File name:

capcut_capcutpc_0_1.2.4_installer.exe

Full analysis: https://app.any.run/tasks/4db7806e-7002-4b72-a209-afd524b403db
Verdict: Malicious activity
Analysis date: January 15, 2024, 08:07:56
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

B828031F324919AEAB20775EEF0DE631

SHA1:

45E01B273E2112CFEFE128074BD089BD9BA931E4

SHA256:

363C18F062E7988139C4D3BA1D5234A9AF1D78BF021AC04CE49AC0C28F3B16EE

SSDEEP:

98304:FuDCRiPyB3GzGLM1pQqQP4CvCqa+0TTduOIeScSl5DP5B1Z5WzUCY1322mJBdh+W:N4E9XIvBr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • capcut_capcutpc_0_1.2.4_installer.exe (PID: 548)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • capcut_capcutpc_0_1.2.4_installer.exe (PID: 548)

    • The process creates files with name similar to system file names

      • capcut_capcutpc_0_1.2.4_installer.exe (PID: 548)

    • Executable content was dropped or overwritten

      • capcut_capcutpc_0_1.2.4_installer.exe (PID: 548)

    • Starts CMD.EXE for commands execution

      • capcut_capcutpc_0_1.2.4_installer.exe (PID: 548)

    • Uses WMIC.EXE to obtain Windows Installer data

      • cmd.exe (PID: 1864)

    • Reads the Internet Settings

      • WMIC.exe (PID: 1596)
      • WMIC.exe (PID: 844)
      • WMIC.exe (PID: 2340)
      • WMIC.exe (PID: 632)
      • WMIC.exe (PID: 1880)

    • Uses WMIC.EXE to obtain operating system information

      • cmd.exe (PID: 1816)

    • Uses WMIC.EXE to obtain a list of video controllers

      • cmd.exe (PID: 1636)

    • Uses WMIC.EXE to obtain information about the network interface controller

      • cmd.exe (PID: 2244)

    • Uses WMIC.EXE to obtain physical disk drive information

      • cmd.exe (PID: 2632)

  • INFO

    • Checks supported languages

      • capcut_capcutpc_0_1.2.4_installer.exe (PID: 548)

    • Reads the computer name

      • capcut_capcutpc_0_1.2.4_installer.exe (PID: 548)

    • Create files in a temporary directory

      • capcut_capcutpc_0_1.2.4_installer.exe (PID: 548)

    • Creates files or folders in the user directory

      • capcut_capcutpc_0_1.2.4_installer.exe (PID: 548)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:12:15 23:26:14+01:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 473088
UninitializedDataSize: 16384
EntryPoint: 0x338f
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
53
Monitored processes
12
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start capcut_capcutpc_0_1.2.4_installer.exe cmd.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs capcut_capcutpc_0_1.2.4_installer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
548"C:\Users\admin\AppData\Local\Temp\capcut_capcutpc_0_1.2.4_installer.exe" C:\Users\admin\AppData\Local\Temp\capcut_capcutpc_0_1.2.4_installer.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\capcut_capcutpc_0_1.2.4_installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
632wmic nicconfig get DefaultIPGateway,macaddressC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
844wmic os get SerialNumber,Caption,BuildNumber,Version /valueC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
1356"C:\Users\admin\AppData\Local\Temp\capcut_capcutpc_0_1.2.4_installer.exe" C:\Users\admin\AppData\Local\Temp\capcut_capcutpc_0_1.2.4_installer.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\capcut_capcutpc_0_1.2.4_installer.exe
c:\windows\system32\ntdll.dll
1596wmic csproduct get Name,UUID /valueC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
1636C:\Windows\System32\cmd.exe /c wmic path Win32_VideoController get CurrentVerticalResolution,CurrentHorizontalResolution /valueC:\Windows\System32\cmd.exe—capcut_capcutpc_0_1.2.4_installer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1816C:\Windows\System32\cmd.exe /c wmic os get SerialNumber,Caption,BuildNumber,Version /valueC:\Windows\System32\cmd.exe—capcut_capcutpc_0_1.2.4_installer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1864C:\Windows\System32\cmd.exe /c wmic csproduct get Name,UUID /valueC:\Windows\System32\cmd.exe—capcut_capcutpc_0_1.2.4_installer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1880wmic diskdrive get SerialNumber /valueC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
2244C:\Windows\System32\cmd.exe /c wmic nicconfig get DefaultIPGateway,macaddressC:\Windows\System32\cmd.exe—capcut_capcutpc_0_1.2.4_installer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
1 239
Read events
1 239
Write events
0
Delete events
0

Modification events

No data
Executable files
5
Suspicious files
1
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
548capcut_capcutpc_0_1.2.4_installer.exeC:\Users\admin\AppData\Local\Temp\nsgFF41.tmp\res.zipcompressed
MD5:071F2613BF3C06DF596C1936CFB0AAE5
SHA256:27B0A914674E640B817FE33CF64DD45B538369324A0A82CC92E40E6EF37B1B7F
548capcut_capcutpc_0_1.2.4_installer.exeC:\Users\admin\AppData\Local\Temp\speech_synthesis_en.pngimage
MD5:7E0FCA9AFBA9A7FBC15D378B8E550BAA
SHA256:49D5FA943BCEC39D1244E6C69801F20B5F9D01FC89D6F260236A3C1255B5FC98
548capcut_capcutpc_0_1.2.4_installer.exeC:\Users\admin\AppData\Local\Temp\nsgFF41.tmp\downloader_nsis_plugin.dllexecutable
MD5:14930A06CBFB26D5FFFFD354FA12D5F8
SHA256:3EF7A13886328DAFBA1C49EC096DA122E63839AC6965BF4F3D4DCCE3A35CCC6D
548capcut_capcutpc_0_1.2.4_installer.exeC:\Users\admin\AppData\Local\Temp\text_style_en.pngimage
MD5:03680B27E2CD41C23DDA448C1EE7B1BB
SHA256:06599F52F75C8E9F3B0A1476CAA97AB7BB0D61DF6A6FEBFB8CCE14706AF64E6B
548capcut_capcutpc_0_1.2.4_installer.exeC:\Users\admin\AppData\Local\Temp\water_world_en.pngimage
MD5:601BBE214313CA48CA8F333161AC62AF
SHA256:56A9920B94732C54604A6AB3CE0072D30E0EB1A2F4F835661FECBC0C448D8965
548capcut_capcutpc_0_1.2.4_installer.exeC:\Users\admin\AppData\Local\Temp\visual_effects_en.pngimage
MD5:8EA92C4B9D936D485757D19391F45043
SHA256:3A5E1EF48BD852386D5B155306F6B4098B53242C282B9BC54A2C2203301D90BA
548capcut_capcutpc_0_1.2.4_installer.exeC:\Users\admin\AppData\Local\Temp\nsgFF41.tmp\shell_downloader.dllexecutable
MD5:30C4AA9356D60D2039ED6BFB7850C4C1
SHA256:0C4ABB66D9A69C80CFAA0EB3C988D4DC40D989843A87E95ED3CC6E75DAE31559
548capcut_capcutpc_0_1.2.4_installer.exeC:\Users\admin\AppData\Local\Temp\nsgFF41.tmp\deviceregister_shared.dllexecutable
MD5:8BAAAEACB97679FB495E1C4F902F0A68
SHA256:7C2A74C4BE8D524A121E78E763C05C7B5CB58B524119AC8897C493E717A1D42A
548capcut_capcutpc_0_1.2.4_installer.exeC:\Users\admin\AppData\Local\Temp\nsgFF41.tmp\System.dllexecutable
MD5:0D7AD4F45DC6F5AA87F606D0331C6901
SHA256:3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
548capcut_capcutpc_0_1.2.4_installer.exeC:\Users\admin\AppData\Local\Temp\nsgFF41.tmp\BgWorker.dllexecutable
MD5:33EC04738007E665059CF40BC0F0C22B
SHA256:50F735AB8F3473423E6873D628150BBC0777BE7B4F6405247CDDF22BB00FB6BE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
23
DNS requests
9
Threats
2

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
548
capcut_capcutpc_0_1.2.4_installer.exe
193.108.153.22:443
maliva-mcs.byteoversea.com
Akamai International B.V.
DE
unknown
548
capcut_capcutpc_0_1.2.4_installer.exe
104.126.37.137:443
editor-api-sg.capcut.com
Akamai International B.V.
DE
unknown
548
capcut_capcutpc_0_1.2.4_installer.exe
193.108.153.17:443
lf16-capcut.faceulv.com
Akamai International B.V.
DE
unknown
548
capcut_capcutpc_0_1.2.4_installer.exe
193.108.153.11:443
editor-api.capcutapi.com
Akamai International B.V.
DE
unknown
548
capcut_capcutpc_0_1.2.4_installer.exe
193.108.153.12:443
sgali-mcs.byteoversea.com
Akamai International B.V.
DE
unknown
548
capcut_capcutpc_0_1.2.4_installer.exe
193.108.153.21:443
maliva-mcs.byteoversea.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
maliva-mcs.byteoversea.com
  • 193.108.153.22
  • 193.108.153.27
  • 193.108.153.25
  • 193.108.153.23
  • 193.108.153.29
  • 193.108.153.26
  • 193.108.153.4
  • 193.108.153.21
  • 193.108.153.24
whitelisted
editor-api-sg.capcut.com
  • 104.126.37.137
  • 104.126.37.177
unknown
lf16-capcut.faceulv.com
  • 193.108.153.17
  • 193.108.153.8
unknown
editor-api.capcutapi.com
  • 193.108.153.11
  • 193.108.153.27
unknown
sgali-mcs.byteoversea.com
  • 193.108.153.12
  • 193.108.153.14
  • 193.108.153.11
  • 193.108.153.16
  • 193.108.153.13
  • 193.108.153.17
  • 193.108.153.19
  • 193.108.153.20
  • 193.108.153.15
whitelisted
sf16-va.tiktokcdn.com
  • 193.108.153.21
  • 193.108.153.14
whitelisted

Threats

Found threats are available for the paid subscriptions
2 ETPRO signatures available at the full report
Process
Message
capcut_capcutpc_0_1.2.4_installer.exe
vlExpandPlate isVisiable:0
capcut_capcutpc_0_1.2.4_installer.exe
exec
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
capcut_capcutpc_0_1.2.4_installer.exe