File name:

capcut_capcutpc_0_1.2.6_installer.exe

Full analysis: https://app.any.run/tasks/1c3f7f74-018d-49da-b41b-7853e6cc9863
Verdict: Malicious activity
Analysis date: August 30, 2024, 06:55:10
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

C91E097550EA6CCEDF592D8B83414E0D

SHA1:

021F3F26D86F98AF28DC987BAAD8714F64867207

SHA256:

4A9D815F284ADDA187982E2B24DA2BEAAD860739BC4B4CB1CF26408E7C221DD6

SSDEEP:

98304:hVb9nzGB0LtahqQP4CK+0TTdui7ej1EfTwb+4TA3SkFYInoeHaEfjhNkhooy7qsY:4Zotwoe

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • capcut_capcutpc_0_1.2.6_installer.exe (PID: 5732)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • capcut_capcutpc_0_1.2.6_installer.exe (PID: 5732)

    • Drops the executable file immediately after the start

      • capcut_capcutpc_0_1.2.6_installer.exe (PID: 5732)

    • The process creates files with name similar to system file names

      • capcut_capcutpc_0_1.2.6_installer.exe (PID: 5732)

    • Potential Corporate Privacy Violation

      • svchost.exe (PID: 2256)

  • INFO

    • Checks supported languages

      • capcut_capcutpc_0_1.2.6_installer.exe (PID: 5732)

    • Create files in a temporary directory

      • capcut_capcutpc_0_1.2.6_installer.exe (PID: 5732)

    • Reads the computer name

      • capcut_capcutpc_0_1.2.6_installer.exe (PID: 5732)

    • Creates files or folders in the user directory

      • capcut_capcutpc_0_1.2.6_installer.exe (PID: 5732)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:12:15 22:26:14+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 473088
UninitializedDataSize: 16384
EntryPoint: 0x338f
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
124
Monitored processes
3
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start capcut_capcutpc_0_1.2.6_installer.exe svchost.exe capcut_capcutpc_0_1.2.6_installer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2256C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3964"C:\Users\admin\Desktop\capcut_capcutpc_0_1.2.6_installer.exe" C:\Users\admin\Desktop\capcut_capcutpc_0_1.2.6_installer.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\capcut_capcutpc_0_1.2.6_installer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
5732"C:\Users\admin\Desktop\capcut_capcutpc_0_1.2.6_installer.exe" C:\Users\admin\Desktop\capcut_capcutpc_0_1.2.6_installer.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\desktop\capcut_capcutpc_0_1.2.6_installer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
728
Read events
728
Write events
0
Delete events
0

Modification events

No data
Executable files
5
Suspicious files
1
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
5732capcut_capcutpc_0_1.2.6_installer.exeC:\Users\admin\AppData\Local\Temp\nssAC85.tmp\downloader_nsis_plugin.dllexecutable
MD5:F181413906A465FD0DD68CC4A3D98803
SHA256:E28FF7B8FC4B1EB2D1F394CE15DE2FC031CDA58DB645038C8C07581C31E79DDA
5732capcut_capcutpc_0_1.2.6_installer.exeC:\Users\admin\AppData\Local\Temp\nssAC85.tmp\shell_downloader.dllexecutable
MD5:C052C0A2ED833D924B7799625413AC1C
SHA256:098972CF9DDC9D574130E025A252A99B278DE9CC0AE700ACFB8C935C24EB1172
5732capcut_capcutpc_0_1.2.6_installer.exeC:\Users\admin\AppData\Local\Temp\automatic_scaling_en.pngimage
MD5:F55D2B8FDFD4F476C0D4829FB663C69B
SHA256:6EB8B5F62E6763598C2FA9D3182F2D091E6247D88D51475EE4694B76722205EB
5732capcut_capcutpc_0_1.2.6_installer.exeC:\Users\admin\AppData\Local\Temp\intelligent_subtitles_en.pngimage
MD5:C51D1976F87828C0DCA46EF4D0243614
SHA256:463A0C124A0925FBB341855685B2B58525B100108D271679F2F95398D5F6C618
5732capcut_capcutpc_0_1.2.6_installer.exeC:\Users\admin\AppData\Local\Temp\nssAC85.tmp\res.zipcompressed
MD5:23E2490706D024BD70CCB906EBF0B62D
SHA256:FBB054F0880B81DE92BE6A9500C6757F4E1A3E8E335E31821D76B49DE8375C8C
5732capcut_capcutpc_0_1.2.6_installer.exeC:\Users\admin\AppData\Local\Temp\nssAC85.tmp\deviceregister_shared.dllexecutable
MD5:8BAAAEACB97679FB495E1C4F902F0A68
SHA256:7C2A74C4BE8D524A121E78E763C05C7B5CB58B524119AC8897C493E717A1D42A
5732capcut_capcutpc_0_1.2.6_installer.exeC:\Users\admin\AppData\Local\Temp\chroma_keying_en.pngimage
MD5:42FEAD072026913A69E7C96BAC8456B0
SHA256:FC330E6CFE8B356B214CC5FFD3A7B8E88618373BE46A763DA205AD6228788A38
5732capcut_capcutpc_0_1.2.6_installer.exeC:\Users\admin\AppData\Local\Temp\nssAC85.tmp\System.dllexecutable
MD5:0D7AD4F45DC6F5AA87F606D0331C6901
SHA256:3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
5732capcut_capcutpc_0_1.2.6_installer.exeC:\Users\admin\AppData\Local\Temp\nssAC85.tmp\BgWorker.dllexecutable
MD5:33EC04738007E665059CF40BC0F0C22B
SHA256:50F735AB8F3473423E6873D628150BBC0777BE7B4F6405247CDDF22BB00FB6BE
5732capcut_capcutpc_0_1.2.6_installer.exeC:\Users\admin\AppData\Local\Temp\speech_synthesis_en.pngimage
MD5:7E0FCA9AFBA9A7FBC15D378B8E550BAA
SHA256:49D5FA943BCEC39D1244E6C69801F20B5F9D01FC89D6F260236A3C1255B5FC98
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
21
TCP/UDP connections
35
DNS requests
13
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
—
2.16.10.168:443
https://lf16-capcut.faceulv.com/obj/capcutpc-packages-us/packages/CapCut_4_3_0_1694_capcutpc_0_creatortool.exe
unknown
—
—
—
—
—
GET
—
2.16.10.168:443
https://lf16-capcut.faceulv.com/obj/capcutpc-packages-us/packages/CapCut_4_3_0_1694_capcutpc_0_creatortool.exe
unknown
—
—
—
—
—
GET
200
104.126.37.137:443
https://editor-api-sg.capcut.com/service/settings/v3/?app=1&aid=562354&arch_info=x86_64&device_id=2182455761&device_platform=windows&from_aid=562354&from_channel=capcutpc_0&from_version=0.0.0&local_info=en_US&version_code=0.0.0
unknown
binary
2.04 Kb
—
—
—
GET
—
2.16.10.168:443
https://lf16-capcut.faceulv.com/obj/capcutpc-packages-us/packages/CapCut_4_3_0_1694_capcutpc_0_creatortool.exe
unknown
—
—
—
—
—
GET
200
23.48.23.159:443
https://sf16-va.tiktokcdn.com/obj/eden-va2/JW-abJwhJ/ljhwZthlaukjlkulzlp/installer/pic/v1/keyframe/keyframe_en.png
unknown
image
593 Kb
—
—
—
POST
200
23.48.23.182:443
https://sgali-mcs.byteoversea.com/v1/json
unknown
binary
14 b
—
—
—
GET
200
23.48.23.183:443
https://sf16-va.tiktokcdn.com/obj/eden-va2/JW-abJwhJ/ljhwZthlaukjlkulzlp/installer/pic/v1/speech_synthesis/speech_synthesis_en.png
unknown
image
457 Kb
—
—
—
POST
200
23.48.23.194:443
https://maliva-mcs.byteoversea.com/v1/json
unknown
binary
14 b
—
—
—
GET
200
23.48.23.159:443
https://sf16-va.tiktokcdn.com/obj/eden-va2/JW-abJwhJ/ljhwZthlaukjlkulzlp/installer/pic/v1/visual_effects/visual_effects_en.png
unknown
image
494 Kb
—
—
—
GET
200
23.48.23.183:443
https://sf16-va.tiktokcdn.com/obj/eden-va2/JW-abJwhJ/ljhwZthlaukjlkulzlp/installer/pic/v1/automatic_scaling/automatic_scaling_en.png
unknown
image
597 Kb
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:138
—
—
—
whitelisted
6364
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6408
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5732
capcut_capcutpc_0_1.2.6_installer.exe
23.48.23.193:443
maliva-mcs.byteoversea.com
Akamai International B.V.
DE
whitelisted
5732
capcut_capcutpc_0_1.2.6_installer.exe
104.126.37.147:443
editor-api-sg.capcut.com
Akamai International B.V.
DE
unknown
2120
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
6364
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4324
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
  • 51.104.136.2
whitelisted
google.com
  • 142.250.185.206
whitelisted
editor-api-sg.capcut.com
  • 104.126.37.147
  • 104.126.37.137
unknown
maliva-mcs.byteoversea.com
  • 23.48.23.193
  • 23.48.23.132
  • 23.48.23.188
  • 23.48.23.192
  • 23.48.23.191
  • 23.48.23.195
  • 23.48.23.190
  • 23.48.23.189
  • 23.48.23.194
  • 23.48.23.182
  • 23.48.23.181
  • 23.48.23.180
  • 23.48.23.178
  • 23.48.23.185
  • 23.48.23.183
  • 23.48.23.179
  • 23.48.23.184
  • 23.48.23.177
  • 23.48.23.143
  • 23.48.23.140
  • 23.48.23.135
  • 23.48.23.139
  • 23.48.23.137
  • 23.48.23.138
  • 23.48.23.142
  • 23.48.23.141
  • 23.48.23.134
whitelisted
sf16-va.tiktokcdn.com
  • 23.48.23.183
  • 23.48.23.159
whitelisted
sgali-mcs.byteoversea.com
  • 23.48.23.182
  • 23.48.23.181
  • 23.48.23.180
  • 23.48.23.178
  • 23.48.23.185
  • 23.48.23.183
  • 23.48.23.179
  • 23.48.23.184
  • 23.48.23.177
whitelisted
lf16-capcut.faceulv.com
  • 2.16.10.175
  • 2.16.10.168
unknown

Threats

Found threats are available for the paid subscriptions
4 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
capcut_capcutpc_0_1.2.6_installer.exe