File name:

capcut-2-5-4.exe

Full analysis: https://app.any.run/tasks/d93d6453-51c1-4ee8-ba01-733358e58a22
Verdict: Malicious activity
Analysis date: January 15, 2024, 03:09:03
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

B828031F324919AEAB20775EEF0DE631

SHA1:

45E01B273E2112CFEFE128074BD089BD9BA931E4

SHA256:

363C18F062E7988139C4D3BA1D5234A9AF1D78BF021AC04CE49AC0C28F3B16EE

SSDEEP:

98304:FuDCRiPyB3GzGLM1pQqQP4CvCqa+0TTduOIeScSl5DP5B1Z5WzUCY1322mJBdh+W:N4E9XIvBr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • capcut-2-5-4.exe (PID: 2420)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • capcut-2-5-4.exe (PID: 2420)

    • The process creates files with name similar to system file names

      • capcut-2-5-4.exe (PID: 2420)

    • Executable content was dropped or overwritten

      • capcut-2-5-4.exe (PID: 2420)

    • Uses WMIC.EXE to obtain operating system information

      • cmd.exe (PID: 1832)

    • Reads the Internet Settings

      • WMIC.exe (PID: 1772)
      • WMIC.exe (PID: 1820)
      • WMIC.exe (PID: 2636)
      • WMIC.exe (PID: 1540)
      • WMIC.exe (PID: 2384)

    • Uses WMIC.EXE to obtain information about the network interface controller

      • cmd.exe (PID: 2300)

    • Uses WMIC.EXE to obtain physical disk drive information

      • cmd.exe (PID: 796)

    • Uses WMIC.EXE to obtain Windows Installer data

      • cmd.exe (PID: 1652)

    • Starts CMD.EXE for commands execution

      • capcut-2-5-4.exe (PID: 2420)

    • Uses WMIC.EXE to obtain a list of video controllers

      • cmd.exe (PID: 1740)

  • INFO

    • Checks supported languages

      • capcut-2-5-4.exe (PID: 2420)

    • Creates files or folders in the user directory

      • capcut-2-5-4.exe (PID: 2420)

    • Create files in a temporary directory

      • capcut-2-5-4.exe (PID: 2420)

    • Reads the computer name

      • capcut-2-5-4.exe (PID: 2420)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:12:15 23:26:14+01:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 473088
UninitializedDataSize: 16384
EntryPoint: 0x338f
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
53
Monitored processes
12
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start capcut-2-5-4.exe cmd.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs capcut-2-5-4.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Users\admin\AppData\Local\Temp\capcut-2-5-4.exe" C:\Users\admin\AppData\Local\Temp\capcut-2-5-4.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\capcut-2-5-4.exe
c:\windows\system32\ntdll.dll
796C:\Windows\System32\cmd.exe /c wmic diskdrive get SerialNumber /valueC:\Windows\System32\cmd.exe—capcut-2-5-4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1540wmic path Win32_VideoController get CurrentVerticalResolution,CurrentHorizontalResolution /valueC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
1652C:\Windows\System32\cmd.exe /c wmic csproduct get Name,UUID /valueC:\Windows\System32\cmd.exe—capcut-2-5-4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1740C:\Windows\System32\cmd.exe /c wmic path Win32_VideoController get CurrentVerticalResolution,CurrentHorizontalResolution /valueC:\Windows\System32\cmd.exe—capcut-2-5-4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1772wmic csproduct get Name,UUID /valueC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
1820wmic os get SerialNumber,Caption,BuildNumber,Version /valueC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
1832C:\Windows\System32\cmd.exe /c wmic os get SerialNumber,Caption,BuildNumber,Version /valueC:\Windows\System32\cmd.exe—capcut-2-5-4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2300C:\Windows\System32\cmd.exe /c wmic nicconfig get DefaultIPGateway,macaddressC:\Windows\System32\cmd.exe—capcut-2-5-4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2384wmic nicconfig get DefaultIPGateway,macaddressC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
Total events
1 239
Read events
1 239
Write events
0
Delete events
0

Modification events

No data
Executable files
5
Suspicious files
1
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
2420capcut-2-5-4.exeC:\Users\admin\AppData\Local\Temp\nslFD8C.tmp\deviceregister_shared.dllexecutable
MD5:8BAAAEACB97679FB495E1C4F902F0A68
SHA256:7C2A74C4BE8D524A121E78E763C05C7B5CB58B524119AC8897C493E717A1D42A
2420capcut-2-5-4.exeC:\Users\admin\AppData\Local\Temp\nslFD8C.tmp\res.zipcompressed
MD5:071F2613BF3C06DF596C1936CFB0AAE5
SHA256:27B0A914674E640B817FE33CF64DD45B538369324A0A82CC92E40E6EF37B1B7F
2420capcut-2-5-4.exeC:\Users\admin\AppData\Local\Temp\nslFD8C.tmp\System.dllexecutable
MD5:0D7AD4F45DC6F5AA87F606D0331C6901
SHA256:3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
2420capcut-2-5-4.exeC:\Users\admin\AppData\Local\Temp\automatic_scaling_en.pngimage
MD5:F55D2B8FDFD4F476C0D4829FB663C69B
SHA256:6EB8B5F62E6763598C2FA9D3182F2D091E6247D88D51475EE4694B76722205EB
2420capcut-2-5-4.exeC:\Users\admin\AppData\Local\Temp\keyframe_en.pngimage
MD5:950E97619B630F384CB2EC5C8DD271C2
SHA256:620CFFEECF59C90DB73B0CD81F8F4378AEAD22AF98791111EEE877A07344DC55
2420capcut-2-5-4.exeC:\Users\admin\AppData\Local\Temp\visual_effects_en.pngimage
MD5:8EA92C4B9D936D485757D19391F45043
SHA256:3A5E1EF48BD852386D5B155306F6B4098B53242C282B9BC54A2C2203301D90BA
2420capcut-2-5-4.exeC:\Users\admin\AppData\Local\Temp\text_style_en.pngimage
MD5:03680B27E2CD41C23DDA448C1EE7B1BB
SHA256:06599F52F75C8E9F3B0A1476CAA97AB7BB0D61DF6A6FEBFB8CCE14706AF64E6B
2420capcut-2-5-4.exeC:\Users\admin\AppData\Local\Temp\nslFD8C.tmp\shell_downloader.dllexecutable
MD5:30C4AA9356D60D2039ED6BFB7850C4C1
SHA256:0C4ABB66D9A69C80CFAA0EB3C988D4DC40D989843A87E95ED3CC6E75DAE31559
2420capcut-2-5-4.exeC:\Users\admin\AppData\Local\Temp\chroma_keying_en.pngimage
MD5:42FEAD072026913A69E7C96BAC8456B0
SHA256:FC330E6CFE8B356B214CC5FFD3A7B8E88618373BE46A763DA205AD6228788A38
2420capcut-2-5-4.exeC:\Users\admin\AppData\Local\Temp\water_world_en.pngimage
MD5:601BBE214313CA48CA8F333161AC62AF
SHA256:56A9920B94732C54604A6AB3CE0072D30E0EB1A2F4F835661FECBC0C448D8965
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
23
DNS requests
9
Threats
2

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2420
capcut-2-5-4.exe
193.108.153.6:443
maliva-mcs.byteoversea.com
Akamai International B.V.
DE
unknown
2420
capcut-2-5-4.exe
2.19.96.202:443
editor-api-sg.capcut.com
Akamai International B.V.
DE
unknown
2420
capcut-2-5-4.exe
193.108.153.17:443
lf16-capcut.faceulv.com
Akamai International B.V.
DE
unknown
2420
capcut-2-5-4.exe
23.53.41.99:443
editor-api.capcutapi.com
Akamai International B.V.
DE
unknown
2420
capcut-2-5-4.exe
193.108.153.9:443
maliva-mcs.byteoversea.com
Akamai International B.V.
DE
unknown
2420
capcut-2-5-4.exe
193.108.153.21:443
sf16-va.tiktokcdn.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
editor-api-sg.capcut.com
  • 2.19.96.202
  • 2.19.96.248
unknown
maliva-mcs.byteoversea.com
  • 193.108.153.6
  • 193.108.153.7
  • 193.108.153.13
  • 193.108.153.9
  • 193.108.153.11
  • 193.108.153.5
  • 193.108.153.8
  • 193.108.153.10
  • 193.108.153.12
whitelisted
lf16-capcut.faceulv.com
  • 193.108.153.17
  • 193.108.153.8
unknown
editor-api.capcutapi.com
  • 23.53.41.99
  • 23.53.41.89
unknown
sgali-mcs.byteoversea.com
  • 193.108.153.9
  • 193.108.153.10
  • 193.108.153.8
  • 193.108.153.6
  • 193.108.153.29
  • 193.108.153.5
  • 193.108.153.27
  • 193.108.153.4
  • 193.108.153.7
whitelisted
sf16-va.tiktokcdn.com
  • 193.108.153.21
  • 193.108.153.14
whitelisted

Threats

Found threats are available for the paid subscriptions
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
capcut-2-5-4.exe