Analysis
- user interaction
yes - max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
26/08/2026, 22:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Creative EAX Settings (1).exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Creative EAX Settings (1).exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
General
- Target Creative EAX Settings (1).exe
- Size 7.0MB
- Sample260826-2bfbgaff78
- SHA256 86d9f77cb460b9e8f049ff344f814fa4cd71bf73701a65ef123e32c28e3d07ab
- MD5 ee0e870ddeae89b7a462b0b764756bb3
- SHA1 f42e58c3d16788050dc7df492f513fa46bffa0c1
- SHA512 bb3556872188d21d5106620b943604365b22f326a57ab3533d60e6a746b804fc404a216a4996735ffa66ca4fd36b16053bdbeb34745c66e2588c55c06706dfb2
- SSDEEP 196608:tYwES/pRYy6H62j9Diyol4QwCVvbxIaQw:hpRYymhjxYl2qvNNN
- TLSH T17476012173E50952D3BF5F75E0B109018BB1B7533746E74F298295A91EA3B80FA12F2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation Creative EAX Settings (1).exe - Loads dropped DLL 2 IoCs
pid Process 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe 2636 Creative EAX Settings (1).exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2636 Creative EAX Settings (1).exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2636 wrote to memory of 632 2636 Creative EAX Settings (1).exe 86 PID 632 wrote to memory of 900 632 csc.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\Creative EAX Settings (1).exe"C:\Users\Admin\AppData\Local\Temp\Creative EAX Settings (1).exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\Creative EAX Settings (1).exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_55e954e6c98f427d9b360028762a274b.cs"2⤵
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3999.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC96796EFC7024ED088C581533723AC76.TMP"3⤵PID:900
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\.net\Creative EAX Settings (1)\Hrqkp01comoaZrSEHPNWNWSdYvuIbfY=\Creative EAX Settings.dll
- Size 5.9MB
- SHA256 11d7ac9e8dc6d86db4bce99452d2d6712cbaba21927606946d1f3edfc332f113
- MD5 6e658862ac80ac47c15652a832399611
- SHA1 41cda27220677c8177fc8b14d6377ce87bbdafc5
- SHA512 7a5ef303e2e3763ce48c0b90e402648fd6f861222dd850af6e6b6898757e191f0d005519836039de90f20129b8eafad3958b4e4c3dbc638ed98163c3b81f436a
- SSDEEP 98304:xcpGXPPq0iwEAf/UaRYJ0s1DH62d9C4Xla67+y34sve14QwmaAVZRb0qzIXp:lYwES/pRYy6H62j9Diyol4QwCVvbxI
- TLSH T1DD561235B7E70C42D3AF1F76E1714A159AB6B7532781A74F204380690EA3B94FA02F6D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RES3999.tmp
- Size 1KB
- SHA256 b612ee99c5866ca6c7549c9a5998e75fee7a113bbf3f18889098a55c7698af75
- MD5 fed66029aa81d4e5a5d504e11ca9aa4b
- SHA1 b461542c57841518cd87eddad7babe219cb92fd5
- SHA512 5dc821e15f34ef115bccb402696e6bc7d1fa897346344da44737154a25449c4a5f67056c71ac1b9250835208775b65decb92bedb4ec06a8839d687e2f06d992f
- TLSH T1DF41614083D84B1EF1B2073129FB5329A278BE94DEAA434EB184122E1F12740CDC37B1
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Users\Admin\AppData\Local\Temp\CSCC96796EFC7024ED088C581533723AC76.TMP
- Size 1KB
- SHA256 ddf40c952d9416f9645a6b8d92fb0ebf30cd104e87e0542911fd028614b36a9d
- MD5 cfa7d282d45ecd896414c2479eb29ae5
- SHA1 b8a0cbf748c51e2be20eac53df3742db0b204027
- SHA512 79ef38a261a6a8a5618796b4884a5522024170a43b7105f02dc8355f9de5df810276b759f68f8b937e6e3e927bf41b6f567c0c918e0d053fb5ee72e18c310443
- TLSH T13D21AD8292E8461EF1F3477069F683639168BE55CC7A83DC74D8175F5B25A0085937B1
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_55e954e6c98f427d9b360028762a274b.cs
- Size 4KB
- SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
- MD5 b7d40eb7e1328728d647678e1ea0a4dc
- SHA1 43850a88c7f012df9e7349886497271c83e2bdaa
- SHA512 a531df01588357b0d669d563fada88e78b0b3d1453e40605a872e9fba6091bb46a623b0817aafab946b01f92d5810ed7eb97ed9373eaeacb9970b316278667a4
- SSDEEP 96:noO1V0E4Yt1YOC3idfygNzkfK1Sg5vpVIHZZ:jl481hC3i1ygNzw5g5vpVw3
- TLSH T19F911298954DA2D69872223AFB03D15BF603103322FF9A20FEADD3505F3D0018678F69
- MD5 SHA1 SHA512 SSDEEP TLSH