Analysis
- max time kernel
149s - max time network
183s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
29/07/2026, 21:27
Static task
static1
Behavioral task
behavioral1
Sample
CapCut_9_1_0_3879_capcutpc_msstore_creatortool.exe
Resource
win10v2004-20260513-en
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
CapCut_9_1_0_3879_capcutpc_msstore_creatortool.exe
Resource
win10ltsc2021-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
CapCut_9_1_0_3879_capcutpc_msstore_creatortool.exe
Resource
win11-20260513-en
4 signatures
150 seconds
General
- Target CapCut_9_1_0_3879_capcutpc_msstore_creatortool.exe
- Size 516.5MB
- Sample260729-1a2mmswvft
- SHA256 9b419618f963d2368844659841e7bfa350eccc2a4e61016c66921ec9a71dee63
- MD5 b630fcf382822bf4f889203916076e61
- SHA1 a5abe0d9383b7a18899f399abe1b2253b96d7ade
- SHA512 0d16457cc402024ae5caab2af0695ee14885e2cd030184c0107facb1efe62e7d19fca0064ea5acc407354e33cf4473f1cccdb4e965ef5855d7115720fad7e679
- SSDEEP 12582912:SSxB1QGwtGxABnYnZCubBsiQMOv+HyKwOv/m:SUB1QPtFs0uNsRRvwyKwOve
- TLSH T18249330AA27480ADE5E7C17985124607EAF27C865330DBCB02D4AA4E2F63FF06DBD755
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 5972 CapCut_9_1_0_3879_capcutpc_msstore_creatortool.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA CapCut_9_1_0_3879_capcutpc_msstore_creatortool.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5972 CapCut_9_1_0_3879_capcutpc_msstore_creatortool.exe 5972 CapCut_9_1_0_3879_capcutpc_msstore_creatortool.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5972 CapCut_9_1_0_3879_capcutpc_msstore_creatortool.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\CapCut_9_1_0_3879_capcutpc_msstore_creatortool.exe"C:\Users\Admin\AppData\Local\Temp\CapCut_9_1_0_3879_capcutpc_msstore_creatortool.exe"1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5972
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\E9DDA433-AA83-40F3-BEA5-93BAD32DD698\7zip.dll
- Size 1.3MB
- SHA256 fba3a384172ad9c464edec06183f22a6fb6fe746e7fd7ca2cec248105e863995
- MD5 9d9bfb3513ea3dcf27b5cdddd1029d56
- SHA1 9353afb513c1bf9444b5176b8943b87f6a5575b9
- SHA512 6ac2fad5587677f28133f5d18809865b4c7dc07ed4262b3ff785ccd4e88b8ef57c55058c386edfdcef430781b007a76febb23e6e84ed67346bebca1d4f1f2cfe
- SSDEEP 24576:ryG0ZHLMzFsqPzNWvMaJj9KKeuJZ1EYgnrULIk37aJBWHZ5ERusNPu6uEtJP2GTV:YyLN3xu7aJKEM8lV2EH2ILuNZLlGb
- TLSH T142656C1BF67840A4D5E6C074C6276B1AD6B0788B8230A6DF06D85E6F3F13BF19979720
- MD5 SHA1 SHA512 SSDEEP TLSH