Overview

overview

5

Static

static

1

capcut-9-2-0-3931.exe

windows10-ltsc_2021-x64

4

capcut-9-2-0-3931.exe

windows11-21h2-x64

5

capcut-9-2-0-3931.exe

windows11-ltsc_2024-x64

4

Analysis

  • user interaction
    yes
  • max time kernel
    150s
  • max time network
    176s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260513-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    25/08/2026, 22:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    capcut-9-2-0-3931.exe
  • Size 529.8MB
  • Sample260825-2dn2dser5w
  • SHA256 31919ecd4369b5bcdc5b253859582910ab689fa2e9d27c2b6fe4a8f73be188dd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
defense_evasiondiscoverytrojan

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1724,i,1417751475784468367,5519512732499376536,262144 --field-trial-handle=2024,i,5185762432902341555,16163527909987331982,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2020 /prefetch:2
    1⤵
      PID:4608
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1620,i,2174552158891337779,18262271884683635382,524288 --field-trial-handle=2024,i,5185762432902341555,16163527909987331982,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2328 /prefetch:3
      1⤵
      • System Time Discovery
      PID:4072
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,14430657682947166007,4192374145212287011,524288 --field-trial-handle=2024,i,5185762432902341555,16163527909987331982,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2580 /prefetch:8
      1⤵
        PID:4968
      • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
        1⤵
          PID:3588
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --metrics-shmem-handle=3176,i,3832405328609950082,13119451919549382280,2097152 --field-trial-handle=2024,i,5185762432902341555,16163527909987331982,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3236 /prefetch:1
          1⤵
            PID:2880
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --metrics-shmem-handle=3180,i,6144736266135081346,2399690348791628073,2097152 --field-trial-handle=2024,i,5185762432902341555,16163527909987331982,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3256 /prefetch:1
            1⤵
              PID:652
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --metrics-shmem-handle=4292,i,8090304327504028450,13439287384785002749,2097152 --field-trial-handle=2024,i,5185762432902341555,16163527909987331982,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4300 /prefetch:2
              1⤵
                PID:704
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --metrics-shmem-handle=4632,i,139914866458475417,12865783733858814496,2097152 --field-trial-handle=2024,i,5185762432902341555,16163527909987331982,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4596 /prefetch:1
                1⤵
                  PID:116
                • C:\Users\Admin\AppData\Local\Temp\capcut-9-2-0-3931.exe
                  "C:\Users\Admin\AppData\Local\Temp\capcut-9-2-0-3931.exe"
                  1⤵
                  • Loads dropped DLL
                  • Checks whether UAC is enabled
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1748
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5420,i,9281990756672040778,6981658273791725922,524288 --field-trial-handle=2024,i,5185762432902341555,16163527909987331982,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5424 /prefetch:8
                  1⤵
                    PID:3516
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                    1⤵
                      PID:1852
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5440,i,13449763974832557812,18305740199741624753,524288 --field-trial-handle=2024,i,5185762432902341555,16163527909987331982,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5432 /prefetch:8
                      1⤵
                        PID:2164
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5504,i,16275423542605907949,7630100684945605828,524288 --field-trial-handle=2024,i,5185762432902341555,16163527909987331982,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5816 /prefetch:8
                        1⤵
                          PID:468
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,10147465190262142570,16377054101564449376,524288 --field-trial-handle=2024,i,5185762432902341555,16163527909987331982,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5796 /prefetch:8
                          1⤵
                            PID:3252
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4332,i,8213884750410137362,10602719421930721390,262144 --field-trial-handle=2024,i,5185762432902341555,16163527909987331982,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4320 /prefetch:8
                            1⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4468

                          Network

                                MITRE ATT&CK Enterprise v16

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                Network Persistent State
                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                • Size 2KB
                                • SHA256 624a9f263d477a9ddce81ba80507eec325635d802c17b742d2bfabf2ddc55795
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                SCT Auditing Pending Reports
                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                • Size 2B
                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                • MD5 SHA1 SHA512
                                Submit Download

                                7zip.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\E9DDA433-AA83-40F3-BEA5-93BAD32DD698\7zip.dll
                                • Size 1.3MB
                                • SHA256 fba3a384172ad9c464edec06183f22a6fb6fe746e7fd7ca2cec248105e863995
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download