File name:

cloud.exe

Full analysis: https://app.any.run/tasks/b9b99209-4c36-42c4-b5a1-4e3c42c4733c
Verdict: Malicious activity
Analysis date: November 09, 2023, 23:54:54
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

27A074CD4F7908BBC73EFD5262351449

SHA1:

D38BB4AA05392CAB9DB0576A91B1C70C165A9E20

SHA256:

6EEC926E1E70542A355A8BE392A4D948610ADCCE4FAA7484E551D4CEA5F8F0B1

SSDEEP:

49152:x6h4gV2kJgU9hgf5f5XAKig8z96vAEfYF2wt/umw8zcQKCAiszne:x614dhdAXOHfYFRQ8zPmS

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • cloud.exe (PID: 3416)
      • zskcwrwoyh.exe (PID: 3164)
      • zskcwrwoyh.exe (PID: 3668)
      • pwpsvmcizr.exe (PID: 3544)

    • Creates a writable file the system directory

      • zskcwrwoyh.exe (PID: 3668)
      • SearchIndexer.exe (PID: 3924)

    • Known privilege escalation attack

      • dllhost.exe (PID: 3580)

    • Runs injected code in another process

      • SearchUserHost.exe (PID: 3948)

    • Application was injected by another process

      • explorer.exe (PID: 1388)

    • Starts NET.EXE to view/change shared resources

      • cmd.exe (PID: 604)
      • net.exe (PID: 2692)

  • SUSPICIOUS

    • Reads the Internet Settings

      • cloud.exe (PID: 3416)
      • zskcwrwoyh.exe (PID: 3164)
      • pwpsvmcizr.exe (PID: 3544)

    • Process drops legitimate windows executable

      • cloud.exe (PID: 3416)
      • zskcwrwoyh.exe (PID: 3668)
      • SearchIndexer.exe (PID: 3924)

    • Drops a system driver (possible attempt to evade defenses)

      • zskcwrwoyh.exe (PID: 3668)

    • The process creates files with name similar to system file names

      • SearchIndexer.exe (PID: 3924)

    • Creates files in the driver directory

      • zskcwrwoyh.exe (PID: 3668)

    • Uses pipe srvsvc via SMB (transferring data)

      • bindsvc.exe (PID: 908)
      • SearchUserHost.exe (PID: 3948)

    • Get information on the list of running processes

      • SearchUserHost.exe (PID: 3948)
      • cmd.exe (PID: 2312)
      • cmd.exe (PID: 2252)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 3820)
      • cmd.exe (PID: 3328)

    • Starts CMD.EXE for commands execution

      • SearchUserHost.exe (PID: 3948)
      • zskcwrwoyh.exe (PID: 3668)

    • Executing commands from a ".bat" file

      • zskcwrwoyh.exe (PID: 3668)

    • Process uses IPCONFIG to discover network configuration

      • cmd.exe (PID: 2624)

    • Uses ROUTE.EXE to obtain the routing table information

      • cmd.exe (PID: 2076)

    • Process uses ARP to discover network configuration

      • cmd.exe (PID: 2408)

  • INFO

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3128)

    • Reads the computer name

      • wmpnscfg.exe (PID: 3128)
      • cloud.exe (PID: 3416)
      • zskcwrwoyh.exe (PID: 3164)
      • rKKDmxal.exe (PID: 3504)
      • zskcwrwoyh.exe (PID: 3668)
      • pwpsvmcizr.exe (PID: 3544)
      • bindsvc.exe (PID: 908)

    • Checks supported languages

      • cloud.exe (PID: 3416)
      • wmpnscfg.exe (PID: 3128)
      • pwpsvmcizr.exe (PID: 3544)
      • zskcwrwoyh.exe (PID: 3164)
      • rKKDmxal.exe (PID: 3504)
      • zskcwrwoyh.exe (PID: 3668)
      • cloud.exe (PID: 3852)
      • bindsvc.exe (PID: 908)

    • Creates files in the program directory

      • zskcwrwoyh.exe (PID: 3164)
      • SearchIndexer.exe (PID: 3924)

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 3128)
      • rKKDmxal.exe (PID: 3504)

    • Create files in a temporary directory

      • cloud.exe (PID: 3416)
      • pwpsvmcizr.exe (PID: 3544)
      • SearchUserHost.exe (PID: 3948)
      • zskcwrwoyh.exe (PID: 3668)

    • Checks transactions between databases Windows and Oracle

      • rKKDmxal.exe (PID: 3504)

    • Executes as Windows Service

      • SearchIndexer.exe (PID: 3924)

    • Creates files or folders in the user directory

      • SearchUserHost.exe (PID: 3948)
      • bindsvc.exe (PID: 908)

    • Drops the executable file immediately after the start

      • SearchIndexer.exe (PID: 3924)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (30.9)
.exe | Win64 Executable (generic) (27.3)
.exe | UPX compressed Win32 Executable (26.8)
.dll | Win32 Dynamic Link Library (generic) (6.5)
.exe | Win32 Executable (generic) (4.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:03:04 09:51:19+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 50688
InitializedDataSize: 104960
UninitializedDataSize: -
EntryPoint: 0x7b1f
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
90
Monitored processes
38
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start inject cloud.exe no specs wmpnscfg.exe no specs pwpsvmcizr.exe no specs zskcwrwoyh.exe no specs rkkdmxal.exe CMSTPLUA no specs zskcwrwoyh.exe no specs cloud.exe no specs searchindexer.exe no specs searchuserhost.exe explorer.exe searchprotocolhost.exe no specs searchfilterhost.exe no specs cmd.exe no specs systeminfo.exe no specs cmd.exe no specs sc.exe no specs bindsvc.exe no specs cmd.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs netstat.exe no specs cmd.exe no specs ipconfig.exe no specs cmd.exe no specs route.exe no specs cmd.exe no specs arp.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs net.exe no specs net1.exe no specs cmd.exe no specs ping.exe no specs cmd.exe no specs sc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
188/c "netstat -ano"C:\Windows\System32\cmd.exe—SearchUserHost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
328netstat -anoC:\Windows\System32\NETSTAT.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Netstat Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netstat.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\iphlpapi.dll
604/c "net share"C:\Windows\System32\cmd.exe—SearchUserHost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
680C:\Windows\system32\net1 shareC:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\netutils.dll
732arp -aC:\Windows\System32\ARP.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Arp Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\arp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\snmpapi.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\advapi32.dll
908"C:\Windows\System32\bindsvc.exe"C:\Windows\System32\bindsvc.exe—zskcwrwoyh.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\windows\system32\bindsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
1388C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1528sc config msdtc obj= LocalSystemC:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1584route printC:\Windows\System32\ROUTE.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Route Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\route.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
1756C:\Windows\system32\cmd.exe /c "C:\Users\admin\AppData\Local\Temp\qVQxCh9h.bat"C:\Windows\System32\cmd.exe—zskcwrwoyh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
5 678
Read events
5 597
Write events
75
Delete events
6

Modification events

(PID) Process:(1388) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3128) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{096E2515-5165-456D-9629-1E99CB14B3FC}\{8E321D59-E064-4E1B-80F6-4F98994BB91E}
Operation:delete keyName:(default)
Value:
(PID) Process:(3128) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{096E2515-5165-456D-9629-1E99CB14B3FC}
Operation:delete keyName:(default)
Value:
(PID) Process:(3128) wmpnscfg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Health\{8500816E-4E7E-429E-8BF1-C15A10022A29}
Operation:delete keyName:(default)
Value:
(PID) Process:(1388) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000F6D6788197A75D498472ACE88906AC8D000000000200000000001066000000010000200000007F0C5AFCF1AE7F71286A81A9B86E67A7BE47980777E154AD953E683E2064784E000000000E8000000002000020000000C547D0854BEA52CCDED7859B79990A863903B335001ED826D40C3D8E323F237F30000000DF0FBC24E15CFF4FE438F74D8486DFB808CBF3EC9160BD0CF16731298F2800053F0DC9D2737FB85ABF81EDB882A089A94000000011BAC043EAAF96F8497DEE93A36C7829C97427DA018BC7750377DAC2CC3CE4D64139784732F789D57202D54D80C3AAC2B4B5EE990B65AEF23416199647916AD4
(PID) Process:(3416) cloud.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3416) cloud.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3416) cloud.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3416) cloud.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3164) zskcwrwoyh.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
13
Suspicious files
8
Text files
11
Unknown types
0

Dropped files

PID
Process
Filename
Type
3948SearchUserHost.exeC:\Users\admin\AppData\Roaming\Microsoft\UserSetting\MediaCache\ramdisk.sdb —
MD5:—
SHA256:—
3164zskcwrwoyh.exeC:\ProgramData\Temp\rKKDmxal.exeexecutable
MD5:B2B51A85BDAD70FF19534CD013C07F24
SHA256:885540B5A42FE845FFADA109B4EF7EB1E07C158255AC315910DFB333EC85D513
3416cloud.exeC:\Users\admin\AppData\Local\Temp\zskcwrwoyh.exeexecutable
MD5:2C2029588AD8B86759C17B7AE885EE03
SHA256:3AB288C47914E33CC61985E46502158400FAA9D7187B55C19039B8795504A290
3668zskcwrwoyh.exeC:\Windows\System32\bindsvc.exeexecutable
MD5:7C5B397FB54D5AA06BD2A6FB99C62FEE
SHA256:D032BDC64C9451BBB653B346C5BD6AC9F83A91EDEB0155497F098C8D6182DDEE
3668zskcwrwoyh.exeC:\Windows\System32\wideshut.exeexecutable
MD5:2C2029588AD8B86759C17B7AE885EE03
SHA256:3AB288C47914E33CC61985E46502158400FAA9D7187B55C19039B8795504A290
3668zskcwrwoyh.exeC:\Windows\System32\drivers\hfile.sysexecutable
MD5:CB0E3A54934FC3F1750A3FAED79B4D9A
SHA256:8E8084A295709B0FF7B083D1F5FD001EA79507490D15E8479A8CED616BB54EE1
3668zskcwrwoyh.exeC:\Windows\System32\racfg.exeexecutable
MD5:DC0222F1E0868C3612A93BA2D83B99BE
SHA256:6BC4497B86DF521B413E4574F4CD4289C986348D2A69DA1945FF1A1784DB05DB
3544pwpsvmcizr.exeC:\Users\admin\AppData\Local\Temp\cloud.exeexecutable
MD5:46E3E78D92AA3C2152489EF20B7D871F
SHA256:89C9E691059C50D71A0463912874D77B95B01817FE074E5DAF09A694467378B5
3416cloud.exeC:\Users\admin\AppData\Local\Temp\pwpsvmcizr.exeexecutable
MD5:E48B89715BF5E4C55EB5A1FED67865D9
SHA256:C25D90168FC2026D8ED2A69C066BD5A7E11004C3899928A7DB24CB7636FC4D9E
3668zskcwrwoyh.exeC:\Windows\System32\wimsvc.exeexecutable
MD5:2C2029588AD8B86759C17B7AE885EE03
SHA256:3AB288C47914E33CC61985E46502158400FAA9D7187B55C19039B8795504A290
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
19
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.1:445
—
—
—
unknown
4
System
192.168.100.2:445
—
—
—
whitelisted
4
System
192.168.100.1:139
—
—
—
unknown
4
System
192.168.100.76:445
—
—
—
unknown
4
System
192.168.100.76:139
—
—
—
unknown
3948
SearchUserHost.exe
192.168.100.1:445
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
Process
Message
rKKDmxal.exe
lpszParam = gQ9VOe5m8zP6
rKKDmxal.exe
lpszPath = C:\Users\admin\AppData\Local\Temp\zskcwrwoyh.exe
rKKDmxal.exe
We will start with normal mode!
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
cloud.exe