Analysis
- user interaction
yes - max time kernel
148s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 17:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Creative EAX.rar
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Creative EAX.rar
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
Creative EAX/EAX Console.exe
Resource
win10v2004-20260513-en
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Creative EAX/EAX Console.exe
Resource
win11ltsc2024-20260709-en
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Creative EAX/VoicemeeterRemote64.dll
Resource
win10v2004-20260513-en
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Creative EAX/VoicemeeterRemote64.dll
Resource
win11ltsc2024-20260709-en
0 signatures
150 seconds
General
- Target Creative EAX.rar
- Size 214KB
- Sample260809-wbe3tabf68
- SHA256 6d5ebdafb2637878c045fd0c970af46c007f10b47d74f1296a8d6c76d08410ec
- MD5 fd46545543f2884efb006c56bf604dd6
- SHA1 a37358de7af5501c2428f3ca869bb9c1d03f6e0c
- SHA512 4062f4576a2fbee3ffcba1ac8a9c8488e50b5a2a0ae55d66f29b5bf196498751f918fa2f2d3e501733041c54c59f4b686b5cbd3b1a6f1fcc3acaa2f6362e279a
- SSDEEP 3072:/r20YwmjSwVXI1DtoMUYq2JNo14V68979NHV6LqI5Cebj6yXWqJcX59/cNop:/q0Yw4RlYqkn5IqIP6y/cJ9ENop
- TLSH T16A2423C318508595ED7153BDA12692EF10A3469CD2B58AFFB872B85B3F2C7023EB15D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5224 EAX Console.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 7zFM.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4280 7zFM.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 4280 7zFM.exe Token: 35 4280 7zFM.exe Token: SeSecurityPrivilege 4280 7zFM.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4280 7zFM.exe 4280 7zFM.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4280 wrote to memory of 5224 4280 7zFM.exe 91
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Creative EAX.rar"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\7zO8B0F916B\EAX Console.exe"C:\Users\Admin\AppData\Local\Temp\7zO8B0F916B\EAX Console.exe"2⤵
- Executes dropped EXE
PID:5224
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\7zO8B0F916B\EAX Console.exe
- Size 144KB
- SHA256 4daaba1a088083a250497b6c159d0e21580657cd0c4e3881518bcfac5f8b5fc1
- MD5 38f427b3fb090d2a24d136c8866bfbe5
- SHA1 cd4c60fe491c53c7723e164dc979c52c1efc6cae
- SHA512 9f491fbae823a7de4d791a35e8adfd2bb4bcfa8957ee8e0ceb6c7f9ebd72fb2845a6f548cce237199760ae48b38ce721d68c38df3c6c5062c70e2f0e9df14057
- SSDEEP 3072:mJ26XZfdwqCEyUVH7r7zmdiJKxzjbkPx3NDhndbDgKwClQHQQ:U+LUVH7rkiQtjbkPv9ZgKwC
- TLSH T1ADE302A37D888D3BD63F9A7201A490105EB1A506B151D7AA19DC30CF16B3FCA5F62F63
- MD5 SHA1 SHA512 SSDEEP TLSH