injected code in another process

      • SearchUserHost.exe (PID: 3948)

    • Creates a writable file the system directory

      • SearchIndexer.exe (PID: 3924)
      • zskcwrwoyh.exe (PID: 3668)

    • Application was injected by another process

      • explorer.exe (PID: 1388)

    • Starts NET.EXE to view/change shared resources

      • cmd.exe (PID: 604)
      • net.exe (PID: 2692)

  • SUSPICIOUS

    • Reads the Internet Settings

      • cloud.exe (PID: 3416)
      • zskcwrwoyh.exe (PID: 3164)
      • pwpsvmcizr.exe (PID: 3544)

    • Process drops legitimate windows executable

      • cloud.exe (PID: 3416)
      • zskcwrwoyh.exe (PID: 3668)
      • SearchIndexer.exe (PID: 3924)

    • Creates files in the driver directory

      • zskcwrwoyh.exe (PID: 3668)

    • Drops a system driver (possible attempt to evade defenses)

      • zskcwrwoyh.exe (PID: 3668)

    • Get information on the list of running processes

      • SearchUserHost.exe (PID: 3948)
      • cmd.exe (PID: 2252)
      • cmd.exe (PID: 2312)

    • Starts CMD.EXE for commands execution

      • SearchUserHost.exe (PID: 3948)
      • zskcwrwoyh.exe (PID: 3668)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 3820)
      • cmd.exe (PID: 3328)

    • Executing commands from a ".bat" file

      • zskcwrwoyh.exe (PID: 3668)

    • Uses pipe srvsvc via SMB (transferring data)

      • bindsvc.exe (PID: 908)
      • SearchUserHost.exe (PID: 3948)

    • The process creates files with name similar to system file names

      • SearchIndexer.exe (PID: 3924)

    • Process uses IPCONFIG to discover network configuration

      • cmd.exe (PID: 2624)

    • Uses ROUTE.EXE to obtain the routing table information

      • cmd.exe (PID: 2076)

    • Process uses ARP to discover network configuration

      • cmd.exe (PID: 2408)

  • INFO

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3128)

    • Checks supported languages

      • cloud.exe (PID: 3416)
      • wmpnscfg.exe (PID: 3128)
      • pwpsvmcizr.exe (PID: 3544)
      • zskcwrwoyh.exe (PID: 3164)
      • rKKDmxal.exe (PID: 3504)
      • zskcwrwoyh.exe (PID: 3668)
      • cloud.exe (PID: 3852)
      • bindsvc.exe (PID: 908)

    • Reads the computer name

      • wmpnscfg.exe (PID: 3128)
      • cloud.exe (PID: 3416)
      • zskcwrwoyh.exe (PID: 3164)
      • rKKDmxal.exe (PID: 3504)
      • pwpsvmcizr.exe (PID: 3544)
      • zskcwrwoyh.exe (PID: 3668)
      • bindsvc.exe (PID: 908)

    • Create files in a temporary directory

      • cloud.exe (PID: 3416)
      • pwpsvmcizr.exe (PID: 3544)
      • SearchUserHost.exe (PID: 3948)
      • zskcwrwoyh.exe (PID: 3668)

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 3128)
      • rKKDmxal.exe (PID: 3504)

    • Creates files in the program directory

      • zskcwrwoyh.exe (PID: 3164)
      • SearchIndexer.exe (PID: 3924)

    • Checks transactions between databases Windows and Oracle

      • rKKDmxal.exe (PID: 3504)

    • Executes as Windows Service

      • SearchIndexer.exe (PID: 3924)

    • Creates files or folders in the user directory

      • SearchUserHost.exe (PID: 3948)
      • bindsvc.exe (PID: 908)

    • Drops the executable file immediately after the start

      • SearchIndexer.exe (PID: 3924)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (30.9)
.exe | Win64 Executable (generic) (27.3)
.exe | UPX compressed Win32 Executable (26.8)
.dll | Win32 Dynamic Link Library (generic) (6.5)
.exe | Win32 Executable (generic) (4.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:03:04 09:51:19+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 50688
InitializedDataSize: 104960
UninitializedDataSize: -
EntryPoint: 0x7b1f
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
90
Monitored processes
38
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start inject cloud.exe no specs wmpnscfg.exe no specs pwpsvmcizr.exe no specs zskcwrwoyh.exe no specs rkkdmxal.exe CMSTPLUA no specs zskcwrwoyh.exe no specs cloud.exe no specs searchindexer.exe no specs searchuserhost.exe explorer.exe searchprotocolhost.exe no specs searchfilterhost.exe no specs cmd.exe no specs systeminfo.exe no specs cmd.exe no specs sc.exe no specs bindsvc.exe no specs cmd.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs netstat.exe no specs cmd.exe no specs ipconfig.exe no specs cmd.exe no specs route.exe no specs cmd.exe no specs arp.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs net.exe no specs net1.exe no specs cmd.exe no specs ping.exe no specs cmd.exe no specs sc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
188/c "netstat -ano"C:\Windows\System32\cmd.exe—SearchUserHost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
328netstat -anoC:\Windows\System32\NETSTAT.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Netstat Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netstat.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\iphlpapi.dll
604/c "net share"C:\Windows\System32\cmd.exe—SearchUserHost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
680C:\Windows\system32\net1 shareC:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\netutils.dll
732arp -aC:\Windows\System32\ARP.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Arp Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\arp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\snmpapi.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\advapi32.dll
908"C:\Windows\System32\bindsvc.exe"C:\Windows\System32\bindsvc.exe—zskcwrwoyh.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\windows\system32\bindsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
1388C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1528sc config msdtc obj= LocalSystemC:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1584route printC:\Windows\System32\ROUTE.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Route Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\route.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
1756C:\Windows\system32\cmd.exe /c "C:\Users\admin\AppData\Local\Temp\qVQxCh9h.bat"C:\Windows\System32\cmd.exe—zskcwrwoyh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
5 678
Read events
5 597
Write events
75
Delete events
6

Modification events

(PID) Process:(1388) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3128) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{096E2515-5165-456D-9629-1E99CB14B3FC}\{8E321D59-E064-4E1B-80F6-4F98994BB91E}
Operation:delete keyName:(default)
Value:
(PID) Process:(3128) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{096E2515-5165-456D-9629-1E99CB14B3FC}
Operation:delete keyName:(default)
Value:
(PID) Process:(3128) wmpnscfg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Health\{8500816E-4E7E-429E-8BF1-C15A10022A29}
Operation:delete keyName:(default)
Value:
(PID) Process:(1388) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000F6D6788197A75D498472ACE88906AC8D000000000200000000001066000000010000200000007F0C5AFCF1AE7F71286A81A9B86E67A7BE47980777E154AD953E683E2064784E000000000E8000000002000020000000C547D0854BEA52CCDED7859B79990A863903B335001ED826D40C3D8E323F237F30000000DF0FBC24E15CFF4FE438F74D8486DFB808CBF3EC9160BD0CF16731298F2800053F0DC9D2737FB85ABF81EDB882A089A94000000011BAC043EAAF96F8497DEE93A36C7829C97427DA018BC7750377DAC2CC3CE4D64139784732F789D57202D54D80C3AAC2B4B5EE990B65AEF23416199647916AD4
(PID) Process:(3416) cloud.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3416) cloud.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3416) cloud.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3416) cloud.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3164) zskcwrwoyh.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
13
Suspicious files
8
Text files
11
Unknown types
0

Dropped files

PID
Process
Filename
Type
3948SearchUserHost.exeC:\Users\admin\AppData\Roaming\Microsoft\UserSetting\MediaCache\ramdisk.sdb —
MD5:—
SHA256:—
3924SearchIndexer.exeC:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.logbinary
MD5:9D7A4C077EDD1B357721404673808564
SHA256:D7944E6EFAE4F73952C552A515717CCA2E093014304681CA61C870958BE67E88
3948SearchUserHost.exeC:\Users\admin\AppData\Roaming\Microsoft\UserSetting\version.inibinary
MD5:C9F0F895FB98AB9159F51FD0297E236D
SHA256:—
3668zskcwrwoyh.exeC:\Windows\System32\wideshut.exeexecutable
MD5:2C2029588AD8B86759C17B7AE885EE03
SHA256:3AB288C47914E33CC61985E46502158400FAA9D7187B55C19039B8795504A290
3948SearchUserHost.exeC:\Users\admin\AppData\Local\Temp\vv5AveQaZe9wXR9cJqSUIvUZDclkeU.txttext
MD5:3EF0ABBC5A90F3612A3C0B1482A05A07
SHA256:5EE3F02480C438369EA8B83AE7592BFDBB290E958887E4FC8E38FE5832D90D16
3924SearchIndexer.exeC:\Windows\system32\SearchUserHost.exeexecutable
MD5:88F23CF4A9E57D99199F3761F6A48FD9
SHA256:79CF96526832DC46A9EF88B7FFC00B8CF3762E2FBE92B42759EAEE2A53E239FD
908bindsvc.exeC:\Users\admin\AppData\Roaming\Microsoft\UserSetting\trnmg.sdbbinary
MD5:6B34AB9BED8065E865DC3365308785D9
SHA256:B1E3AF1A678CD54ECE07624B7FCADFC804E716C8329D1F28308A0A26E90CD32B
3948SearchUserHost.exeC:\Users\admin\AppData\Local\Temp\usjVhAZ4ImYOQMlc52Tjr4rTrEYRX7.txttext
MD5:A20522BD1D1CF1013772D95D51FB412C
SHA256:CEC94C1E12B37F0CA43CCD44B9C45632F3E0A36D390981F65370585773FEDA0D
3668zskcwrwoyh.exeC:\Users\admin\AppData\Local\Temp\qVQxCh9h.battext
MD5:7FD11B655DA861191ABF089BCD628589
SHA256:E301245F1C533481131FE0E36794E2896CE6141FB1F5C22735294B9CE0424F8E
3668zskcwrwoyh.exeC:\Windows\system32\oci.dllexecutable
MD5:5A3424883054C5A4C75093E07B160B31
SHA256:611A986AE5D9B58333338924EBD9ECA91876C112C09080DE0BC0A56FD2F2D498
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
19
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.1:445
—
—
—
unknown
4
System
192.168.100.2:445
—
—
—
whitelisted
4
System
192.168.100.1:139
—
—
—
unknown
4
System
192.168.100.76:445
—
—
—
unknown
4
System
192.168.100.76:139
—
—
—
unknown
3948
SearchUserHost.exe
192.168.100.1:445
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
Process
Message
rKKDmxal.exe
lpszParam = gQ9VOe5m8zP6
rKKDmxal.exe
lpszPath = C:\Users\admin\AppData\Local\Temp\zskcwrwoyh.exe
rKKDmxal.exe
We will start with normal mode!
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
cloud.exe