7ee2c000166735fd9eccbaa0abeddba984633b35d3c678838b9e71bd388cf008

Analysis

max time kernel
150s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 07:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MAXON Ecosystem.exe
Size 936KB
Sample260702-jcd6pady6x
SHA256 7ee2c000166735fd9eccbaa0abeddba984633b35d3c678838b9e71bd388cf008
MD5 5a7d4c08f60c8673a40ed59f2735b58d
SHA1 bb7cb89109bba6160115efee8d0bbc4cecbb08c0
SHA512 c2b7f1c7d5856b929d05f1b57edb47c4b0ff194351b1494002dc4bc2bc243e98c6cc6d64c68a71444f93697e14fce1ed36fc74d08bb606db0c797775ecd92bdc
SSDEEP 24576:7R/CoYQiCoEJV65AOig4BdvcR1fGxbPpYCS8C:7IVfCoEJXHgU0R1aPO9
TLSH
T1A5159E29922C90E6FFB6927428F30E477CA078690BB557CF12BD7C1536179E9983A34C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion persistence

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable = "1"	MAXON Ecosystem.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	MAXON Ecosystem.exe

Drops file in Program Files directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Maxon Cinema 4D 2024\Cinema 4D Team Render Client.exe.local	MAXON Ecosystem.exe
File opened for modification	C:\Program Files\Maxon Cinema 4D 2024\Cinema 4D Team Render Server.exe.local	MAXON Ecosystem.exe
File opened for modification	C:\Program Files\Maxon Cinema 4D 2026\Commandline.exe.local	MAXON Ecosystem.exe
File opened for modification	C:\Program Files\Maxon Cinema 4D 2024\c4dpy.exe.local	MAXON Ecosystem.exe
File opened for modification	C:\Program Files\Maxon Cinema 4D 2024\Commandline.exe.local	MAXON Ecosystem.exe
File opened for modification	C:\Program Files\Maxon Cinema 4D 2025\Cinema 4D Team Render Client.exe.local	MAXON Ecosystem.exe
File created	C:\Program Files\Maxon Cinema 4D 2025\Cinema 4D Team Render Client.exe.local\wintrust.dll	MAXON Ecosystem.exe
File created	C:\Program Files\Maxon Cinema 4D 2026\Cinema 4D.exe.local\wintrust.dll	MAXON Ecosystem.exe
File created	C:\Program Files\Maxon Cinema 4D 2026\Commandline.exe.local\wintrust.dll	MAXON Ecosystem.exe
File created	C:\Program Files\Maxon Cinema 4D 2024\Cinema 4D Team Render Client.exe.local\wintrust.dll	MAXON Ecosystem.exe
File opened for modification	C:\Program Files\Maxon Cinema 4D 2025\c4dpy.exe.local	MAXON Ecosystem.exe
File opened for modification	C:\Program Files\Maxon Cinema 4D 2025\Commandline.exe.local	MAXON Ecosystem.exe
File opened for modification	C:\Program Files\Maxon Cinema 4D 2026\Cinema 4D.exe.local	MAXON Ecosystem.exe
File created	C:\Program Files\Maxon Cinema 4D 2024\c4dpy.exe.local\wintrust.dll	MAXON Ecosystem.exe
File created	C:\Program Files\Maxon Cinema 4D 2024\Commandline.exe.local\wintrust.dll	MAXON Ecosystem.exe
File created	C:\Program Files\Maxon Cinema 4D 2025\Cinema 4D Team Render Server.exe.local\wintrust.dll	MAXON Ecosystem.exe
File created	C:\Program Files\Maxon Cinema 4D 2025\Commandline.exe.local\wintrust.dll	MAXON Ecosystem.exe
File created	C:\Program Files\Maxon Cinema 4D 2026\Cinema 4D Team Render Client.exe.local\wintrust.dll	MAXON Ecosystem.exe
File created	C:\Program Files\Maxon Cinema 4D 2026\Cinema 4D Team Render Server.exe.local\wintrust.dll	MAXON Ecosystem.exe
File opened for modification	C:\Program Files\Maxon Cinema 4D 2024\Cinema 4D.exe.local	MAXON Ecosystem.exe
File created	C:\Program Files\Maxon Cinema 4D 2025\c4dpy.exe.local\wintrust.dll	MAXON Ecosystem.exe
File created	C:\Program Files\Maxon Cinema 4D 2024\Cinema 4D.exe.local\wintrust.dll	MAXON Ecosystem.exe
File opened for modification	C:\Program Files\Maxon Cinema 4D 2026\Cinema 4D Team Render Server.exe.local	MAXON Ecosystem.exe
File created	C:\Program Files\Maxon Cinema 4D 2024\Cinema 4D Team Render Server.exe.local\wintrust.dll	MAXON Ecosystem.exe
File opened for modification	C:\Program Files\Maxon Cinema 4D 2025\Cinema 4D Team Render Server.exe.local	MAXON Ecosystem.exe
File opened for modification	C:\Program Files\Maxon Cinema 4D 2025\Cinema 4D.exe.local	MAXON Ecosystem.exe
File created	C:\Program Files\Maxon Cinema 4D 2025\Cinema 4D.exe.local\wintrust.dll	MAXON Ecosystem.exe
File opened for modification	C:\Program Files\Maxon Cinema 4D 2026\c4dpy.exe.local	MAXON Ecosystem.exe
File created	C:\Program Files\Maxon Cinema 4D 2026\c4dpy.exe.local\wintrust.dll	MAXON Ecosystem.exe
File opened for modification	C:\Program Files\Maxon Cinema 4D 2026\Cinema 4D Team Render Client.exe.local	MAXON Ecosystem.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6136	sc.exe
5844	sc.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
3732	taskkill.exe
3844	taskkill.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3732	taskkill.exe
Token: SeDebugPrivilege	3844	taskkill.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 3468 wrote to memory of 3732	3468	MAXON Ecosystem.exe	88
PID 3468 wrote to memory of 3844	3468	MAXON Ecosystem.exe	91
PID 3468 wrote to memory of 4208	3468	MAXON Ecosystem.exe	93
PID 3468 wrote to memory of 1268	3468	MAXON Ecosystem.exe	95
PID 3468 wrote to memory of 2916	3468	MAXON Ecosystem.exe	97
PID 3468 wrote to memory of 5624	3468	MAXON Ecosystem.exe	99
PID 3468 wrote to memory of 5408	3468	MAXON Ecosystem.exe	101
PID 3468 wrote to memory of 2012	3468	MAXON Ecosystem.exe	103
PID 3468 wrote to memory of 5484	3468	MAXON Ecosystem.exe	105
PID 3468 wrote to memory of 1524	3468	MAXON Ecosystem.exe	107
PID 3468 wrote to memory of 1564	3468	MAXON Ecosystem.exe	109
PID 3468 wrote to memory of 5992	3468	MAXON Ecosystem.exe	111
PID 3468 wrote to memory of 2596	3468	MAXON Ecosystem.exe	113
PID 3468 wrote to memory of 5544	3468	MAXON Ecosystem.exe	115
PID 3468 wrote to memory of 2360	3468	MAXON Ecosystem.exe	117
PID 3468 wrote to memory of 5552	3468	MAXON Ecosystem.exe	119
PID 3468 wrote to memory of 5540	3468	MAXON Ecosystem.exe	121
PID 3468 wrote to memory of 6136	3468	MAXON Ecosystem.exe	123
PID 3468 wrote to memory of 5844	3468	MAXON Ecosystem.exe	125

Views/modifies file attributes 1 TTPs 15 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2916	attrib.exe
5624	attrib.exe
5484	attrib.exe
1564	attrib.exe
2596	attrib.exe
4208	attrib.exe
2012	attrib.exe
5540	attrib.exe
2360	attrib.exe
5552	attrib.exe
5408	attrib.exe
1524	attrib.exe
5992	attrib.exe
1268	attrib.exe
5544	attrib.exe

C:\Users\Admin\AppData\Local\Temp\MAXON Ecosystem.exe
"C:\Users\Admin\AppData\Local\Temp\MAXON Ecosystem.exe"
1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM "MxNotify.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3732
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM "Maxon.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3844
- C:\Windows\SYSTEM32\attrib.exe
  attrib -H -S "C:\Program Files\Maxon Cinema 4D 2024\c4dpy.exe.local" /D /S
  2⤵
  - Views/modifies file attributes
  PID:4208
- C:\Windows\SYSTEM32\attrib.exe
  attrib -H -S "C:\Program Files\Maxon Cinema 4D 2024\Cinema 4D Team Render Client.exe.local" /D /S
  2⤵
  - Views/modifies file attributes
  PID:1268
- C:\Windows\SYSTEM32\attrib.exe
  attrib -H -S "C:\Program Files\Maxon Cinema 4D 2024\Cinema 4D Team Render Server.exe.local" /D /S
  2⤵
  - Views/modifies file attributes
  PID:2916
- C:\Windows\SYSTEM32\attrib.exe
  attrib -H -S "C:\Program Files\Maxon Cinema 4D 2024\Cinema 4D.exe.local" /D /S
  2⤵
  - Views/modifies file attributes
  PID:5624
- C:\Windows\SYSTEM32\attrib.exe
  attrib -H -S "C:\Program Files\Maxon Cinema 4D 2024\Commandline.exe.local" /D /S
  2⤵
  - Views/modifies file attributes
  PID:5408
- C:\Windows\SYSTEM32\attrib.exe
  attrib -H -S "C:\Program Files\Maxon Cinema 4D 2025\c4dpy.exe.local" /D /S
  2⤵
  - Views/modifies file attributes
  PID:2012
- C:\Windows\SYSTEM32\attrib.exe
  attrib -H -S "C:\Program Files\Maxon Cinema 4D 2025\Cinema 4D Team Render Client.exe.local" /D /S
  2⤵
  - Views/modifies file attributes
  PID:5484
- C:\Windows\SYSTEM32\attrib.exe
  attrib -H -S "C:\Program Files\Maxon Cinema 4D 2025\Cinema 4D Team Render Server.exe.local" /D /S
  2⤵
  - Views/modifies file attributes
  PID:1524
- C:\Windows\SYSTEM32\attrib.exe
  attrib -H -S "C:\Program Files\Maxon Cinema 4D 2025\Cinema 4D.exe.local" /D /S
  2⤵
  - Views/modifies file attributes
  PID:1564
- C:\Windows\SYSTEM32\attrib.exe
  attrib -H -S "C:\Program Files\Maxon Cinema 4D 2025\Commandline.exe.local" /D /S
  2⤵
  - Views/modifies file attributes
  PID:5992
- C:\Windows\SYSTEM32\attrib.exe
  attrib -H -S "C:\Program Files\Maxon Cinema 4D 2026\c4dpy.exe.local" /D /S
  2⤵
  - Views/modifies file attributes
  PID:2596
- C:\Windows\SYSTEM32\attrib.exe
  attrib -H -S "C:\Program Files\Maxon Cinema 4D 2026\Cinema 4D Team Render Client.exe.local" /D /S
  2⤵
  - Views/modifies file attributes
  PID:5544
- C:\Windows\SYSTEM32\attrib.exe
  attrib -H -S "C:\Program Files\Maxon Cinema 4D 2026\Cinema 4D Team Render Server.exe.local" /D /S
  2⤵
  - Views/modifies file attributes
  PID:2360
- C:\Windows\SYSTEM32\attrib.exe
  attrib -H -S "C:\Program Files\Maxon Cinema 4D 2026\Cinema 4D.exe.local" /D /S
  2⤵
  - Views/modifies file attributes
  PID:5552
- C:\Windows\SYSTEM32\attrib.exe
  attrib -H -S "C:\Program Files\Maxon Cinema 4D 2026\Commandline.exe.local" /D /S
  2⤵
  - Views/modifies file attributes
  PID:5540
- C:\Windows\SYSTEM32\sc.exe
  sc start "Maxon Install Helper"
  2⤵
  - Launches sc.exe
  PID:6136
- C:\Windows\SYSTEM32\sc.exe
  sc start "Red Giant Service"
  2⤵
  - Launches sc.exe
  PID:5844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads