File name:

capcut-2-5-4.exe

Full analysis: https://app.any.run/tasks/d93d6453-51c1-4ee8-ba01-733358e58a22
Verdict: Malicious activity
Analysis date: January 15, 2024, 03:09:03
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

B828031F324919AEAB20775EEF0DE631

SHA1:

45E01B273E2112CFEFE128074BD089BD9BA931E4

SHA256:

363C18F062E7988139C4D3BA1D5234A9AF1D78BF021AC04CE49AC0C28F3B16EE

SSDEEP:

98304:FuDCRiPyB3GzGLM1pQqQP4CvCqa+0TTduOIeScSl5DP5B1Z5WzUCY1322mJBdh+W:N4E9XIvBr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • capcut-2-5-4.exe (PID: 2420)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • capcut-2-5-4.exe (PID: 2420)

    • Executable content was dropped or overwritten

      • capcut-2-5-4.exe (PID: 2420)

    • The process creates files with name similar to system file names

      • capcut-2-5-4.exe (PID: 2420)

    • Starts CMD.EXE for commands execution

      • capcut-2-5-4.exe (PID: 2420)

    • Uses WMIC.EXE to obtain Windows Installer data

      • cmd.exe (PID: 1652)

    • Reads the Internet Settings

      • WMIC.exe (PID: 1772)
      • WMIC.exe (PID: 1820)
      • WMIC.exe (PID: 1540)
      • WMIC.exe (PID: 2384)
      • WMIC.exe (PID: 2636)

    • Uses WMIC.EXE to obtain operating system information

      • cmd.exe (PID: 1832)

    • Uses WMIC.EXE to obtain a list of video controllers

      • cmd.exe (PID: 1740)

    • Uses WMIC.EXE to obtain information about the network interface controller

      • cmd.exe (PID: 2300)

    • Uses WMIC.EXE to obtain physical disk drive information

      • cmd.exe (PID: 796)

  • INFO

    • Checks supported languages

      • capcut-2-5-4.exe (PID: 2420)

    • Reads the computer name

      • capcut-2-5-4.exe (PID: 2420)

    • Create files in a temporary directory

      • capcut-2-5-4.exe (PID: 2420)

    • Creates files or folders in the user directory

      • capcut-2-5-4.exe (PID: 2420)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:12:15 23:26:14+01:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 473088
UninitializedDataSize: 16384
EntryPoint: 0x338f
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
53
Monitored processes
12
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start capcut-2-5-4.exe cmd.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs capcut-2-5-4.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Users\admin\AppData\Local\Temp\capcut-2-5-4.exe" C:\Users\admin\AppData\Local\Temp\capcut-2-5-4.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\capcut-2-5-4.exe
c:\windows\system32\ntdll.dll
796C:\Windows\System32\cmd.exe /c wmic diskdrive get SerialNumber /valueC:\Windows\System32\cmd.exe—capcut-2-5-4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1540wmic path Win32_VideoController get CurrentVerticalResolution,CurrentHorizontalResolution /valueC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
1652C:\Windows\System32\cmd.exe /c wmic csproduct get Name,UUID /valueC:\Windows\System32\cmd.exe—capcut-2-5-4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1740C:\Windows\System32\cmd.exe /c wmic path Win32_VideoController get CurrentVerticalResolution,CurrentHorizontalResolution /valueC:\Windows\System32\cmd.exe—capcut-2-5-4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1772wmic csproduct get Name,UUID /valueC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
1820wmic os get SerialNumber,Caption,BuildNumber,Version /valueC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
1832C:\Windows\System32\cmd.exe /c wmic os get SerialNumber,Caption,BuildNumber,Version /valueC:\Windows\System32\cmd.exe—capcut-2-5-4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2300C:\Windows\System32\cmd.exe /c wmic nicconfig get DefaultIPGateway,macaddressC:\Windows\System32\cmd.exe—capcut-2-5-4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2384wmic nicconfig get DefaultIPGateway,macaddressC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
Total events
1 239
Read events
1 239
Write events
0
Delete events
0

Modification events

No data
Executable files
5
Suspicious files
1
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
2420capcut-2-5-4.exeC:\Users\admin\AppData\Local\Temp\visual_effects_en.pngimage
MD5:8EA92C4B9D936D485757D19391F45043
SHA256:3A5E1EF48BD852386D5B155306F6B4098B53242C282B9BC54A2C2203301D90BA
2420capcut-2-5-4.exeC:\Users\admin\AppData\Local\Temp\nslFD8C.tmp\System.dllexecutable
MD5:0D7AD4F45DC6F5AA87F606D0331C6901
SHA256:3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
2420capcut-2-5-4.exeC:\Users\admin\AppData\Local\Temp\nslFD8C.tmp\shell_downloader.dllexecutable
MD5:30C4AA9356D60D2039ED6BFB7850C4C1
SHA256:0C4ABB66D9A69C80CFAA0EB3C988D4DC40D989843A87E95ED3CC6E75DAE31559
2420capcut-2-5-4.exeC:\Users\admin\AppData\Local\Temp\nslFD8C.tmp\res.zipcompressed
MD5:071F2613BF3C06DF596C1936CFB0AAE5
SHA256:27B0A914674E640B817FE33CF64DD45B538369324A0A82CC92E40E6EF37B1B7F
2420capcut-2-5-4.exeC:\Users\admin\AppData\Local\Temp\nslFD8C.tmp\downloader_nsis_plugin.dllexecutable
MD5:14930A06CBFB26D5FFFFD354FA12D5F8
SHA256:3EF7A13886328DAFBA1C49EC096DA122E63839AC6965BF4F3D4DCCE3A35CCC6D
2420capcut-2-5-4.exeC:\Users\admin\AppData\Local\Temp\nslFD8C.tmp\BgWorker.dllexecutable
MD5:33EC04738007E665059CF40BC0F0C22B
SHA256:50F735AB8F3473423E6873D628150BBC0777BE7B4F6405247CDDF22BB00FB6BE
2420capcut-2-5-4.exeC:\Users\admin\AppData\Local\Temp\intelligent_subtitles_en.pngimage
MD5:C51D1976F87828C0DCA46EF4D0243614
SHA256:463A0C124A0925FBB341855685B2B58525B100108D271679F2F95398D5F6C618
2420capcut-2-5-4.exeC:\Users\admin\AppData\Local\Temp\speech_synthesis_en.pngimage
MD5:7E0FCA9AFBA9A7FBC15D378B8E550BAA
SHA256:49D5FA943BCEC39D1244E6C69801F20B5F9D01FC89D6F260236A3C1255B5FC98
2420capcut-2-5-4.exeC:\Users\admin\AppData\Local\Temp\text_style_en.pngimage
MD5:03680B27E2CD41C23DDA448C1EE7B1BB
SHA256:06599F52F75C8E9F3B0A1476CAA97AB7BB0D61DF6A6FEBFB8CCE14706AF64E6B
2420capcut-2-5-4.exeC:\Users\admin\AppData\Local\Temp\keyframe_en.pngimage
MD5:950E97619B630F384CB2EC5C8DD271C2
SHA256:620CFFEECF59C90DB73B0CD81F8F4378AEAD22AF98791111EEE877A07344DC55
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
23
DNS requests
9
Threats
2

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2420
capcut-2-5-4.exe
193.108.153.6:443
maliva-mcs.byteoversea.com
Akamai International B.V.
DE
unknown
2420
capcut-2-5-4.exe
2.19.96.202:443
editor-api-sg.capcut.com
Akamai International B.V.
DE
unknown
2420
capcut-2-5-4.exe
193.108.153.17:443
lf16-capcut.faceulv.com
Akamai International B.V.
DE
unknown
2420
capcut-2-5-4.exe
23.53.41.99:443
editor-api.capcutapi.com
Akamai International B.V.
DE
unknown
2420
capcut-2-5-4.exe
193.108.153.9:443
maliva-mcs.byteoversea.com
Akamai International B.V.
DE
unknown
2420
capcut-2-5-4.exe
193.108.153.21:443
sf16-va.tiktokcdn.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
editor-api-sg.capcut.com
  • 2.19.96.202
  • 2.19.96.248
unknown
maliva-mcs.byteoversea.com
  • 193.108.153.6
  • 193.108.153.7
  • 193.108.153.13
  • 193.108.153.9
  • 193.108.153.11
  • 193.108.153.5
  • 193.108.153.8
  • 193.108.153.10
  • 193.108.153.12
whitelisted
lf16-capcut.faceulv.com
  • 193.108.153.17
  • 193.108.153.8
unknown
editor-api.capcutapi.com
  • 23.53.41.99
  • 23.53.41.89
unknown
sgali-mcs.byteoversea.com
  • 193.108.153.9
  • 193.108.153.10
  • 193.108.153.8
  • 193.108.153.6
  • 193.108.153.29
  • 193.108.153.5
  • 193.108.153.27
  • 193.108.153.4
  • 193.108.153.7
whitelisted
sf16-va.tiktokcdn.com
  • 193.108.153.21
  • 193.108.153.14
whitelisted

Threats

Found threats are available for the paid subscriptions
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
capcut-2-5-4.exe