Overview

overview

6

Static

static

3

CapCut_737...er.exe

windows7-x64

6

CapCut_737...er.exe

windows10-2004-x64

6

$PLUGINSDI...er.dll

windows7-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ed.dll

windows7-x64

3

$PLUGINSDI...ed.dll

windows10-2004-x64

3

$PLUGINSDI...in.dll

windows7-x64

3

$PLUGINSDI...in.dll

windows10-2004-x64

3

$PLUGINSDIR/res.zip

windows7-x64

1

$PLUGINSDIR/res.zip

windows10-2004-x64

1

app_warning_icon.png

windows7-x64

3

app_warning_icon.png

windows10-2004-x64

3

banner_bk.jpg

windows7-x64

3

banner_bk.jpg

windows10-2004-x64

3

btn_dark_1...le.png

windows7-x64

3

btn_dark_1...le.png

windows10-2004-x64

3

btn_dark_1_hover.png

windows7-x64

3

btn_dark_1_hover.png

windows10-2004-x64

3

btn_dark_1_normal.png

windows7-x64

3

btn_dark_1_normal.png

windows10-2004-x64

3

btn_dark_1_pushed.png

windows7-x64

3

btn_dark_1_pushed.png

windows10-2004-x64

3

btn_dir_disable.png

windows7-x64

3

btn_dir_disable.png

windows10-2004-x64

3

btn_dir_hover.png

windows7-x64

3

btn_dir_hover.png

windows10-2004-x64

3

btn_dir_normal.png

windows7-x64

3

btn_dir_normal.png

windows10-2004-x64

3

btn_dir_pushed.png

windows7-x64

3

btn_dir_pushed.png

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    CapCut_7376292114319015953_installer.exe

  • Size

    2.2MB

  • Sample

    240731-m94dmavbma

  • MD5

    c91e097550ea6ccedf592d8b83414e0d

  • SHA1

    021f3f26d86f98af28dc987baad8714f64867207

  • SHA256

    4a9d815f284adda187982e2b24da2beaad860739bc4b4cb1cf26408e7c221dd6

  • SHA512

    916898c9850ddfcd2c11da7421eeffc4d48406d9ad4787a4dc572ec17a81a39edd30733aa8cccde8b31450ff8031e3da68be019a8a0eff50c0a17ed4fa0aa3c9

  • SSDEEP

    49152:uGVKq6wrr98ArcTTuVMZCC8GYCNbFLg3dlXI5x8oaigMv3Dh:uGVLprJ8ArnVMZCUPFcNlXID8en1

Score
6/10
discoveryevasiontrojan

Malware Config

Targets

    • Target

      CapCut_7376292114319015953_installer.exe

    • Size

      2.2MB

    • MD5

      c91e097550ea6ccedf592d8b83414e0d

    • SHA1

      021f3f26d86f98af28dc987baad8714f64867207

    • SHA256

      4a9d815f284adda187982e2b24da2beaad860739bc4b4cb1cf26408e7c221dd6

    • SHA512

      916898c9850ddfcd2c11da7421eeffc4d48406d9ad4787a4dc572ec17a81a39edd30733aa8cccde8b31450ff8031e3da68be019a8a0eff50c0a17ed4fa0aa3c9

    • SSDEEP

      49152:uGVKq6wrr98ArcTTuVMZCC8GYCNbFLg3dlXI5x8oaigMv3Dh:uGVLprJ8ArnVMZCUPFcNlXID8en1

    Score
    6/10
    discoveryevasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtCreateThreadExHideFromDebugger

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/BgWorker.dll

    • Size

      2KB

    • MD5

      33ec04738007e665059cf40bc0f0c22b

    • SHA1

      4196759a922e333d9b17bda5369f14c33cd5e3bc

    • SHA256

      50f735ab8f3473423e6873d628150bbc0777be7b4f6405247cddf22bb00fb6be

    • SHA512

      2318b01f0c2f2f021a618ca3e6e5c24a94df5d00154766b77160203b8b0a177c8581c7b688ffe69be93a69bc7fd06b8a589844d42447f5060fb4bcf94d8a9aef

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      0d7ad4f45dc6f5aa87f606d0331c6901

    • SHA1

      48df0911f0484cbe2a8cdd5362140b63c41ee457

    • SHA256

      3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

    • SHA512

      c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

    • SSDEEP

      192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/deviceregister_shared.dll

    • Size

      226KB

    • MD5

      8baaaeacb97679fb495e1c4f902f0a68

    • SHA1

      29185b00e4c56ff8cc22de64c1407809d60348f1

    • SHA256

      7c2a74c4be8d524a121e78e763c05c7b5cb58b524119ac8897c493e717a1d42a

    • SHA512

      49f864332165c0229f0588fa1fd56fdc04bb005be1b61a9367fac5f45c32783e2e633c8acb64c3a921d41d9b79ceb3315813aa409a8f725cc7193958bf4bb8e0

    • SSDEEP

      6144:5Nj2oPjbpV4hliZ7xsFARHtw+WY0L1TBWoBvF:6KV4hliZ7KFAb+L1TIo

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/downloader_nsis_plugin.dll

    • Size

      1.2MB

    • MD5

      f181413906a465fd0dd68cc4a3d98803

    • SHA1

      5aa28be48047dd0b672ab98d5e7cbd8260486b4b

    • SHA256

      e28ff7b8fc4b1eb2d1f394ce15de2fc031cda58db645038c8c07581c31e79dda

    • SHA512

      8d0116bcbc3938b2ebdddf77dec87e4b6c872382d20b555571b0bc3e4a35f88d16bc450004f875a8271165b71bdbae5d4d474a5bfda4c7787da63f4325009c25

    • SSDEEP

      24576:UtF94NRXKCK8gEM4Vn8rHmAumkpF6sBE:Ut/uXTianGmAumkpFe

    Score
    3/10
    discovery
    behavioral10behavioral9

    • Target

      $PLUGINSDIR/res.zip

    • Size

      162KB

    • MD5

      23e2490706d024bd70ccb906ebf0b62d

    • SHA1

      94c346ac69ff8867204f1a2346491342203980be

    • SHA256

      fbb054f0880b81de92be6a9500c6757f4e1a3e8e335e31821d76b49de8375c8c

    • SHA512

      fdd948396d184cc7e663678ce179721dc5d9ddedceb46110a86acfe4ac69613e36ed4030ece15ef95b575c0027d0e83f0c99f9c1c7fe55b967c86fe4cef86bd0

    • SSDEEP

      3072:xqbNMh58abnJ6taLk0gLP5mAugd+YMfYTY3CtKqnyL3d:zz/d6t+aLP5mAr7MfP3KKbLd

    Score
    1/10
    behavioral11behavioral12

    • Target

      app_warning_icon.png

    • Size

      10KB

    • MD5

      ff33518be442da6232709553157e2418

    • SHA1

      a68eeced8fa5a2ab918e9d4c575ff09839624efb

    • SHA256

      2c8cdbdfa2a99200718901ed35bb56ea90f8fed9934aecd640d9507b677f7025

    • SHA512

      02858ae7e65c33c21952e65eef49d74c4c4398e7b9a04eb9c7b50ad0fa24d3025f377ffadfc2e9b9e07d112efd3468bdce4f71a146608287827a65f2e057f83e

    • SSDEEP

      192:vDbpB1zqKLGqqeSaU18Ft/TCpZu2cphDjlVq4kw9oTrRpa1s:npB1ztG3D18FtLkDmhDxVahpss

    Score
    3/10
    behavioral13behavioral14

    • Target

      banner_bk.jpg

    • Size

      83KB

    • MD5

      245b96c88020b408e92a4f3ff77d9ac7

    • SHA1

      eb04cd6411ac4fa24dd4248004e9521186206a9b

    • SHA256

      c4b98d49afd4beab5b0f549cb9674f61e2156d273626f17e8d84129c127684f5

    • SHA512

      fd2f09c8a02d43d8ce8ca53959804cd3265d426cad6a40d3fad6cd7423c952f62ccfb1e46832af3dc66070c008c7812caa3bb9d2702dd55ab77da785cab05c79

    • SSDEEP

      1536:9uUUgVClmd0qp3Atu7wnmGrmMFcjYe9QK+uRNTFzTxBNeCBoygO:U8VCozwnmGrmvO+tpjeCfP

    Score
    3/10
    behavioral15behavioral16

    • Target

      btn_dark_1_disable.png

    • Size

      495B

    • MD5

      653d579d6668c1431cac857b7efe5034

    • SHA1

      0a606960becc6b7b40f97b34bf4bcb46f679cd45

    • SHA256

      1214f419b0f821daa6ee796b284662c25002f579d3045b50e82ab8a531925cf0

    • SHA512

      487b869f9933991c026708e8b47ca34bc268d2f0680a52dab50d99b39d62d669409d999274b3c193b0076a4e03d86b7843efe3ced41fb8a9fdc986c75032917e

    Score
    3/10
    behavioral17behavioral18

    • Target

      btn_dark_1_hover.png

    • Size

      500B

    • MD5

      e2d1d028a247d172652fa902395da9a1

    • SHA1

      80098c9e5ff0e2d53cdd07a132564dc6b9bfe786

    • SHA256

      361ca657c498b9762869f0561fb0e8346c1d7d511fa8351b704c2b6b67e8017d

    • SHA512

      5abb58988d1b5072dee85878ba28bd75e2e2a59dc617fbf1fa9e6ca0c96695ff15aed275d6c5653f3e6a594f69d77ca73a5d0ab8488a67dacc7ed44fa32db0b7

    Score
    3/10
    behavioral19behavioral20

    • Target

      btn_dark_1_normal.png

    • Size

      465B

    • MD5

      0a6953548ea99f1f3c609f371680de1e

    • SHA1

      a43039665aa11953064c67535c6c0730e0d42715

    • SHA256

      f7d278ca8bd08b29bd93c95cdc0232b23ba5bdce09ddc9ccf77a4570c5efc0b7

    • SHA512

      27daee094b0c04d1967243881cf91128107735f7b378b3dc848eaf4ba7a3c658c7d95eb9f826514f47c82fea0f6a69a8af3a75f9887e009c03dc692e657993fb

    Score
    3/10
    behavioral21behavioral22

    • Target

      btn_dark_1_pushed.png

    • Size

      455B

    • MD5

      e9d2c7a7ae25969a0e166d51c921660d

    • SHA1

      4387b00f8c545a1b25156ddec6c98b3400e379dd

    • SHA256

      835474b1387b98bd5837668661396fc7cfaa7c934d3422c923ebe9553e5d9552

    • SHA512

      18da16fa24ce72f66331605e6f7938727373c06b8b97c1ef9789cdd5d4e3178623130a1fa01464211e9db33913c518a2aa1de0ee1eb8f09ab55f4e3082359efe

    Score
    3/10
    behavioral23behavioral24

    • Target

      btn_dir_disable.png

    • Size

      634B

    • MD5

      71e683c7fca17d19e59d536056cea81d

    • SHA1

      80196242b17fe96af99d4663b1bbb912b617fe26

    • SHA256

      551e25a738681d1365e8853bea823ebb8bdfea8547e5843bf076173be4151689

    • SHA512

      e63f3f5ba9453687c7c07e2bf9c63974dbac1d916fa3a21f3882e12b60dcb361cb43ba00e9e390e8214347c5e9795021cb1612b7843ab0b18c5239ee865a1fc3

    Score
    3/10
    behavioral25behavioral26

    • Target

      btn_dir_hover.png

    • Size

      1KB

    • MD5

      f1446398846b2f7c7779b3a4e34c930a

    • SHA1

      2adf38f8a439f1e3ee666df91b20a0836e69a265

    • SHA256

      cf1abbf3c06ef18818272eeae0bf5197e9982385c0633a03e06caef2eea479cd

    • SHA512

      48e9f62011e6a780c267882613c3c3dedfed0340ac8fedf225d99772d62a8212e1da3d13edc182b924e36fec1f3bd9eab6a42a3360d85320fb38050a3a852534

    Score
    3/10
    behavioral27behavioral28

    • Target

      btn_dir_normal.png

    • Size

      599B

    • MD5

      69c49053991a8044a2a3e9330d56f650

    • SHA1

      e52b4c21b2616a23f4c534b52923fc8eddfca25a

    • SHA256

      c3d4853cf097def877b54bd9f66ec2beff88d5210306959570e85c0a6b8e1eef

    • SHA512

      66aba66ab169df7da16cf0a52bbb5fc8562ec04487cec6e2cb25892eb25be76d82f29ec17e6cc92640667f74c433d691b5ea83fb86385998baa44b5461b03643

    Score
    3/10
    behavioral29behavioral30

    • Target

      btn_dir_pushed.png

    • Size

      577B

    • MD5

      34e768fe73d27f826589add661153ede

    • SHA1

      7d7d015b2f428e7bb77ce511b23d27567e086483

    • SHA256

      8e3cd0fff2a8dc5697b513b3164ff7dcffa30cc7deec7b104e29cede1ab71b0b

    • SHA512

      80db2b26f4a1af423ea9f16bba4d861cfac428e2f8a4b7772101c0e012c1447027b9057876c8bf2b2a74bb6dc3fa91893bbdf1fee559694af8815f4996bd8edb

    Score
    3/10
    behavioral31behavioral32

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

13
T1082

Query Registry

2
T1012

System Location Discovery

5
T1614

System Language Discovery

5
T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

Score
3/10

behavioral1

discoveryevasiontrojan
Score
6/10

behavioral2

discoveryevasiontrojan
Score
6/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
3/10

behavioral14

Score
3/10

behavioral15

Score
3/10

behavioral16

Score
3/10

behavioral17

Score
3/10

behavioral18

Score
3/10

behavioral19

Score
3/10

behavioral20

Score
3/10

behavioral21

Score
3/10

behavioral22

Score
3/10

behavioral23

Score
3/10

behavioral24

Score
3/10

behavioral25

Score
3/10

behavioral26

Score
3/10

behavioral27

Score
3/10

behavioral28

Score
3/10

behavioral29

Score
3/10

behavioral30

Score
3/10

behavioral31

Score
3/10

behavioral32

Score
3/10