Analysis
- max time kernel
34s - max time network
37s - platform
windows11-21h2_x64 - resource
win11-20241007-en - resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system - submitted
18/10/2024, 14:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
capcut_capcutpc_invitefission_1.2.4_installer.exe
Resource
win10-20240404-en
windows10-1703-x64
30 signatures
1800 seconds
Behavioral task
behavioral2
Sample
capcut_capcutpc_invitefission_1.2.4_installer.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
17 signatures
1800 seconds
Behavioral task
behavioral3
Sample
capcut_capcutpc_invitefission_1.2.4_installer.exe
Resource
win11-20241007-en
windows11-21h2-x64
5 signatures
1800 seconds
General
- Target capcut_capcutpc_invitefission_1.2.4_installer.exe
- Size 2.2MB
- Sample241018-rm6yfstemm
- SHA256 aa8ff4d4c4505f9245ae995be2fee8f6a78b1167126e613490e1c22549bdf142
- MD5 cafd508f953e2d28acf9b49e80bf2fc6
- SHA1 0c739749978ef0b6077261e511ab10e9211f2c71
- SHA512 3ff026e849378691da40d406ce806c438c8a4f015217731bd132bfccdb58c4832306a3f92aa752af6d3ca71e2425f161155d767e56d23c15f0634424080caab3
- SSDEEP 49152:7VhVn6EBMgmH1Cz0DqfMus8/V3sYPyD9+gqulxheyY6:7XVn6OMgmH1CS7ec7fxY6
- MD5 SHA1 SHA512 SSDEEP
Score
4/10
Malware Config
Signatures
- Loads dropped DLL 5 IoCs
pid Process 2488 capcut_capcutpc_invitefission_1.2.4_installer.exe 2488 capcut_capcutpc_invitefission_1.2.4_installer.exe 2488 capcut_capcutpc_invitefission_1.2.4_installer.exe 2488 capcut_capcutpc_invitefission_1.2.4_installer.exe 2488 capcut_capcutpc_invitefission_1.2.4_installer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language capcut_capcutpc_invitefission_1.2.4_installer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 648 WMIC.exe Token: SeSecurityPrivilege 648 WMIC.exe Token: SeTakeOwnershipPrivilege 648 WMIC.exe Token: SeLoadDriverPrivilege 648 WMIC.exe Token: SeSystemProfilePrivilege 648 WMIC.exe Token: SeSystemtimePrivilege 648 WMIC.exe Token: SeProfSingleProcessPrivilege 648 WMIC.exe Token: SeIncBasePriorityPrivilege 648 WMIC.exe Token: SeCreatePagefilePrivilege 648 WMIC.exe Token: SeBackupPrivilege 648 WMIC.exe Token: SeRestorePrivilege 648 WMIC.exe Token: SeShutdownPrivilege 648 WMIC.exe Token: SeDebugPrivilege 648 WMIC.exe Token: SeSystemEnvironmentPrivilege 648 WMIC.exe Token: SeRemoteShutdownPrivilege 648 WMIC.exe Token: SeUndockPrivilege 648 WMIC.exe Token: SeManageVolumePrivilege 648 WMIC.exe Token: 33 648 WMIC.exe Token: 34 648 WMIC.exe Token: 35 648 WMIC.exe Token: 36 648 WMIC.exe Token: SeIncreaseQuotaPrivilege 648 WMIC.exe Token: SeSecurityPrivilege 648 WMIC.exe Token: SeTakeOwnershipPrivilege 648 WMIC.exe Token: SeLoadDriverPrivilege 648 WMIC.exe Token: SeSystemProfilePrivilege 648 WMIC.exe Token: SeSystemtimePrivilege 648 WMIC.exe Token: SeProfSingleProcessPrivilege 648 WMIC.exe Token: SeIncBasePriorityPrivilege 648 WMIC.exe Token: SeCreatePagefilePrivilege 648 WMIC.exe Token: SeBackupPrivilege 648 WMIC.exe Token: SeRestorePrivilege 648 WMIC.exe Token: SeShutdownPrivilege 648 WMIC.exe Token: SeDebugPrivilege 648 WMIC.exe Token: SeSystemEnvironmentPrivilege 648 WMIC.exe Token: SeRemoteShutdownPrivilege 648 WMIC.exe Token: SeUndockPrivilege 648 WMIC.exe Token: SeManageVolumePrivilege 648 WMIC.exe Token: 33 648 WMIC.exe Token: 34 648 WMIC.exe Token: 35 648 WMIC.exe Token: 36 648 WMIC.exe Token: SeIncreaseQuotaPrivilege 4956 WMIC.exe Token: SeSecurityPrivilege 4956 WMIC.exe Token: SeTakeOwnershipPrivilege 4956 WMIC.exe Token: SeLoadDriverPrivilege 4956 WMIC.exe Token: SeSystemProfilePrivilege 4956 WMIC.exe Token: SeSystemtimePrivilege 4956 WMIC.exe Token: SeProfSingleProcessPrivilege 4956 WMIC.exe Token: SeIncBasePriorityPrivilege 4956 WMIC.exe Token: SeCreatePagefilePrivilege 4956 WMIC.exe Token: SeBackupPrivilege 4956 WMIC.exe Token: SeRestorePrivilege 4956 WMIC.exe Token: SeShutdownPrivilege 4956 WMIC.exe Token: SeDebugPrivilege 4956 WMIC.exe Token: SeSystemEnvironmentPrivilege 4956 WMIC.exe Token: SeRemoteShutdownPrivilege 4956 WMIC.exe Token: SeUndockPrivilege 4956 WMIC.exe Token: SeManageVolumePrivilege 4956 WMIC.exe Token: 33 4956 WMIC.exe Token: 34 4956 WMIC.exe Token: 35 4956 WMIC.exe Token: 36 4956 WMIC.exe Token: SeIncreaseQuotaPrivilege 4956 WMIC.exe - Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2488 wrote to memory of 2404 2488 capcut_capcutpc_invitefission_1.2.4_installer.exe 77 PID 2488 wrote to memory of 2404 2488 capcut_capcutpc_invitefission_1.2.4_installer.exe 77 PID 2488 wrote to memory of 2404 2488 capcut_capcutpc_invitefission_1.2.4_installer.exe 77 PID 2404 wrote to memory of 648 2404 cmd.exe 79 PID 2404 wrote to memory of 648 2404 cmd.exe 79 PID 2404 wrote to memory of 648 2404 cmd.exe 79 PID 2488 wrote to memory of 3444 2488 capcut_capcutpc_invitefission_1.2.4_installer.exe 81 PID 2488 wrote to memory of 3444 2488 capcut_capcutpc_invitefission_1.2.4_installer.exe 81 PID 2488 wrote to memory of 3444 2488 capcut_capcutpc_invitefission_1.2.4_installer.exe 81 PID 3444 wrote to memory of 4956 3444 cmd.exe 83 PID 3444 wrote to memory of 4956 3444 cmd.exe 83 PID 3444 wrote to memory of 4956 3444 cmd.exe 83 PID 2488 wrote to memory of 3116 2488 capcut_capcutpc_invitefission_1.2.4_installer.exe 84 PID 2488 wrote to memory of 3116 2488 capcut_capcutpc_invitefission_1.2.4_installer.exe 84 PID 2488 wrote to memory of 3116 2488 capcut_capcutpc_invitefission_1.2.4_installer.exe 84 PID 3116 wrote to memory of 3204 3116 cmd.exe 86 PID 3116 wrote to memory of 3204 3116 cmd.exe 86 PID 3116 wrote to memory of 3204 3116 cmd.exe 86 PID 2488 wrote to memory of 396 2488 capcut_capcutpc_invitefission_1.2.4_installer.exe 87 PID 2488 wrote to memory of 396 2488 capcut_capcutpc_invitefission_1.2.4_installer.exe 87 PID 2488 wrote to memory of 396 2488 capcut_capcutpc_invitefission_1.2.4_installer.exe 87 PID 396 wrote to memory of 808 396 cmd.exe 89 PID 396 wrote to memory of 808 396 cmd.exe 89 PID 396 wrote to memory of 808 396 cmd.exe 89 PID 2488 wrote to memory of 1544 2488 capcut_capcutpc_invitefission_1.2.4_installer.exe 90 PID 2488 wrote to memory of 1544 2488 capcut_capcutpc_invitefission_1.2.4_installer.exe 90 PID 2488 wrote to memory of 1544 2488 capcut_capcutpc_invitefission_1.2.4_installer.exe 90 PID 1544 wrote to memory of 3312 1544 cmd.exe 92 PID 1544 wrote to memory of 3312 1544 cmd.exe 92 PID 1544 wrote to memory of 3312 1544 cmd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\capcut_capcutpc_invitefission_1.2.4_installer.exe"C:\Users\Admin\AppData\Local\Temp\capcut_capcutpc_invitefission_1.2.4_installer.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe /c wmic csproduct get Name,UUID /value2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic csproduct get Name,UUID /value3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:648
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe /c wmic os get SerialNumber,Caption,BuildNumber,Version /value2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic os get SerialNumber,Caption,BuildNumber,Version /value3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4956
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe /c wmic path Win32_VideoController get CurrentVerticalResolution,CurrentHorizontalResolution /value2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path Win32_VideoController get CurrentVerticalResolution,CurrentHorizontalResolution /value3⤵
- System Location Discovery: System Language Discovery
PID:3204
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe /c wmic nicconfig get DefaultIPGateway,macaddress2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic nicconfig get DefaultIPGateway,macaddress3⤵
- System Location Discovery: System Language Discovery
PID:808
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe /c wmic diskdrive get SerialNumber /value2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic diskdrive get SerialNumber /value3⤵
- System Location Discovery: System Language Discovery
PID:3312
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsiCDFF.tmp\BgWorker.dll
- Size 2KB
- SHA256 50f735ab8f3473423e6873d628150bbc0777be7b4f6405247cddf22bb00fb6be
- MD5 33ec04738007e665059cf40bc0f0c22b
- SHA1 4196759a922e333d9b17bda5369f14c33cd5e3bc
- SHA512 2318b01f0c2f2f021a618ca3e6e5c24a94df5d00154766b77160203b8b0a177c8581c7b688ffe69be93a69bc7fd06b8a589844d42447f5060fb4bcf94d8a9aef
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsiCDFF.tmp\System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsiCDFF.tmp\deviceregister_shared.dll
- Size 226KB
- SHA256 7c2a74c4be8d524a121e78e763c05c7b5cb58b524119ac8897c493e717a1d42a
- MD5 8baaaeacb97679fb495e1c4f902f0a68
- SHA1 29185b00e4c56ff8cc22de64c1407809d60348f1
- SHA512 49f864332165c0229f0588fa1fd56fdc04bb005be1b61a9367fac5f45c32783e2e633c8acb64c3a921d41d9b79ceb3315813aa409a8f725cc7193958bf4bb8e0
- SSDEEP 6144:5Nj2oPjbpV4hliZ7xsFARHtw+WY0L1TBWoBvF:6KV4hliZ7KFAb+L1TIo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsiCDFF.tmp\downloader_nsis_plugin.dll
- Size 1.2MB
- SHA256 3ef7a13886328dafba1c49ec096da122e63839ac6965bf4f3d4dcce3a35ccc6d
- MD5 14930a06cbfb26d5ffffd354fa12d5f8
- SHA1 1de289bab03eaad965e419d657c3531a3738c558
- SHA512 385268602f050c060795312c9cb86e979030a21b8cecc20303b346bbc0800a468a84a291224592d9b0e43458e579660b8062f6b9cba3b2e79aab5015d1dcc67b
- SSDEEP 24576:eDe+j+n40zyob+w+LsoZttOWR7vDzAOdYKT9s6rNnb3Khz:Eei+n7zy2ULsGjOWR7vDzhdYKThNnzKN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsiCDFF.tmp\shell_downloader.dll
- Size 2.2MB
- SHA256 0c4abb66d9a69c80cfaa0eb3c988d4dc40d989843a87e95ed3cc6e75dae31559
- MD5 30c4aa9356d60d2039ed6bfb7850c4c1
- SHA1 ef23c32dab6ed871527151932bbfe8b917d507af
- SHA512 f425c9fcefd2ed55160d173b8e441f7867307fd006b0f01a655120ba150d87568ddc6266d36163267ce508df8147a97c16982093808c766051ca1e02ba9cc62b
- SSDEEP 49152:6oiR6tzluS2KbICD13Nw2FiBLROWnhJV:6oiR+zDhbB19w+i1ROW
- MD5 SHA1 SHA512 SSDEEP