Malware analysis CapCut_7418895590240747525_installer.exe Malicious activity

Add for printing

File name:	CapCut_7418895590240747525_installer.exe
Full analysis:	https://app.any.run/tasks/5b06f81f-e062-420d-94a5-966d37354052
Verdict:	Malicious activity
Analysis date:	March 11, 2025, 15:26:50
OS:	Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:	C91E097550EA6CCEDF592D8B83414E0D
SHA1:	021F3F26D86F98AF28DC987BAAD8714F64867207
SHA256:	4A9D815F284ADDA187982E2B24DA2BEAAD860739BC4B4CB1CF26408E7C221DD6
SSDEEP:	98304:hVb9nzGB0LtahqQP4CK+0TTdui7ej1EfTwb+4TA3SkFYInoeHaEfjhNkhooy7qsY:4Zotwoe

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 300 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: 240 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
- The process creates files with name similar to system file names
  - CapCut_7418895590240747525_installer.exe (PID: 7452)
- Malware-specific behavior (creating "System.dll" in Temp)
  - CapCut_7418895590240747525_installer.exe (PID: 7452)
- Executable content was dropped or overwritten
  - CapCut_7418895590240747525_installer.exe (PID: 7452)
  - app_package_83419733db.exe (PID: 7956)
- There is functionality for taking screenshot (YARA)
  - CapCut_7418895590240747525_installer.exe (PID: 7452)
  - app_package_83419733db.exe (PID: 7956)
INFO
- Checks supported languages
  - CapCut_7418895590240747525_installer.exe (PID: 7452)
  - app_package_83419733db.exe (PID: 7956)
- The sample compiled with english language support
  - CapCut_7418895590240747525_installer.exe (PID: 7452)
- Create files in a temporary directory
  - CapCut_7418895590240747525_installer.exe (PID: 7452)
  - app_package_83419733db.exe (PID: 7956)
- Reads the computer name
  - CapCut_7418895590240747525_installer.exe (PID: 7452)
  - app_package_83419733db.exe (PID: 7956)
- Creates files or folders in the user directory
  - CapCut_7418895590240747525_installer.exe (PID: 7452)
  - app_package_83419733db.exe (PID: 7956)
- Reads the software policy settings
  - slui.exe (PID: 7692)
  - slui.exe (PID: 1628)
- Checks proxy server information
  - slui.exe (PID: 1628)
- Process checks whether UAC notifications are on
  - app_package_83419733db.exe (PID: 7956)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	Win32 Executable MS Visual C++ (generic) (67.4)
.dll	\|	Win32 Dynamic Link Library (generic) (14.2)
.exe	\|	Win32 Executable (generic) (9.7)
.exe	\|	Generic Win/DOS Executable (4.3)
.exe	\|	DOS Executable Generic (4.3)

EXIF

EXE

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2018:12:15 22:26:14+00:00
ImageFileCharacteristics:	No relocs, Executable, No line numbers, No symbols, 32-bit
PEType:	PE32
LinkerVersion:	6
CodeSize:	26624
InitializedDataSize:	473088
UninitializedDataSize:	16384
EntryPoint:	0x338f
OSVersion:	4
ImageVersion:	6
SubsystemVersion:	4
Subsystem:	Windows GUI

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

142

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

1628

C:\WINDOWS\System32\slui.exe -Embedding

C:\Windows\System32\slui.exe

svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Activation Client

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll

7404

"C:\Users\admin\AppData\Local\Temp\CapCut_7418895590240747525_installer.exe"

C:\Users\admin\AppData\Local\Temp\CapCut_7418895590240747525_installer.exe

—

explorer.exe

User:

admin

Integrity Level:

MEDIUM

Exit code:

3221226540

Modules

Images
c:\users\admin\appdata\local\temp\capcut_7418895590240747525_installer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll

7452

"C:\Users\admin\AppData\Local\Temp\CapCut_7418895590240747525_installer.exe"

C:\Users\admin\AppData\Local\Temp\CapCut_7418895590240747525_installer.exe

explorer.exe

User:

admin

Integrity Level:

HIGH

Modules

Images
c:\users\admin\appdata\local\temp\capcut_7418895590240747525_installer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll

7660

C:\WINDOWS\system32\SppExtComObj.exe -Embedding

C:\Windows\System32\SppExtComObj.Exe

—

svchost.exe

User:

NETWORK SERVICE

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

KMS Connection Broker

Exit code:

Version:

10.0.19041.3996 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll

7692

"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent

C:\Windows\System32\slui.exe

SppExtComObj.Exe

User:

NETWORK SERVICE

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Windows Activation Client

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll

7956

"C:\Users\admin\AppData\Local\app_shell_cache_562354\app_package_83419733db.exe" /s /create_desktop=1 /install_path="C:\Users\admin\AppData\Local\CapCut\Apps"

C:\Users\admin\AppData\Local\app_shell_cache_562354\app_package_83419733db.exe

CapCut_7418895590240747525_installer.exe

User:

admin

Company:

Bytedance Pte. Ltd.

Integrity Level:

HIGH

Description:

CapCut

Version:

5.7.0.2112

Modules

Images
c:\users\admin\appdata\local\app_shell_cache_562354\app_package_83419733db.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll

Add for printing

Total events

1 393

Read events

1 393

Write events

Delete events

Modification events

No data

Add for printing

Executable files

Suspicious files

1 202

Text files

1 006

Unknown types

Dropped files

PID	Process	Filename		Type
7452	CapCut_7418895590240747525_installer.exe	C:\Users\admin\AppData\Local\app_shell_cache_562354\app_package_83419733db.exe		—
		MD5:—	SHA256:—
7452	CapCut_7418895590240747525_installer.exe	C:\Users\admin\AppData\Local\Temp\nsrBAA8.tmp\shell_downloader.dll		executable
		MD5:C052C0A2ED833D924B7799625413AC1C	SHA256:098972CF9DDC9D574130E025A252A99B278DE9CC0AE700ACFB8C935C24EB1172
7452	CapCut_7418895590240747525_installer.exe	C:\Users\admin\AppData\Local\Temp\nsrBAA8.tmp\downloader_nsis_plugin.dll		executable
		MD5:F181413906A465FD0DD68CC4A3D98803	SHA256:E28FF7B8FC4B1EB2D1F394CE15DE2FC031CDA58DB645038C8C07581C31E79DDA
7452	CapCut_7418895590240747525_installer.exe	C:\Users\admin\AppData\Local\Temp\nsrBAA8.tmp\res.zip		compressed
		MD5:23E2490706D024BD70CCB906EBF0B62D	SHA256:FBB054F0880B81DE92BE6A9500C6757F4E1A3E8E335E31821D76B49DE8375C8C
7452	CapCut_7418895590240747525_installer.exe	C:\Users\admin\AppData\Local\Temp\intelligent_subtitles_en.png		image
		MD5:C51D1976F87828C0DCA46EF4D0243614	SHA256:463A0C124A0925FBB341855685B2B58525B100108D271679F2F95398D5F6C618
7452	CapCut_7418895590240747525_installer.exe	C:\Users\admin\AppData\Local\Temp\chroma_keying_en.png		image
		MD5:42FEAD072026913A69E7C96BAC8456B0	SHA256:FC330E6CFE8B356B214CC5FFD3A7B8E88618373BE46A763DA205AD6228788A38
7452	CapCut_7418895590240747525_installer.exe	C:\Users\admin\AppData\Local\Temp\visual_effects_en.png		image
		MD5:8EA92C4B9D936D485757D19391F45043	SHA256:3A5E1EF48BD852386D5B155306F6B4098B53242C282B9BC54A2C2203301D90BA
7452	CapCut_7418895590240747525_installer.exe	C:\Users\admin\AppData\Local\Temp\speech_synthesis_en.png		image
		MD5:7E0FCA9AFBA9A7FBC15D378B8E550BAA	SHA256:49D5FA943BCEC39D1244E6C69801F20B5F9D01FC89D6F260236A3C1255B5FC98
7452	CapCut_7418895590240747525_installer.exe	C:\Users\admin\AppData\Local\Temp\text_style_en.png		image
		MD5:03680B27E2CD41C23DDA448C1EE7B1BB	SHA256:06599F52F75C8E9F3B0A1476CAA97AB7BB0D61DF6A6FEBFB8CCE14706AF64E6B
7452	CapCut_7418895590240747525_installer.exe	C:\Users\admin\AppData\Local\Temp\keyframe_en.png		image
		MD5:950E97619B630F384CB2EC5C8DD271C2	SHA256:620CFFEECF59C90DB73B0CD81F8F4378AEAD22AF98791111EEE877A07344DC55

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
7796	backgroundTaskHost.exe	GET	200	184.30.131.245:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D	unknown	—	—	whitelisted
6544	svchost.exe	GET	200	184.30.131.245:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
5048	SIHClient.exe	GET	200	2.23.246.101:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl	unknown	—	—	whitelisted
5048	SIHClient.exe	GET	200	2.23.246.101:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
2104	svchost.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
—	—	192.168.100.255:137	—	—	—	whitelisted
—	—	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
7452	CapCut_7418895590240747525_installer.exe	72.247.154.91:443	maliva-mcs.byteoversea.com	Akamai International B.V.	DE	whitelisted
7452	CapCut_7418895590240747525_installer.exe	95.100.110.9:443	editor-api-sg.capcut.com	Akamai International B.V.	NL	unknown
7452	CapCut_7418895590240747525_installer.exe	2.16.202.115:443	sf16-va.tiktokcdn.com	Akamai International B.V.	NL	whitelisted
7452	CapCut_7418895590240747525_installer.exe	2.22.242.97:443	sgali-mcs.byteoversea.com	Akamai International B.V.	DE	whitelisted
7452	CapCut_7418895590240747525_installer.exe	2.16.202.65:443	lf16-capcut.faceulv.com	Akamai International B.V.	NL	unknown
6544	svchost.exe	20.190.159.4:443	login.live.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	20.73.194.208 51.124.78.146	whitelisted
google.com	142.250.186.46	whitelisted
editor-api-sg.capcut.com	95.100.110.9 95.100.110.18	unknown
maliva-mcs.byteoversea.com	72.247.154.91 72.247.154.90 72.247.154.97 72.247.154.96 72.247.154.88 72.247.154.9 72.247.154.99 72.247.154.89 72.247.154.98 23.53.42.50 23.53.42.43 23.53.42.16 23.53.42.9 23.53.42.40 23.53.42.65 23.53.42.10 23.53.42.25 23.53.41.249	whitelisted
sf16-va.tiktokcdn.com	2.16.202.115 95.101.54.138	whitelisted
sgali-mcs.byteoversea.com	2.22.242.97 2.22.242.225 2.22.242.128 2.22.242.226 2.22.242.139 2.22.242.146 2.22.242.144 2.22.242.129 2.22.242.90	whitelisted
lf16-capcut.faceulv.com	2.16.202.65 2.16.202.16	unknown
login.live.com	20.190.159.4 40.126.31.130 20.190.159.68 40.126.31.0 40.126.31.71 40.126.31.3 20.190.159.129 20.190.159.71	whitelisted
client.wns.windows.com	40.113.103.199	whitelisted
ocsp.digicert.com	184.30.131.245	whitelisted

Threats

No threats detected

Add for printing

No debug info

General Info

CapCut_7418895590240747525_installer.exe

C91E097550EA6CCEDF592D8B83414E0D

021F3F26D86F98AF28DC987BAAD8714F64867207

4A9D815F284ADDA187982E2B24DA2BEAAD860739BC4B4CB1CF26408E7C221DD6

98304:hVb9nzGB0LtahqQP4CK+0TTdui7ej1EfTwb+4TA3SkFYInoeHaEfjhNkhooy7qsY:4Zotwoe

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

The process creates files with name similar to system file names

Malware-specific behavior (creating "System.dll" in Temp)

Executable content was dropped or overwritten

There is functionality for taking screenshot (YARA)

INFO

Checks supported languages

The sample compiled with english language support

Create files in a temporary directory

Reads the computer name

Creates files or folders in the user directory

Reads the software policy settings

Checks proxy server information

Process checks whether UAC notifications are on

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings