Analysis
- user interaction
yes - max time kernel
34s - max time network
40s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/08/2026, 22:38
Static task
static1
Behavioral task
behavioral1
Sample
Pro.rar
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Pro.rar
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target Pro.rar
- Size 100.0MB
- Sample260830-2kh4qaar31
- SHA256 86d94d7dd0248baa179857729651bd44a08384cc69f2a5f3165e58565d27fb33
- MD5 118f37e8d8fa16ea07affcf753d1237f
- SHA1 3c2a8dec5210f4c0f719d8c3f4f6641fff1fdaed
- SHA512 a1d6a3bfd80d4be5d7c79087769d504668bdda220dfd67441c3581041ee801c097d5568f4e90b2f4d252e7541805e3d4d2e7a7ea770e4e52ac1097e59a126461
- SSDEEP 3145728:DdMroQwgdNsOtS6wXJi3PWYBlVFxoINl4B1Vb5:yLdNHS6wXU3DVxoINlY
- TLSH T1A73833AFC0DBBB646313C4542CDC2555D25B4B2203EDCA66BE713D0E3B6538FAB8A251
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1848 Capcut pro activator.exe - Loads dropped DLL 1 IoCs
pid Process 1848 Capcut pro activator.exe - Modifies registry class 25 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PotterDraw.Document\shell\printto\command\ = "C:\\Users\\Admin\\Desktop\\Pro\\CAPCUT~1.EXE /ddenoshow" Capcut pro activator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.pdr\ShellNew Capcut pro activator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PotterDraw.Document\shell\printto\ddeexec Capcut pro activator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PotterDraw.Document\ = "PotterDraw.Document" Capcut pro activator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.pdr Capcut pro activator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PotterDraw.Document\DefaultIcon\ = "C:\\Users\\Admin\\Desktop\\Pro\\CAPCUT~1.EXE,1" Capcut pro activator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PotterDraw.Document\shell Capcut pro activator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PotterDraw.Document\shell\print\ddeexec Capcut pro activator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PotterDraw.Document\shell\printto Capcut pro activator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pdr\ = "PotterDraw.Document" Capcut pro activator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pdr\ShellNew\NullFile Capcut pro activator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PotterDraw.Document Capcut pro activator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PotterDraw.Document\AppUserModelID = "AnalSoftware.PotterDraw.PotterDraw.1.0" Capcut pro activator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PotterDraw.Document\DefaultIcon Capcut pro activator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PotterDraw.Document\shell\open\ddeexec Capcut pro activator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PotterDraw.Document\shell\open Capcut pro activator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PotterDraw.Document\shell\print Capcut pro activator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PotterDraw.Document\shell\print\ddeexec\ = "[print(\"%1\")]" Capcut pro activator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PotterDraw.Document\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]" Capcut pro activator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PotterDraw.Document\shell\open\ddeexec\ = "[open(\"%1\")]" Capcut pro activator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PotterDraw.Document\shell\open\command Capcut pro activator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PotterDraw.Document\shell\open\command\ = "C:\\Users\\Admin\\Desktop\\Pro\\CAPCUT~1.EXE /dde" Capcut pro activator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PotterDraw.Document\shell\print\command Capcut pro activator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PotterDraw.Document\shell\print\command\ = "C:\\Users\\Admin\\Desktop\\Pro\\CAPCUT~1.EXE /ddenoshow" Capcut pro activator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PotterDraw.Document\shell\printto\command Capcut pro activator.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1848 Capcut pro activator.exe 1848 Capcut pro activator.exe 1848 Capcut pro activator.exe 1848 Capcut pro activator.exe 1848 Capcut pro activator.exe 1848 Capcut pro activator.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3164 7zFM.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 3164 7zFM.exe Token: 35 3164 7zFM.exe Token: SeSecurityPrivilege 3164 7zFM.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3164 7zFM.exe 3164 7zFM.exe 1848 Capcut pro activator.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1848 Capcut pro activator.exe 1848 Capcut pro activator.exe 1848 Capcut pro activator.exe
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Pro.rar"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3164
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:116
-
C:\Users\Admin\Desktop\Pro\Capcut pro activator.exe"C:\Users\Admin\Desktop\Pro\Capcut pro activator.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1848
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\Desktop\Pro\Capcut pro activator.exe
- Size 5.1MB
- SHA256 496d1c75257ec33af07d2095084736d71837f5191615ca6b166ca12097e30863
- MD5 8a3871a90593aa3d4e57b33cefe9f070
- SHA1 307f20156cc36eb7d530dcbe025c5ecc4302ad26
- SHA512 2daf9d8a5d5a92e192276180a6f256f15d13451e6603c87b99aa6475f865f9c6e43988ff1ed00ef9d818416a9a53b316732a8c7d74e02eef30ac4f76f3147508
- SSDEEP 98304:PyI2Aad5sKVGtWtfFVj7/n5FLOAkGkzdnEVomFHKnP:PyFAUd5FLOyomFHKnP
- TLSH T1BB468D117AEC40D8E0A6F179CAD6C55BD6B77CE12A32C35F005A265B9F33B410E5AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\Pro\d3dx9_26.dll
- Size 4.9MB
- SHA256 3b526f3c36756ff20a6823cd42f934a2226c41339afdc7b4a6f2e8ae91661060
- MD5 11f09ad6027df866b03cc9b047fd6ead
- SHA1 cc3d8d6bdf55cf495fb76bd9cc6e2392278c4283
- SHA512 ffc0b7a34f9a1e848ca7e7c40bf9b7de5565568b6a9db6de0b25f78df14e70fde94147b473e1aa4da7a91b4b06bf01e352034f4cc1863af34ef074e5ef9cc85c
- SSDEEP 49152:lviQgqf8Hc0QhI74w+A+QYCuzLpLVonD1jnvtFlXiAgccbytf2ys6nuXsam8ePA+:L1iHuz3kBXiOcbyBrsUucOeq/I
- TLSH T1EC365B07B5C14964D49AC639E27E6722E760BC8CCF3373EB1E14AAB51E253E4AE34744
- MD5 SHA1 SHA512 SSDEEP TLSH