756791be4475c670869d4987a1abcbdbcec76641615e5e8d1177775e0370e1aa

Analysis

user interaction
yes
max time kernel
149s
max time network
114s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/04/2026, 17:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Creative EAX Setting (4).rar
Size 1.5MB
Sample260418-v7eaqac161
SHA256 756791be4475c670869d4987a1abcbdbcec76641615e5e8d1177775e0370e1aa
MD5 185add24a85b5c0b622ced8c38f0b037
SHA1 da832f89606db0412c30d43c013168c800bcd6bc
SHA512 b3a92fbe474999e8d5f664911a4c851f16dc19cb89dc8b5dbe693d6ee24a2155361db26a7be00ca30caaf12219f0039411972040b5840602f2d731e178cc97f1
SSDEEP 24576:ybgv4DUq7qjR2Wvv7V/7LHfc86h+KjR3mHYZSBVFFvNXf+Im+9IRWgwj9S:ybgv4DUqM7VDL4h+uRYdNNWsgwj0
TLSH
T1117533EE57BE53F1917926450474AFD6208E088EB2542FDF8EA91B4C37E60548BE1CF2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4236	Creative EAX Setting.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3616	4236	WerFault.exe	79

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Creative EAX Setting.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4972	7zFM.exe
4972	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4972	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	4972	7zFM.exe
Token: 35	4972	7zFM.exe
Token: SeSecurityPrivilege	4972	7zFM.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4972	7zFM.exe
4972	7zFM.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 4236	4972	7zFM.exe	79

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Creative EAX Setting (4).rar"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Users\Admin\AppData\Local\Temp\7zOC63F5668\Creative EAX Setting.exe
  "C:\Users\Admin\AppData\Local\Temp\7zOC63F5668\Creative EAX Setting.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4236
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 896
    3⤵
    - Program crash
    PID:3616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4236 -ip 4236
1⤵
PID:2744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Creative EAX Setting.exe

Path C:\Users\Admin\AppData\Local\Temp\7zOC63F5668\Creative EAX Setting.exe
Size 1.3MB
SHA256 cf27b5e3709d59aa9f8ac8b48e4eb20876f5d769300b1ab4d5bfa21b69d24fee
MD5 63ab4473d5c90fa1efebf5c61f517589
SHA1 31f31b57b3b94e5e3da26036ccd1e9fb346738ff
SHA512 32d7499e758cba3ae8de27ee7c069383dcac7a43640fffe7115718223b745ee2aabb8fc67e3953f2047be14491f04429017b622dd89f28edec61b41674cb9d13
SSDEEP 24576:hHESP3uRi8kctcmrAA6ZHG5awz/Q+I1eP4YkON9F0RHESP3uRi8kctcmrUF6Z:hHES0LhprAA65G5awz/dI1eWODF0RHEv
TLSH
T125559CA2E50001EEDD3E97B1A4373F86191674FAC9F5498DB88870A58AD7353093FD3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4236-14-0x0000000000530000-0x0000000000678000-memory.dmp

Download

memory/4236-15-0x0000000005750000-0x0000000005CF6000-memory.dmp

Download

memory/4236-16-0x00000000051A0000-0x0000000005232000-memory.dmp

Download

memory/4972-0-0x0000015110CA0000-0x0000015110DBE000-memory.dmp

Download

memory/4972-1-0x0000015110CA0000-0x0000015110DBE000-memory.dmp

Download

memory/4972-17-0x0000015110CA0000-0x0000015110DBE000-memory.dmp

Download