Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20230621-en -
resource tags
arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system -
submitted
27-06-2023 08:00
Static task
static1
Behavioral task
behavioral1
Sample
CapCut_2_2_0_491_capcutpc_0.msi
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
CapCut_2_2_0_491_capcutpc_0.msi
Resource
win10v2004-20230621-en
General
-
Target
CapCut_2_2_0_491_capcutpc_0.msi
-
Size
880KB
-
MD5
9119e1089119e0714fe06e239944faef
-
SHA1
86f8b24dfcfb1a4cbf373c41ef55427d7ca3ecdc
-
SHA256
b0f32d577b677e6793d77b53148bb4df5ef2f9f1ce29cc76548f80705deacd35
-
SHA512
c445bfc2613c647e2c91e2d85f484e583223009c5b02858495ea4cec96b08d6ee8e5e21436ab46b04d742c8c90e01a176b001d5d628fb84303cc49f8774508d0
-
SSDEEP
12288:qurWV30ISQvKKwR5GAauHX4qih45ggXnotXs8cAYc:qug30IlvKKwc44q55ggXotc8cA
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 2 1716 msiexec.exe 5 1336 msiexec.exe -
Loads dropped DLL 8 IoCs
pid Process 1388 MsiExec.exe 1388 MsiExec.exe 1388 MsiExec.exe 1388 MsiExec.exe 1388 MsiExec.exe 1152 MsiExec.exe 1388 MsiExec.exe 1388 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe -
Drops file in Program Files directory 11 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeWebView\nmmhkkegccagdldgiimedpiccmgmiedagg4\icons\32.png msiexec.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\nmmhkkegccagdldgiimedpiccmgmiedagg4\popup.js msiexec.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\setup.bat msiexec.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\nmmhkkegccagdldgiimedpiccmgmiedagg4\content-script.js msiexec.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\nmmhkkegccagdldgiimedpiccmgmiedagg4\icons\16.png msiexec.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\nmmhkkegccagdldgiimedpiccmgmiedagg4\icons\128.png msiexec.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\nmmhkkegccagdldgiimedpiccmgmiedagg4\icons\48.png msiexec.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\nmmhkkegccagdldgiimedpiccmgmiedagg4\manifest.json msiexec.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\nmmhkkegccagdldgiimedpiccmgmiedagg4\background.html msiexec.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\nmmhkkegccagdldgiimedpiccmgmiedagg4\background.js msiexec.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\nmmhkkegccagdldgiimedpiccmgmiedagg4\home.html msiexec.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI4A6E.tmp msiexec.exe File created C:\Windows\Installer\6e3ca7.msi msiexec.exe File opened for modification C:\Windows\Installer\6e3ca4.msi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\6e3ca4.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI413A.tmp msiexec.exe File created C:\Windows\Installer\6e3ca5.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\6e3ca5.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 288 timeout.exe -
Kills process with taskkill 2 IoCs
pid Process 1952 taskkill.exe 2028 taskkill.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe -
Modifies registry class 23 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EE59E962B56D8BB4DBEEC219F840A3C5\MainFeature msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D67D65DC055391D46A49369003BD40F3 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE59E962B56D8BB4DBEEC219F840A3C5\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE59E962B56D8BB4DBEEC219F840A3C5\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE59E962B56D8BB4DBEEC219F840A3C5\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE59E962B56D8BB4DBEEC219F840A3C5\ProductName = "Google Bard AI" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE59E962B56D8BB4DBEEC219F840A3C5\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE59E962B56D8BB4DBEEC219F840A3C5\AuthorizedLUAApp = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE59E962B56D8BB4DBEEC219F840A3C5\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE59E962B56D8BB4DBEEC219F840A3C5\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D67D65DC055391D46A49369003BD40F3\EE59E962B56D8BB4DBEEC219F840A3C5 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE59E962B56D8BB4DBEEC219F840A3C5\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE59E962B56D8BB4DBEEC219F840A3C5\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EE59E962B56D8BB4DBEEC219F840A3C5 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE59E962B56D8BB4DBEEC219F840A3C5\PackageCode = "22535061DF5BE304BA4EA915223348FB" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE59E962B56D8BB4DBEEC219F840A3C5\Version = "33554433" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE59E962B56D8BB4DBEEC219F840A3C5\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE59E962B56D8BB4DBEEC219F840A3C5\SourceList\PackageName = "CapCut_2_2_0_491_capcutpc_0.msi" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE59E962B56D8BB4DBEEC219F840A3C5\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE59E962B56D8BB4DBEEC219F840A3C5\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE59E962B56D8BB4DBEEC219F840A3C5 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE59E962B56D8BB4DBEEC219F840A3C5\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE59E962B56D8BB4DBEEC219F840A3C5\InstanceType = "0" msiexec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1336 msiexec.exe 1336 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1716 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1716 msiexec.exe Token: SeIncreaseQuotaPrivilege 1716 msiexec.exe Token: SeRestorePrivilege 1336 msiexec.exe Token: SeTakeOwnershipPrivilege 1336 msiexec.exe Token: SeSecurityPrivilege 1336 msiexec.exe Token: SeCreateTokenPrivilege 1716 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1716 msiexec.exe Token: SeLockMemoryPrivilege 1716 msiexec.exe Token: SeIncreaseQuotaPrivilege 1716 msiexec.exe Token: SeMachineAccountPrivilege 1716 msiexec.exe Token: SeTcbPrivilege 1716 msiexec.exe Token: SeSecurityPrivilege 1716 msiexec.exe Token: SeTakeOwnershipPrivilege 1716 msiexec.exe Token: SeLoadDriverPrivilege 1716 msiexec.exe Token: SeSystemProfilePrivilege 1716 msiexec.exe Token: SeSystemtimePrivilege 1716 msiexec.exe Token: SeProfSingleProcessPrivilege 1716 msiexec.exe Token: SeIncBasePriorityPrivilege 1716 msiexec.exe Token: SeCreatePagefilePrivilege 1716 msiexec.exe Token: SeCreatePermanentPrivilege 1716 msiexec.exe Token: SeBackupPrivilege 1716 msiexec.exe Token: SeRestorePrivilege 1716 msiexec.exe Token: SeShutdownPrivilege 1716 msiexec.exe Token: SeDebugPrivilege 1716 msiexec.exe Token: SeAuditPrivilege 1716 msiexec.exe Token: SeSystemEnvironmentPrivilege 1716 msiexec.exe Token: SeChangeNotifyPrivilege 1716 msiexec.exe Token: SeRemoteShutdownPrivilege 1716 msiexec.exe Token: SeUndockPrivilege 1716 msiexec.exe Token: SeSyncAgentPrivilege 1716 msiexec.exe Token: SeEnableDelegationPrivilege 1716 msiexec.exe Token: SeManageVolumePrivilege 1716 msiexec.exe Token: SeImpersonatePrivilege 1716 msiexec.exe Token: SeCreateGlobalPrivilege 1716 msiexec.exe Token: SeCreateTokenPrivilege 1716 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1716 msiexec.exe Token: SeLockMemoryPrivilege 1716 msiexec.exe Token: SeIncreaseQuotaPrivilege 1716 msiexec.exe Token: SeMachineAccountPrivilege 1716 msiexec.exe Token: SeTcbPrivilege 1716 msiexec.exe Token: SeSecurityPrivilege 1716 msiexec.exe Token: SeTakeOwnershipPrivilege 1716 msiexec.exe Token: SeLoadDriverPrivilege 1716 msiexec.exe Token: SeSystemProfilePrivilege 1716 msiexec.exe Token: SeSystemtimePrivilege 1716 msiexec.exe Token: SeProfSingleProcessPrivilege 1716 msiexec.exe Token: SeIncBasePriorityPrivilege 1716 msiexec.exe Token: SeCreatePagefilePrivilege 1716 msiexec.exe Token: SeCreatePermanentPrivilege 1716 msiexec.exe Token: SeBackupPrivilege 1716 msiexec.exe Token: SeRestorePrivilege 1716 msiexec.exe Token: SeShutdownPrivilege 1716 msiexec.exe Token: SeDebugPrivilege 1716 msiexec.exe Token: SeAuditPrivilege 1716 msiexec.exe Token: SeSystemEnvironmentPrivilege 1716 msiexec.exe Token: SeChangeNotifyPrivilege 1716 msiexec.exe Token: SeRemoteShutdownPrivilege 1716 msiexec.exe Token: SeUndockPrivilege 1716 msiexec.exe Token: SeSyncAgentPrivilege 1716 msiexec.exe Token: SeEnableDelegationPrivilege 1716 msiexec.exe Token: SeManageVolumePrivilege 1716 msiexec.exe Token: SeImpersonatePrivilege 1716 msiexec.exe Token: SeCreateGlobalPrivilege 1716 msiexec.exe Token: SeCreateTokenPrivilege 1716 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1716 msiexec.exe 1716 msiexec.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 1336 wrote to memory of 1388 1336 msiexec.exe 29 PID 1336 wrote to memory of 1388 1336 msiexec.exe 29 PID 1336 wrote to memory of 1388 1336 msiexec.exe 29 PID 1336 wrote to memory of 1388 1336 msiexec.exe 29 PID 1336 wrote to memory of 1388 1336 msiexec.exe 29 PID 1336 wrote to memory of 1388 1336 msiexec.exe 29 PID 1336 wrote to memory of 1388 1336 msiexec.exe 29 PID 1336 wrote to memory of 1152 1336 msiexec.exe 33 PID 1336 wrote to memory of 1152 1336 msiexec.exe 33 PID 1336 wrote to memory of 1152 1336 msiexec.exe 33 PID 1336 wrote to memory of 1152 1336 msiexec.exe 33 PID 1336 wrote to memory of 1152 1336 msiexec.exe 33 PID 1336 wrote to memory of 1152 1336 msiexec.exe 33 PID 1336 wrote to memory of 1152 1336 msiexec.exe 33 PID 2024 wrote to memory of 1952 2024 cmd.exe 37 PID 2024 wrote to memory of 1952 2024 cmd.exe 37 PID 2024 wrote to memory of 1952 2024 cmd.exe 37 PID 2024 wrote to memory of 2028 2024 cmd.exe 39 PID 2024 wrote to memory of 2028 2024 cmd.exe 39 PID 2024 wrote to memory of 2028 2024 cmd.exe 39 PID 2024 wrote to memory of 288 2024 cmd.exe 40 PID 2024 wrote to memory of 288 2024 cmd.exe 40 PID 2024 wrote to memory of 288 2024 cmd.exe 40 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\CapCut_2_2_0_491_capcutpc_0.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1716
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding CEDFB2A7DD89D4F12905D93433D0A317 C2⤵
- Loads dropped DLL
PID:1388
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1B865312E1E2158ED9DC9F0E32ABB16E2⤵
- Loads dropped DLL
PID:1152
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:1948
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003D8" "00000000000004A4"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1552
-
C:\Windows\system32\cmd.execmd /c ""C:\Program Files (x86)\Microsoft\EdgeWebView\setup.bat" "1⤵
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe2⤵
- Kills process with taskkill
PID:1952
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedge.exe2⤵
- Kills process with taskkill
PID:2028
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:288
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD59d995446558b68e157d3003a5e94a56b
SHA107e3b69e4b2cf83acf0796b7c510bad1fc7e2b06
SHA256c4d6097345c2d0381a2dfb9d26b4b12c73ac2cb9d776df08d853f2860ea7d61b
SHA51288ffc24d1382dcfc4e9e7ff5fe9b5e25560174bc979d7779e58a4d488212b3e8a3c066c85ad511c65ea72637f94c1dae0ec9a77550db3db4cc4f26162b744c72
-
Filesize
279B
MD513c4c845b001ddbad9ef3275a41924a7
SHA17c3600b54d2ed584f5f9e70299984b233b29d770
SHA256a2a75f92696af48a34e089d0195acbb2ebc67146e6bc8a92ee0c577aa61fcf53
SHA5124d330facc1c53af1c0912a9419f4ac4bb8a2990b7c9344f1a265cb984a3714b27adbe0facb1f1e4f296c1962bf5dcab5064105d69658ab7145e5dd239ceeebb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD518c29e3a021874964e09091df9593c32
SHA1fadd3121fdd1a21ae3064a4c09291b6dc57c4bd3
SHA256448cda1afc242d827153feca29584a4bca748d7182e5f471fc8b5c0af20b2fdd
SHA512c3770014667ef25beb7bb9e0fe1c9b5411f1b01af49085c6473a0386689f3056e57ce6a024262e5ff8a95c2ff17959a003acc672198f4b25094a1af1cbf510db
-
Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
Filesize
555KB
MD54d436978faaef6c90ad5b208102fa0b4
SHA108930ae826c426ebfc3f96c324319bd9384472c0
SHA2566cb47f74d25952c087bd9f04eea54e0c0e80cc9e6b052f2bdc1d8a328ac955be
SHA512692073337de46817d6deac61b462d22cfc8f5126936f3858bca938c3bfd205ea2ae55b89589bc61453bfe826feec8b4e251d4d5bdc68c9149a18ceacd7e1f153
-
Filesize
555KB
MD54d436978faaef6c90ad5b208102fa0b4
SHA108930ae826c426ebfc3f96c324319bd9384472c0
SHA2566cb47f74d25952c087bd9f04eea54e0c0e80cc9e6b052f2bdc1d8a328ac955be
SHA512692073337de46817d6deac61b462d22cfc8f5126936f3858bca938c3bfd205ea2ae55b89589bc61453bfe826feec8b4e251d4d5bdc68c9149a18ceacd7e1f153
-
Filesize
555KB
MD54d436978faaef6c90ad5b208102fa0b4
SHA108930ae826c426ebfc3f96c324319bd9384472c0
SHA2566cb47f74d25952c087bd9f04eea54e0c0e80cc9e6b052f2bdc1d8a328ac955be
SHA512692073337de46817d6deac61b462d22cfc8f5126936f3858bca938c3bfd205ea2ae55b89589bc61453bfe826feec8b4e251d4d5bdc68c9149a18ceacd7e1f153
-
Filesize
555KB
MD54d436978faaef6c90ad5b208102fa0b4
SHA108930ae826c426ebfc3f96c324319bd9384472c0
SHA2566cb47f74d25952c087bd9f04eea54e0c0e80cc9e6b052f2bdc1d8a328ac955be
SHA512692073337de46817d6deac61b462d22cfc8f5126936f3858bca938c3bfd205ea2ae55b89589bc61453bfe826feec8b4e251d4d5bdc68c9149a18ceacd7e1f153
-
Filesize
555KB
MD54d436978faaef6c90ad5b208102fa0b4
SHA108930ae826c426ebfc3f96c324319bd9384472c0
SHA2566cb47f74d25952c087bd9f04eea54e0c0e80cc9e6b052f2bdc1d8a328ac955be
SHA512692073337de46817d6deac61b462d22cfc8f5126936f3858bca938c3bfd205ea2ae55b89589bc61453bfe826feec8b4e251d4d5bdc68c9149a18ceacd7e1f153
-
Filesize
555KB
MD54d436978faaef6c90ad5b208102fa0b4
SHA108930ae826c426ebfc3f96c324319bd9384472c0
SHA2566cb47f74d25952c087bd9f04eea54e0c0e80cc9e6b052f2bdc1d8a328ac955be
SHA512692073337de46817d6deac61b462d22cfc8f5126936f3858bca938c3bfd205ea2ae55b89589bc61453bfe826feec8b4e251d4d5bdc68c9149a18ceacd7e1f153
-
Filesize
555KB
MD54d436978faaef6c90ad5b208102fa0b4
SHA108930ae826c426ebfc3f96c324319bd9384472c0
SHA2566cb47f74d25952c087bd9f04eea54e0c0e80cc9e6b052f2bdc1d8a328ac955be
SHA512692073337de46817d6deac61b462d22cfc8f5126936f3858bca938c3bfd205ea2ae55b89589bc61453bfe826feec8b4e251d4d5bdc68c9149a18ceacd7e1f153
-
Filesize
555KB
MD54d436978faaef6c90ad5b208102fa0b4
SHA108930ae826c426ebfc3f96c324319bd9384472c0
SHA2566cb47f74d25952c087bd9f04eea54e0c0e80cc9e6b052f2bdc1d8a328ac955be
SHA512692073337de46817d6deac61b462d22cfc8f5126936f3858bca938c3bfd205ea2ae55b89589bc61453bfe826feec8b4e251d4d5bdc68c9149a18ceacd7e1f153
-
Filesize
164KB
MD54ff65ad929cd9a367680e0e5b1c08166
SHA1c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA256c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
SHA512f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27
-
Filesize
880KB
MD59119e1089119e0714fe06e239944faef
SHA186f8b24dfcfb1a4cbf373c41ef55427d7ca3ecdc
SHA256b0f32d577b677e6793d77b53148bb4df5ef2f9f1ce29cc76548f80705deacd35
SHA512c445bfc2613c647e2c91e2d85f484e583223009c5b02858495ea4cec96b08d6ee8e5e21436ab46b04d742c8c90e01a176b001d5d628fb84303cc49f8774508d0
-
Filesize
555KB
MD54d436978faaef6c90ad5b208102fa0b4
SHA108930ae826c426ebfc3f96c324319bd9384472c0
SHA2566cb47f74d25952c087bd9f04eea54e0c0e80cc9e6b052f2bdc1d8a328ac955be
SHA512692073337de46817d6deac61b462d22cfc8f5126936f3858bca938c3bfd205ea2ae55b89589bc61453bfe826feec8b4e251d4d5bdc68c9149a18ceacd7e1f153
-
Filesize
555KB
MD54d436978faaef6c90ad5b208102fa0b4
SHA108930ae826c426ebfc3f96c324319bd9384472c0
SHA2566cb47f74d25952c087bd9f04eea54e0c0e80cc9e6b052f2bdc1d8a328ac955be
SHA512692073337de46817d6deac61b462d22cfc8f5126936f3858bca938c3bfd205ea2ae55b89589bc61453bfe826feec8b4e251d4d5bdc68c9149a18ceacd7e1f153
-
Filesize
555KB
MD54d436978faaef6c90ad5b208102fa0b4
SHA108930ae826c426ebfc3f96c324319bd9384472c0
SHA2566cb47f74d25952c087bd9f04eea54e0c0e80cc9e6b052f2bdc1d8a328ac955be
SHA512692073337de46817d6deac61b462d22cfc8f5126936f3858bca938c3bfd205ea2ae55b89589bc61453bfe826feec8b4e251d4d5bdc68c9149a18ceacd7e1f153
-
Filesize
555KB
MD54d436978faaef6c90ad5b208102fa0b4
SHA108930ae826c426ebfc3f96c324319bd9384472c0
SHA2566cb47f74d25952c087bd9f04eea54e0c0e80cc9e6b052f2bdc1d8a328ac955be
SHA512692073337de46817d6deac61b462d22cfc8f5126936f3858bca938c3bfd205ea2ae55b89589bc61453bfe826feec8b4e251d4d5bdc68c9149a18ceacd7e1f153
-
Filesize
555KB
MD54d436978faaef6c90ad5b208102fa0b4
SHA108930ae826c426ebfc3f96c324319bd9384472c0
SHA2566cb47f74d25952c087bd9f04eea54e0c0e80cc9e6b052f2bdc1d8a328ac955be
SHA512692073337de46817d6deac61b462d22cfc8f5126936f3858bca938c3bfd205ea2ae55b89589bc61453bfe826feec8b4e251d4d5bdc68c9149a18ceacd7e1f153
-
Filesize
555KB
MD54d436978faaef6c90ad5b208102fa0b4
SHA108930ae826c426ebfc3f96c324319bd9384472c0
SHA2566cb47f74d25952c087bd9f04eea54e0c0e80cc9e6b052f2bdc1d8a328ac955be
SHA512692073337de46817d6deac61b462d22cfc8f5126936f3858bca938c3bfd205ea2ae55b89589bc61453bfe826feec8b4e251d4d5bdc68c9149a18ceacd7e1f153
-
Filesize
555KB
MD54d436978faaef6c90ad5b208102fa0b4
SHA108930ae826c426ebfc3f96c324319bd9384472c0
SHA2566cb47f74d25952c087bd9f04eea54e0c0e80cc9e6b052f2bdc1d8a328ac955be
SHA512692073337de46817d6deac61b462d22cfc8f5126936f3858bca938c3bfd205ea2ae55b89589bc61453bfe826feec8b4e251d4d5bdc68c9149a18ceacd7e1f153
-
Filesize
555KB
MD54d436978faaef6c90ad5b208102fa0b4
SHA108930ae826c426ebfc3f96c324319bd9384472c0
SHA2566cb47f74d25952c087bd9f04eea54e0c0e80cc9e6b052f2bdc1d8a328ac955be
SHA512692073337de46817d6deac61b462d22cfc8f5126936f3858bca938c3bfd205ea2ae55b89589bc61453bfe826feec8b4e251d4d5bdc68c9149a18ceacd7e1f153
-
Filesize
555KB
MD54d436978faaef6c90ad5b208102fa0b4
SHA108930ae826c426ebfc3f96c324319bd9384472c0
SHA2566cb47f74d25952c087bd9f04eea54e0c0e80cc9e6b052f2bdc1d8a328ac955be
SHA512692073337de46817d6deac61b462d22cfc8f5126936f3858bca938c3bfd205ea2ae55b89589bc61453bfe826feec8b4e251d4d5bdc68c9149a18ceacd7e1f153