File name:

CloudCheck.exe

Full analysis: https://app.any.run/tasks/967325da-af81-4110-a069-b6770f2e31a2
Verdict: Malicious activity
Analysis date: October 29, 2023, 10:57:53
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5:

81C4E0D97B822D5D2802B6ECEC9AF8BF

SHA1:

C57C66F2D29D8F85ED4D3A348D6A7CC76105A43B

SHA256:

A83E4D482B1E12406BC6D4809623B3DFF088DD30406D4A7BC1FBAE009A0D7207

SSDEEP:

98304:C8aQSkFr66I4l8mUS7sxw/gyoOa/Ahv9PU:Rs

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads settings of System Certificates

      • CloudCheck.exe (PID: 1492)

    • Checks Windows Trust Settings

      • CloudCheck.exe (PID: 1492)

    • Reads the Internet Settings

      • CloudCheck.exe (PID: 1492)

    • Reads security settings of Internet Explorer

      • CloudCheck.exe (PID: 1492)

  • INFO

    • Checks supported languages

      • CloudCheck.exe (PID: 1492)

    • Reads the computer name

      • CloudCheck.exe (PID: 1492)

    • Reads the machine GUID from the registry

      • CloudCheck.exe (PID: 1492)

    • Create files in a temporary directory

      • CloudCheck.exe (PID: 1492)

    • Creates files or folders in the user directory

      • CloudCheck.exe (PID: 1492)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (71.5)
.scr | Windows screen saver (21.7)
.exe | Generic Win/DOS Executable (3.3)
.exe | DOS Executable Generic (3.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2023:06:27 16:17:44+02:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Large address aware, No debug
PEType: PE32+
LinkerVersion: 8
CodeSize: 3387392
InitializedDataSize: 2407424
UninitializedDataSize: -
EntryPoint: 0x7420
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 2023.3.450.0
ProductVersionNumber: 2023.3.450.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Cloudflare
FileDescription: Cloudflare WARP
FileVersion: 2023.3.450.0
InternalName: Cloudflare WARP.dll
LegalCopyright: (c) 2021, Cloudflare Inc.
OriginalFileName: Cloudflare WARP.dll
ProductName: Cloudflare WARP
ProductVersion: 2023.3.450.0
AssemblyVersion: 2023.3.450.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
30
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start cloudcheck.exe

Process information

PID
CMD
Path
Indicators
Parent process
1492"C:\Users\admin\AppData\Local\Temp\CloudCheck.exe" C:\Users\admin\AppData\Local\Temp\CloudCheck.exe
explorer.exe
User:
admin
Company:
Cloudflare
Integrity Level:
MEDIUM
Description:
Cloudflare WARP
Exit code:
0
Version:
2023.3.450.0
Modules
Images
c:\users\admin\appdata\local\temp\cloudcheck.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
Total events
1 051
Read events
1 036
Write events
15
Delete events
0

Modification events

(PID) Process:(1492) CloudCheck.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\156\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1492) CloudCheck.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
Skype.exe
Executable files
0
Suspicious files
6
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
1492CloudCheck.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\538F535B7FBDE384E456CC9F5DA5FBABbinary
MD5:6D469ED9256D08235B5E747D1E27DBF2
SHA256:B676F2EDDAE8775CD36CB0F63CD1D4603961F49E6265BA013A2F0307B6D0B804
1492CloudCheck.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:9DCCC84F416223750AAA7610CF57D1F2
SHA256:5002700078E06FE7CBFC12B8D06C52A3E85D6C9BACFA46F468BDF7EFBFBE6BC4
1492CloudCheck.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:F3441B8572AAE8801C04F3060B550443
SHA256:6720349E7D82EE0A8E73920D3C2B7CB2912D9FCF2EDB6FD98F2F12820158B0BF
1492CloudCheck.exeC:\Users\admin\AppData\Local\Temp\TarAF95.tmpbinary
MD5:9441737383D21192400ECA82FDA910EC
SHA256:BC3A6E84E41FAEB57E7C21AA3B60C2A64777107009727C5B7C0ED8FE658909E5
1492CloudCheck.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\538F535B7FBDE384E456CC9F5DA5FBABbinary
MD5:EB6080A4B459FA908614C9A651590350
SHA256:4D29A8C4C3E626EACAA5A797F3E2092D15CB96E3E625B8AF491E527BC82A59E1
1492CloudCheck.exeC:\Users\admin\AppData\Local\Temp\CabAF94.tmpcompressed
MD5:F3441B8572AAE8801C04F3060B550443
SHA256:6720349E7D82EE0A8E73920D3C2B7CB2912D9FCF2EDB6FD98F2F12820158B0BF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
8
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1492
CloudCheck.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?2f41e588fd180c9a
unknown
compressed
61.6 Kb
unknown
1492
CloudCheck.exe
GET
200
2.17.100.234:80
http://repository.certum.pl/ctnca2.cer
unknown
binary
1.46 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1492
CloudCheck.exe
2.17.100.234:80
repository.certum.pl
Akamai International B.V.
DE
unknown
1492
CloudCheck.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
repository.certum.pl
  • 2.17.100.234
  • 2.17.100.209
whitelisted
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
CloudCheck.exe