Analysis
- max time kernel
150s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/08/2026, 22:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Creative_EAX_Settings_1.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
Creative_EAX_Settings_1.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target Creative_EAX_Settings_1.exe
- Size 7.0MB
- Sample260825-1185eaba68
- SHA256 86d9f77cb460b9e8f049ff344f814fa4cd71bf73701a65ef123e32c28e3d07ab
- MD5 ee0e870ddeae89b7a462b0b764756bb3
- SHA1 f42e58c3d16788050dc7df492f513fa46bffa0c1
- SHA512 bb3556872188d21d5106620b943604365b22f326a57ab3533d60e6a746b804fc404a216a4996735ffa66ca4fd36b16053bdbeb34745c66e2588c55c06706dfb2
- SSDEEP 196608:tYwES/pRYy6H62j9Diyol4QwCVvbxIaQw:hpRYymhjxYl2qvNNN
- TLSH T17476012173E50952D3BF5F75E0B109018BB1B7533746E74F298295A91EA3B80FA12F2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
pid Process 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe 4896 Creative_EAX_Settings_1.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4896 Creative_EAX_Settings_1.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4896 wrote to memory of 4476 4896 Creative_EAX_Settings_1.exe 89 PID 4476 wrote to memory of 3076 4476 csc.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\Creative_EAX_Settings_1.exe"C:\Users\Admin\AppData\Local\Temp\Creative_EAX_Settings_1.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\Creative_EAX_Settings_1.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_d14e831107ce407691b1d0e28de94dee.cs"2⤵
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6548.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCECDFFE75AE149CFA59980B86AAD642.TMP"3⤵PID:3076
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\.net\Creative_EAX_Settings_1\Hrqkp01comoaZrSEHPNWNWSdYvuIbfY=\Creative EAX Settings.dll
- Size 5.9MB
- SHA256 11d7ac9e8dc6d86db4bce99452d2d6712cbaba21927606946d1f3edfc332f113
- MD5 6e658862ac80ac47c15652a832399611
- SHA1 41cda27220677c8177fc8b14d6377ce87bbdafc5
- SHA512 7a5ef303e2e3763ce48c0b90e402648fd6f861222dd850af6e6b6898757e191f0d005519836039de90f20129b8eafad3958b4e4c3dbc638ed98163c3b81f436a
- SSDEEP 98304:xcpGXPPq0iwEAf/UaRYJ0s1DH62d9C4Xla67+y34sve14QwmaAVZRb0qzIXp:lYwES/pRYy6H62j9Diyol4QwCVvbxI
- TLSH T1DD561235B7E70C42D3AF1F76E1714A159AB6B7532781A74F204380690EA3B94FA02F6D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RES6548.tmp
- Size 1KB
- SHA256 3907d22e2c5d8f280310cd3ba0c1a55fb0b95398fef26de4b9d14778eac3a994
- MD5 5fe78c2af13dcee4d219a1b4b13e4a8d
- SHA1 4865343d61dbbebab4b77ec4b74250aeaf0fe1a5
- SHA512 fba5c46568e4e3929a59ee792c9748cfb096bca81491b590fb04581900bb7b7b18c40450f6b259f93835828d69f811a2a11279b424863ed5fa334fc18233114f
- TLSH T18141404183DC8B1FF172473169F79319A678BE959EAA874D75C8123E1E22740CDC32B1
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Users\Admin\AppData\Local\Temp\CSCCECDFFE75AE149CFA59980B86AAD642.TMP
- Size 1KB
- SHA256 5803d183155a5aca0387e0be93dfc1acb1cc6e319e56bf35b1daefa3b080ed2f
- MD5 e73e23b8501904fb8d6f16ebadb6a99d
- SHA1 49a45bb4e350faf31914dcaccc77ed7cd68efdc8
- SHA512 f9d307d57eacad4c175290ddb49344f46edbae785d7de839c9098834bbd59ac6736fb006dfd32d2668444b5d5474492316a5682753e462727aac675cca062772
- TLSH T10021AD86A2E8461DF1F3477069F69362916CBE96DD6A83EC34C8175F1B2560085836B1
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_d14e831107ce407691b1d0e28de94dee.cs
- Size 4KB
- SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
- MD5 b7d40eb7e1328728d647678e1ea0a4dc
- SHA1 43850a88c7f012df9e7349886497271c83e2bdaa
- SHA512 a531df01588357b0d669d563fada88e78b0b3d1453e40605a872e9fba6091bb46a623b0817aafab946b01f92d5810ed7eb97ed9373eaeacb9970b316278667a4
- SSDEEP 96:noO1V0E4Yt1YOC3idfygNzkfK1Sg5vpVIHZZ:jl481hC3i1ygNzw5g5vpVw3
- TLSH T19F911298954DA2D69872223AFB03D15BF603103322FF9A20FEADD3505F3D0018678F69
- MD5 SHA1 SHA512 SSDEEP TLSH