Analysis
-
max time kernel
117s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10-08-2024 18:53
Static task
static1
Behavioral task
behavioral1
Sample
capcut_capcutpc_invitefission_1.2.4_installer (1).exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
capcut_capcutpc_invitefission_1.2.4_installer (1).exe
Resource
win10v2004-20240802-en
General
-
Target
capcut_capcutpc_invitefission_1.2.4_installer (1).exe
-
Size
2.2MB
-
MD5
cafd508f953e2d28acf9b49e80bf2fc6
-
SHA1
0c739749978ef0b6077261e511ab10e9211f2c71
-
SHA256
aa8ff4d4c4505f9245ae995be2fee8f6a78b1167126e613490e1c22549bdf142
-
SHA512
3ff026e849378691da40d406ce806c438c8a4f015217731bd132bfccdb58c4832306a3f92aa752af6d3ca71e2425f161155d767e56d23c15f0634424080caab3
-
SSDEEP
49152:7VhVn6EBMgmH1Cz0DqfMus8/V3sYPyD9+gqulxheyY6:7XVn6OMgmH1CS7ec7fxY6
Malware Config
Signatures
-
Loads dropped DLL 5 IoCs
Processes:
capcut_capcutpc_invitefission_1.2.4_installer (1).exepid process 2624 capcut_capcutpc_invitefission_1.2.4_installer (1).exe 2624 capcut_capcutpc_invitefission_1.2.4_installer (1).exe 2624 capcut_capcutpc_invitefission_1.2.4_installer (1).exe 2624 capcut_capcutpc_invitefission_1.2.4_installer (1).exe 2624 capcut_capcutpc_invitefission_1.2.4_installer (1).exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
capcut_capcutpc_invitefission_1.2.4_installer (1).execmd.execmd.execmd.exeWMIC.execmd.execmd.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language capcut_capcutpc_invitefission_1.2.4_installer (1).exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 2696 WMIC.exe Token: SeSecurityPrivilege 2696 WMIC.exe Token: SeTakeOwnershipPrivilege 2696 WMIC.exe Token: SeLoadDriverPrivilege 2696 WMIC.exe Token: SeSystemProfilePrivilege 2696 WMIC.exe Token: SeSystemtimePrivilege 2696 WMIC.exe Token: SeProfSingleProcessPrivilege 2696 WMIC.exe Token: SeIncBasePriorityPrivilege 2696 WMIC.exe Token: SeCreatePagefilePrivilege 2696 WMIC.exe Token: SeBackupPrivilege 2696 WMIC.exe Token: SeRestorePrivilege 2696 WMIC.exe Token: SeShutdownPrivilege 2696 WMIC.exe Token: SeDebugPrivilege 2696 WMIC.exe Token: SeSystemEnvironmentPrivilege 2696 WMIC.exe Token: SeRemoteShutdownPrivilege 2696 WMIC.exe Token: SeUndockPrivilege 2696 WMIC.exe Token: SeManageVolumePrivilege 2696 WMIC.exe Token: 33 2696 WMIC.exe Token: 34 2696 WMIC.exe Token: 35 2696 WMIC.exe Token: SeIncreaseQuotaPrivilege 2696 WMIC.exe Token: SeSecurityPrivilege 2696 WMIC.exe Token: SeTakeOwnershipPrivilege 2696 WMIC.exe Token: SeLoadDriverPrivilege 2696 WMIC.exe Token: SeSystemProfilePrivilege 2696 WMIC.exe Token: SeSystemtimePrivilege 2696 WMIC.exe Token: SeProfSingleProcessPrivilege 2696 WMIC.exe Token: SeIncBasePriorityPrivilege 2696 WMIC.exe Token: SeCreatePagefilePrivilege 2696 WMIC.exe Token: SeBackupPrivilege 2696 WMIC.exe Token: SeRestorePrivilege 2696 WMIC.exe Token: SeShutdownPrivilege 2696 WMIC.exe Token: SeDebugPrivilege 2696 WMIC.exe Token: SeSystemEnvironmentPrivilege 2696 WMIC.exe Token: SeRemoteShutdownPrivilege 2696 WMIC.exe Token: SeUndockPrivilege 2696 WMIC.exe Token: SeManageVolumePrivilege 2696 WMIC.exe Token: 33 2696 WMIC.exe Token: 34 2696 WMIC.exe Token: 35 2696 WMIC.exe Token: SeIncreaseQuotaPrivilege 2808 WMIC.exe Token: SeSecurityPrivilege 2808 WMIC.exe Token: SeTakeOwnershipPrivilege 2808 WMIC.exe Token: SeLoadDriverPrivilege 2808 WMIC.exe Token: SeSystemProfilePrivilege 2808 WMIC.exe Token: SeSystemtimePrivilege 2808 WMIC.exe Token: SeProfSingleProcessPrivilege 2808 WMIC.exe Token: SeIncBasePriorityPrivilege 2808 WMIC.exe Token: SeCreatePagefilePrivilege 2808 WMIC.exe Token: SeBackupPrivilege 2808 WMIC.exe Token: SeRestorePrivilege 2808 WMIC.exe Token: SeShutdownPrivilege 2808 WMIC.exe Token: SeDebugPrivilege 2808 WMIC.exe Token: SeSystemEnvironmentPrivilege 2808 WMIC.exe Token: SeRemoteShutdownPrivilege 2808 WMIC.exe Token: SeUndockPrivilege 2808 WMIC.exe Token: SeManageVolumePrivilege 2808 WMIC.exe Token: 33 2808 WMIC.exe Token: 34 2808 WMIC.exe Token: 35 2808 WMIC.exe Token: SeIncreaseQuotaPrivilege 2808 WMIC.exe Token: SeSecurityPrivilege 2808 WMIC.exe Token: SeTakeOwnershipPrivilege 2808 WMIC.exe Token: SeLoadDriverPrivilege 2808 WMIC.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
capcut_capcutpc_invitefission_1.2.4_installer (1).execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 2624 wrote to memory of 2776 2624 capcut_capcutpc_invitefission_1.2.4_installer (1).exe cmd.exe PID 2624 wrote to memory of 2776 2624 capcut_capcutpc_invitefission_1.2.4_installer (1).exe cmd.exe PID 2624 wrote to memory of 2776 2624 capcut_capcutpc_invitefission_1.2.4_installer (1).exe cmd.exe PID 2624 wrote to memory of 2776 2624 capcut_capcutpc_invitefission_1.2.4_installer (1).exe cmd.exe PID 2776 wrote to memory of 2696 2776 cmd.exe WMIC.exe PID 2776 wrote to memory of 2696 2776 cmd.exe WMIC.exe PID 2776 wrote to memory of 2696 2776 cmd.exe WMIC.exe PID 2776 wrote to memory of 2696 2776 cmd.exe WMIC.exe PID 2624 wrote to memory of 2632 2624 capcut_capcutpc_invitefission_1.2.4_installer (1).exe cmd.exe PID 2624 wrote to memory of 2632 2624 capcut_capcutpc_invitefission_1.2.4_installer (1).exe cmd.exe PID 2624 wrote to memory of 2632 2624 capcut_capcutpc_invitefission_1.2.4_installer (1).exe cmd.exe PID 2624 wrote to memory of 2632 2624 capcut_capcutpc_invitefission_1.2.4_installer (1).exe cmd.exe PID 2632 wrote to memory of 2808 2632 cmd.exe WMIC.exe PID 2632 wrote to memory of 2808 2632 cmd.exe WMIC.exe PID 2632 wrote to memory of 2808 2632 cmd.exe WMIC.exe PID 2632 wrote to memory of 2808 2632 cmd.exe WMIC.exe PID 2624 wrote to memory of 2784 2624 capcut_capcutpc_invitefission_1.2.4_installer (1).exe cmd.exe PID 2624 wrote to memory of 2784 2624 capcut_capcutpc_invitefission_1.2.4_installer (1).exe cmd.exe PID 2624 wrote to memory of 2784 2624 capcut_capcutpc_invitefission_1.2.4_installer (1).exe cmd.exe PID 2624 wrote to memory of 2784 2624 capcut_capcutpc_invitefission_1.2.4_installer (1).exe cmd.exe PID 2784 wrote to memory of 2548 2784 cmd.exe WMIC.exe PID 2784 wrote to memory of 2548 2784 cmd.exe WMIC.exe PID 2784 wrote to memory of 2548 2784 cmd.exe WMIC.exe PID 2784 wrote to memory of 2548 2784 cmd.exe WMIC.exe PID 2624 wrote to memory of 2608 2624 capcut_capcutpc_invitefission_1.2.4_installer (1).exe cmd.exe PID 2624 wrote to memory of 2608 2624 capcut_capcutpc_invitefission_1.2.4_installer (1).exe cmd.exe PID 2624 wrote to memory of 2608 2624 capcut_capcutpc_invitefission_1.2.4_installer (1).exe cmd.exe PID 2624 wrote to memory of 2608 2624 capcut_capcutpc_invitefission_1.2.4_installer (1).exe cmd.exe PID 2608 wrote to memory of 2344 2608 cmd.exe WMIC.exe PID 2608 wrote to memory of 2344 2608 cmd.exe WMIC.exe PID 2608 wrote to memory of 2344 2608 cmd.exe WMIC.exe PID 2608 wrote to memory of 2344 2608 cmd.exe WMIC.exe PID 2624 wrote to memory of 2356 2624 capcut_capcutpc_invitefission_1.2.4_installer (1).exe cmd.exe PID 2624 wrote to memory of 2356 2624 capcut_capcutpc_invitefission_1.2.4_installer (1).exe cmd.exe PID 2624 wrote to memory of 2356 2624 capcut_capcutpc_invitefission_1.2.4_installer (1).exe cmd.exe PID 2624 wrote to memory of 2356 2624 capcut_capcutpc_invitefission_1.2.4_installer (1).exe cmd.exe PID 2356 wrote to memory of 780 2356 cmd.exe WMIC.exe PID 2356 wrote to memory of 780 2356 cmd.exe WMIC.exe PID 2356 wrote to memory of 780 2356 cmd.exe WMIC.exe PID 2356 wrote to memory of 780 2356 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\capcut_capcutpc_invitefission_1.2.4_installer (1).exe"C:\Users\Admin\AppData\Local\Temp\capcut_capcutpc_invitefission_1.2.4_installer (1).exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe /c wmic csproduct get Name,UUID /value2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic csproduct get Name,UUID /value3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe /c wmic os get SerialNumber,Caption,BuildNumber,Version /value2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic os get SerialNumber,Caption,BuildNumber,Version /value3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe /c wmic path Win32_VideoController get CurrentVerticalResolution,CurrentHorizontalResolution /value2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path Win32_VideoController get CurrentVerticalResolution,CurrentHorizontalResolution /value3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe /c wmic nicconfig get DefaultIPGateway,macaddress2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic nicconfig get DefaultIPGateway,macaddress3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe /c wmic diskdrive get SerialNumber /value2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic diskdrive get SerialNumber /value3⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsoE689.tmp\BgWorker.dllFilesize
2KB
MD533ec04738007e665059cf40bc0f0c22b
SHA14196759a922e333d9b17bda5369f14c33cd5e3bc
SHA25650f735ab8f3473423e6873d628150bbc0777be7b4f6405247cddf22bb00fb6be
SHA5122318b01f0c2f2f021a618ca3e6e5c24a94df5d00154766b77160203b8b0a177c8581c7b688ffe69be93a69bc7fd06b8a589844d42447f5060fb4bcf94d8a9aef
-
\Users\Admin\AppData\Local\Temp\nsoE689.tmp\System.dllFilesize
12KB
MD50d7ad4f45dc6f5aa87f606d0331c6901
SHA148df0911f0484cbe2a8cdd5362140b63c41ee457
SHA2563eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
-
\Users\Admin\AppData\Local\Temp\nsoE689.tmp\deviceregister_shared.dllFilesize
226KB
MD58baaaeacb97679fb495e1c4f902f0a68
SHA129185b00e4c56ff8cc22de64c1407809d60348f1
SHA2567c2a74c4be8d524a121e78e763c05c7b5cb58b524119ac8897c493e717a1d42a
SHA51249f864332165c0229f0588fa1fd56fdc04bb005be1b61a9367fac5f45c32783e2e633c8acb64c3a921d41d9b79ceb3315813aa409a8f725cc7193958bf4bb8e0
-
\Users\Admin\AppData\Local\Temp\nsoE689.tmp\downloader_nsis_plugin.dllFilesize
1.2MB
MD514930a06cbfb26d5ffffd354fa12d5f8
SHA11de289bab03eaad965e419d657c3531a3738c558
SHA2563ef7a13886328dafba1c49ec096da122e63839ac6965bf4f3d4dcce3a35ccc6d
SHA512385268602f050c060795312c9cb86e979030a21b8cecc20303b346bbc0800a468a84a291224592d9b0e43458e579660b8062f6b9cba3b2e79aab5015d1dcc67b
-
\Users\Admin\AppData\Local\Temp\nsoE689.tmp\shell_downloader.dllFilesize
2.2MB
MD530c4aa9356d60d2039ed6bfb7850c4c1
SHA1ef23c32dab6ed871527151932bbfe8b917d507af
SHA2560c4abb66d9a69c80cfaa0eb3c988d4dc40d989843a87e95ed3cc6e75dae31559
SHA512f425c9fcefd2ed55160d173b8e441f7867307fd006b0f01a655120ba150d87568ddc6266d36163267ce508df8147a97c16982093808c766051ca1e02ba9cc62b