Overview
overview
7Static
static
342f3a1d26f...18.exe
windows7-x64
742f3a1d26f...18.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...sh.dll
windows7-x64
1$PLUGINSDI...sh.dll
windows10-2004-x64
1$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3$TEMP/~nsi...86.dll
windows7-x64
1$TEMP/~nsi...86.dll
windows10-2004-x64
3Cloud-Web_2_86.dll
windows7-x64
6Cloud-Web_2_86.dll
windows10-2004-x64
6Cloud-Web_2_86.dll
windows7-x64
6Cloud-Web_2_86.dll
windows10-2004-x64
6Cloud-Web_...86.dll
windows7-x64
1Cloud-Web_...86.dll
windows10-2004-x64
1Cloud-Web_...86.dll
windows7-x64
1Cloud-Web_...86.dll
windows10-2004-x64
1Cloud-Web_...86.dll
windows7-x64
1Cloud-Web_...86.dll
windows10-2004-x64
3Cloud-Web_...86.dll
windows7-x64
1Cloud-Web_...86.dll
windows10-2004-x64
3Cloud-Web_run.exe
windows7-x64
6Cloud-Web_run.exe
windows10-2004-x64
6Cloud-Web_run.exe
windows7-x64
6Cloud-Web_run.exe
windows10-2004-x64
6Cloud-Web_tb_2_86.dll
windows7-x64
1Cloud-Web_tb_2_86.dll
windows10-2004-x64
1Cloud-Web_tb_2_86.dll
windows7-x64
1Cloud-Web_tb_2_86.dll
windows10-2004-x64
1cloudidsvc.exe
windows7-x64
1cloudidsvc.exe
windows10-2004-x64
1Analysis
-
max time kernel
125s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
13/07/2024, 19:02
Static task
static1
Behavioral task
behavioral1
Sample
42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral2
Sample
42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/newadvsplash.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/newadvsplash.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$TEMP/~nsis/Cloud-Web_nad_2_86.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral10
Sample
$TEMP/~nsis/Cloud-Web_nad_2_86.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Cloud-Web_2_86.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral12
Sample
Cloud-Web_2_86.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Cloud-Web_2_86.dll
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral14
Sample
Cloud-Web_2_86.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Cloud-Web_mime_2_86.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral16
Sample
Cloud-Web_mime_2_86.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Cloud-Web_mime_2_86.dll
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral18
Sample
Cloud-Web_mime_2_86.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Cloud-Web_nad_2_86.dll
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral20
Sample
Cloud-Web_nad_2_86.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Cloud-Web_nad_2_86.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral22
Sample
Cloud-Web_nad_2_86.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
Cloud-Web_run.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral24
Sample
Cloud-Web_run.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
Cloud-Web_run.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral26
Sample
Cloud-Web_run.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
Cloud-Web_tb_2_86.dll
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral28
Sample
Cloud-Web_tb_2_86.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
Cloud-Web_tb_2_86.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral30
Sample
Cloud-Web_tb_2_86.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
cloudidsvc.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral32
Sample
cloudidsvc.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
General
-
Target
42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe
-
Size
587KB
-
MD5
42f3a1d26fb4dcbf86ffa3289aa3dc10
-
SHA1
60b5c3a0ba32b79596fbc264b3df6f1818957ed9
-
SHA256
2f14f9b66d7054613c2e84f70d04fd5cdb3b2c99ec7f72d14123feffcf6a8808
-
SHA512
8d8abf9d08d872133519d468ff980682c88a47d9567372a5cc457ed8d743cfc8ff1ffe97c62be5a1bbcef59407d3a887b37d0eab0aae4129ba3fa7cd94951f51
-
SSDEEP
12288:pab0pEkOM74sWha8LkW3kXcYWLBKMXLUa3oYViTeyJILJQ:4IjzrqLLkW3zBBNgqiSQ
Malware Config
Signatures
-
Executes dropped EXE 5 IoCs
pid Process 2744 cloudidsvc.ex_ 2624 cloudidsvc.ex_ 840 cloudidsvc.exe 2356 cloudidsvc.exe 2016 cloudidsvc.exe -
Loads dropped DLL 32 IoCs
pid Process 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 840 cloudidsvc.exe 840 cloudidsvc.exe 840 cloudidsvc.exe 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 2356 cloudidsvc.exe 2356 cloudidsvc.exe 2356 cloudidsvc.exe 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 2016 cloudidsvc.exe 2016 cloudidsvc.exe 2016 cloudidsvc.exe 2016 cloudidsvc.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{3AD2B8DC-C660-B0ef-BF1F-D4C52BD272B0} 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{3AD2B8DC-C660-B0ef-BF1F-D4C52BD272B0}\ = "CloudExs30002APIClass Helper" 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat cloudidsvc.exe -
Drops file in Program Files directory 16 IoCs
description ioc Process File created C:\Program Files (x86)\Cloud-Web\Cloud-Web_mime_2_86.dl_ 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe File created C:\Program Files (x86)\Cloud-Web\Cloud-Web_run.exe 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe File created C:\Program Files (x86)\Cloud-Web\uninst.exe 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe File created C:\Program Files (x86)\Cloud-Web\Cloud-Web_2_86.dll 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe File created C:\Program Files (x86)\Cloud-Web\cloudidsvc.exe 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe File created C:\Program Files (x86)\Cloud-Web\Cloud-Web_run.ex_ 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Cloud-Web\Log\cloudweb_up_20240713.txt cloudidsvc.ex_ File created C:\Program Files (x86)\Cloud-Web\Cloud-Web_nad_2_86.dll 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe File created C:\Program Files (x86)\Cloud-Web\cloudidsvc.ex_ 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe File created C:\Program Files (x86)\Cloud-Web\Cloud-Web_tb_2_86.dl_ 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe File created C:\Program Files (x86)\Cloud-Web\Cloud-Web_tb_2_86.dll 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe File created C:\Program Files (x86)\Cloud-Web\Cloud-Web_mime_2_86.dll 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Cloud-Web\Log\cloudweb_up_20240713.txt cloudidsvc.exe File created C:\Program Files (x86)\Cloud-Web\cloud_uins.dat 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe File created C:\Program Files (x86)\Cloud-Web\Cloud-Web_2_86.dl_ 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe File created C:\Program Files (x86)\Cloud-Web\Cloud-Web_nad_2_86.dl_ 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes" 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{0A07354E-A092-490f-9597-BA096721A26D}\ButtonText = "Ŭ¶ó¿ìµåÀ¥ ¼³Á¤ ½ÇÇà" 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{0A07354E-A092-490f-9597-BA096721A26D}\Icon = "C:\\Program Files (x86)\\Cloud-Web\\Cloud-Web_tb_2_86.dll,201" 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{0A07354E-A092-490f-9597-BA096721A26D}\HotIcon = "C:\\Program Files (x86)\\Cloud-Web\\Cloud-Web_tb_2_86.dll,202" 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{0A07354E-A092-490f-9597-BA096721A26D}\ClsidExtension = "{053202B5-4539-4c5a-B531-42C754ABBD41}" 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\SOFTWARE\Microsoft\Internet Explorer\Main 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{0A07354E-A092-490f-9597-BA096721A26D} 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{0A07354E-A092-490f-9597-BA096721A26D}\CLSID = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}" 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{0A07354E-A092-490f-9597-BA096721A26D}\Default Visible = "Yes" 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe -
Modifies data under HKEY_USERS 28 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0033000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 cloudidsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections cloudidsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" cloudidsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" cloudidsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{00B21A40-6FAF-45D7-A099-5BB09CBF3C64}\WpadDecisionReason = "1" cloudidsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" cloudidsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{00B21A40-6FAF-45D7-A099-5BB09CBF3C64} cloudidsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{00B21A40-6FAF-45D7-A099-5BB09CBF3C64}\WpadNetworkName = "Network 3" cloudidsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\66-4e-4b-c5-e6-8c cloudidsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 cloudidsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings cloudidsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0033000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 cloudidsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix cloudidsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\66-4e-4b-c5-e6-8c\WpadDecisionTime = 803e875b57d5da01 cloudidsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" cloudidsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{00B21A40-6FAF-45D7-A099-5BB09CBF3C64}\WpadDecision = "0" cloudidsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\66-4e-4b-c5-e6-8c\WpadDecisionTime = a036588157d5da01 cloudidsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings cloudidsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad cloudidsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ cloudidsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" cloudidsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{00B21A40-6FAF-45D7-A099-5BB09CBF3C64}\66-4e-4b-c5-e6-8c cloudidsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\66-4e-4b-c5-e6-8c\WpadDecision = "0" cloudidsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{00B21A40-6FAF-45D7-A099-5BB09CBF3C64}\WpadDecisionTime = a036588157d5da01 cloudidsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 cloudidsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{00B21A40-6FAF-45D7-A099-5BB09CBF3C64}\WpadDecisionTime = 803e875b57d5da01 cloudidsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\66-4e-4b-c5-e6-8c\WpadDecisionReason = "1" cloudidsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\66-4e-4b-c5-e6-8c\WpadDetectedUrl cloudidsvc.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4DDB057-9EDC-45B5-89A3-8CAD9F265F1E}\1.0 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D89080BE-5019-4399-96E1-2A0E32AEF599}\TypeLib\ = "{B4DDB057-9EDC-45B5-89A3-8CAD9F265F1E}" 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CloudExs30002BHO.CloudExs30002APIClass\CLSID\ = "{3AD2B8DC-C660-B0ef-BF1F-D4C52BD272B0}" 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2AD2B8DC-C660-B0EF-BF1F-D4C52BD272B0}\1.0\ = "CloudExs30002APIClass 1.0 Type Library" 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2AD2B8DC-C660-B0EF-BF1F-D4C52BD272B0}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Cloud-Web\\" 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4DDB057-9EDC-45B5-89A3-8CAD9F265F1E}\1.0\ = "CloudToolBar 1.0 Type Library" 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{22D0BA1C-4BEB-476E-AA5A-18FDE2E9D064}\ProgID 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CloudExs30002BHO.CloudExs30002APIClass\CLSID 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3AD2B8DC-C660-B0ef-BF1F-D4C52BD272B0}\Programmable 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1AD2B8DC-C660-B0EF-BF1F-D4C52BD272B0}\TypeLib\Version = "1.0" 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{22D0BA1C-4BEB-476E-AA5A-18FDE2E9D064}\Version 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CloudToolBar.CloudToolbarObject\CLSID\ = "{053202B5-4539-4c5a-B531-42C754ABBD41}" 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D89080BE-5019-4399-96E1-2A0E32AEF599}\TypeLib 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3AD2B8DC-C660-B0ef-BF1F-D4C52BD272B0}\VersionIndependentProgID\ = "CloudExs30002BHO.CloudExs30002APIClass" 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4DDB057-9EDC-45B5-89A3-8CAD9F265F1E}\1.0\HELPDIR 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CloudToolBar.CloudToolbarObject 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4DDB057-9EDC-45B5-89A3-8CAD9F265F1E}\1.0\0\win32 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D89080BE-5019-4399-96E1-2A0E32AEF599}\TypeLib\Version = "1.0" 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CloudToolBar.CloudToolbarObject\CLSID 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{053202B5-4539-4c5a-B531-42C754ABBD41}\InprocServer32\ThreadingModel = "Apartment" 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D89080BE-5019-4399-96E1-2A0E32AEF599}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ID_MimeHTML.1\CLSID 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ID_MimeHTML\CurVer\ = "ID_MimeHTML.1" 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{22D0BA1C-4BEB-476E-AA5A-18FDE2E9D064}\Version\ = "1.0" 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{36E4825B-2C2F-4EC9-99F0-6EA492D7CC30}\TypeLib 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EA3B666E-8A3C-4099-B499-E0A277279117} 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3AD2B8DC-C660-B0ef-BF1F-D4C52BD272B0}\VersionIndependentProgID 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1AD2B8DC-C660-B0EF-BF1F-D4C52BD272B0}\ProxyStubClsid32 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1AD2B8DC-C660-B0EF-BF1F-D4C52BD272B0}\TypeLib\Version = "1.0" 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1AD2B8DC-C660-B0EF-BF1F-D4C52BD272B0}\TypeLib\ = "{2AD2B8DC-C660-B0EF-BF1F-D4C52BD272B0}" 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CloudToolBar.CloudToolbarObject.1 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CloudToolBar.CloudToolbarObject.1\CLSID\ = "{053202B5-4539-4c5a-B531-42C754ABBD41}" 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{22D0BA1C-4BEB-476E-AA5A-18FDE2E9D064}\ = "MimeHTML Class" 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3AD2B8DC-C660-B0ef-BF1F-D4C52BD272B0}\TypeLib 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2AD2B8DC-C660-B0EF-BF1F-D4C52BD272B0}\1.0\0\win32 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4DDB057-9EDC-45B5-89A3-8CAD9F265F1E} 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ID_MimeHTML\CLSID 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{053202B5-4539-4c5a-B531-42C754ABBD41}\ProgID\ = "CloudToolBar.CloudToolbarObject.1" 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CloudExs30002BHO.CloudExs30002APIClass 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3AD2B8DC-C660-B0ef-BF1F-D4C52BD272B0}\InprocServer32\ThreadingModel = "Apartment" 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1AD2B8DC-C660-B0EF-BF1F-D4C52BD272B0} 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1AD2B8DC-C660-B0EF-BF1F-D4C52BD272B0}\ProxyStubClsid32 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1AD2B8DC-C660-B0EF-BF1F-D4C52BD272B0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CloudToolBar.CloudToolbarObject\CurVer 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{053202B5-4539-4c5a-B531-42C754ABBD41}\ = "CloudToolbarObject Class" 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ID_MimeHTML 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{22D0BA1C-4BEB-476E-AA5A-18FDE2E9D064}\Programmable 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EA3B666E-8A3C-4099-B499-E0A277279117}\1.0\FLAGS\ = "0" 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D89080BE-5019-4399-96E1-2A0E32AEF599}\TypeLib 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ID_MimeHTML.1\ = "MimeHTML Class" 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{22D0BA1C-4BEB-476E-AA5A-18FDE2E9D064}\InprocServer32\ = "C:\\Program Files (x86)\\Cloud-Web\\Cloud-Web_mime_2_86.dll" 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{36E4825B-2C2F-4EC9-99F0-6EA492D7CC30}\TypeLib\Version = "1.0" 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D89080BE-5019-4399-96E1-2A0E32AEF599} 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D89080BE-5019-4399-96E1-2A0E32AEF599}\ProxyStubClsid32 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D89080BE-5019-4399-96E1-2A0E32AEF599} 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ID_MimeHTML.1\CLSID\ = "{22D0BA1C-4BEB-476E-AA5A-18FDE2E9D064}" 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3AD2B8DC-C660-B0ef-BF1F-D4C52BD272B0}\ProgID 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{053202B5-4539-4c5a-B531-42C754ABBD41}\Programmable 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4DDB057-9EDC-45B5-89A3-8CAD9F265F1E}\1.0\FLAGS 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ID_MimeHTML\CurVer 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EA3B666E-8A3C-4099-B499-E0A277279117}\1.0 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{36E4825B-2C2F-4EC9-99F0-6EA492D7CC30}\ProxyStubClsid32 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2AD2B8DC-C660-B0EF-BF1F-D4C52BD272B0}\1.0\0 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CloudExs30002BHO.CloudExs30002APIClass.1 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe Token: SeBackupPrivilege 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2700 wrote to memory of 2744 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 30 PID 2700 wrote to memory of 2744 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 30 PID 2700 wrote to memory of 2744 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 30 PID 2700 wrote to memory of 2744 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 30 PID 2700 wrote to memory of 2744 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 30 PID 2700 wrote to memory of 2744 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 30 PID 2700 wrote to memory of 2744 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 30 PID 2700 wrote to memory of 2624 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 31 PID 2700 wrote to memory of 2624 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 31 PID 2700 wrote to memory of 2624 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 31 PID 2700 wrote to memory of 2624 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 31 PID 2700 wrote to memory of 2624 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 31 PID 2700 wrote to memory of 2624 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 31 PID 2700 wrote to memory of 2624 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 31 PID 2700 wrote to memory of 840 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 32 PID 2700 wrote to memory of 840 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 32 PID 2700 wrote to memory of 840 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 32 PID 2700 wrote to memory of 840 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 32 PID 2700 wrote to memory of 840 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 32 PID 2700 wrote to memory of 840 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 32 PID 2700 wrote to memory of 840 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 32 PID 2700 wrote to memory of 2356 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 33 PID 2700 wrote to memory of 2356 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 33 PID 2700 wrote to memory of 2356 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 33 PID 2700 wrote to memory of 2356 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 33 PID 2700 wrote to memory of 2356 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 33 PID 2700 wrote to memory of 2356 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 33 PID 2700 wrote to memory of 2356 2700 42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\42f3a1d26fb4dcbf86ffa3289aa3dc10_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Program Files (x86)\Cloud-Web\cloudidsvc.ex_"C:\Program Files (x86)\Cloud-Web\cloudidsvc.ex_" /stop2⤵
- Executes dropped EXE
PID:2744
-
-
C:\Program Files (x86)\Cloud-Web\cloudidsvc.ex_"C:\Program Files (x86)\Cloud-Web\cloudidsvc.ex_" /u2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2624
-
-
C:\Program Files (x86)\Cloud-Web\cloudidsvc.exe"C:\Program Files (x86)\Cloud-Web\cloudidsvc.exe" /i2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:840
-
-
C:\Program Files (x86)\Cloud-Web\cloudidsvc.exe"C:\Program Files (x86)\Cloud-Web\cloudidsvc.exe" /start2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356
-
-
C:\Program Files (x86)\Cloud-Web\cloudidsvc.exe"C:\Program Files (x86)\Cloud-Web\cloudidsvc.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2016
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
127KB
MD5cc2c7d2ca1d6a2100680f77b32a3ac2c
SHA1f23dfeb12c78a44cb2d6191eb3f405a147ae6167
SHA256875589feb35cbc36355d6ccf062e97fba77b94f102a7560b636aecda570457a9
SHA5127f11137990210a5130bd48be37b1496a3ce835a88a047d026e10a3484035a9749faa7105f9fd4e1658e7f3f8447b6dc784b6d941cc6a56511f65bf553baff578
-
Filesize
379B
MD5aabcb8b5404edf03cf6024d61d6c1857
SHA1e6d6a28cc3e3251d06dd4ca5be2da283eebd197d
SHA25669ab3374ba65883c00016097ad11294b097460d7aca2ddd855193a87693fb76e
SHA5120890ae876dbfa3e9bbab78a85828be784582c0375e38134c04dfbb53485575b5fdc1d14bf969d781a3ac193987dad70f42e341405920838b35c0acdfc8ebd4f0
-
Filesize
631B
MD5d68e763c825dc0e388929ae1b375ce18
SHA17951a43bbfb08fd742224ada280913d1897b89ab
SHA25625cf0f0ce42f8acd9ea6facc223f54105c7fd0cce63fb7bb5d83e6600100acbd
SHA5121e146e2631a4f3bd091905ccc10ed1054700349648cd52aad24eaeeedff0fac4b44b6212284a6d0855942ff16308c66402ecb895e68ef1c66dcd496973043cdb
-
Filesize
123KB
MD5cd80e012b768c6fbfcf209a10bcfb2b2
SHA1e1c01bd52be5861cd20696484c043a2b77d22222
SHA256ee3ba8b64aeaacac397cd4fe81bd4433f23bf7b144a65c18034b1323e6e75c23
SHA512d1cc91089165ef8507bd8bf21aa76d2373579e7e5e793ee72bd123b9bb8135e8d61272db79aa5d47f3848d8a2a54dd1c9a5b3892ba1f00cc4dc8e2367063f44a
-
Filesize
210KB
MD5e03152320af546785839f21cefd28ce1
SHA17264e5753bb5313b9ceb69d05c15e000ed938559
SHA2566807aee8007988c5409a947a526c187c66e349886399541454800ce2a99c2442
SHA51293681775e96cb80b8cc4b89c788902f5070497c5a0120c0ba965c14e651ab3726387bc0d3f8feeaf315ae45bd7bf40bf37f1e2fd379b89bc812c9dd2fdfefb5e
-
Filesize
127KB
MD52f476c794155a6d41487ab48ca6091a8
SHA1999d2036b8e6b4fb75db915e8fcd1447652c6816
SHA25625fcf3cb6a01fa879cd8153ce826564505967049e9a66811c972a8384e320092
SHA512f7c82513dcc6d6f09e0d7b634f2ff8d5fe6864fce05729a807a82150fb196666a355c19f01657a8628b3592d3d15c93dfe7ffee78816e9cfa441b52c4f47f91c
-
Filesize
107KB
MD5191d8246a87565d7291f8d518c60912e
SHA145cf9834d3930b1b91e075999c44dd143bcc5a4d
SHA2569ae3b2a05985b28b28439b667b26f3bb2543f7ac757ca0187beacd67dd898b37
SHA512208c2312317e776e6c63e7fe5504178142be6fcee03df00b392b249db529cb55b94974465d7282331f6dec096821208046b2ad462e66e8b9d2c7b13df12d7846
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
8KB
MD57ee14dff57fb6e6c644b318d16768f4c
SHA19a5d5b31ab56ab01e9b0bd76c51b8b4605a8ccce
SHA25653377d0710f551182edbab4150935425948535d11b92bf08a1c2dcf989723bd7
SHA5120565ff2bdbdf044c5f90bd45475d478b48cdbd5e19569976291b1bdd703e61355410c65f29f2c9213faf56251beb16d342c8625288dad6afc670717b9636d51f
-
Filesize
4KB
MD58f4ac52cb2f7143f29f114add12452ad
SHA129dc25f5d69bf129d608b83821c8ec8ab8c8edb3
SHA256b214d73aea95191f7363ad93cdc12b6fbd50a3a54b0aa891b3d45bc4b7b2aa04
SHA5122f9e2c7450557c2b88a12d3a3b4ab999c9f2a4df0d39dcd795b307b89855387bc96fc6d4fb51de8f33de0780e08a3b15fdad43daeaf7373cca71b01d7afdaf0c
-
Filesize
551KB
MD510b188c019ba9e23fec9b06f272c3438
SHA15c50e3ce77935a3ef6a2679bccf9a228f4d42eef
SHA25690d999d46e21356297a1ca84ffe5e94e3e29d767437d4e805950dc2250269b8a
SHA512018bdf75222bf7ce2edefcc9cf896658b2e7f63ef8cf7f2497c5145935d9b59591fec37dc9fb0c4801681d3d6178aa07a400fef88527119eb8366f8ca35ec00a
