Analysis
- max time kernel
150s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/09/2026, 15:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Creative EAX Settings (1).exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Creative EAX Settings (1).exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target Creative EAX Settings (1).exe
- Size 7.0MB
- Sample260908-sdphgsswbv
- SHA256 86d9f77cb460b9e8f049ff344f814fa4cd71bf73701a65ef123e32c28e3d07ab
- MD5 ee0e870ddeae89b7a462b0b764756bb3
- SHA1 f42e58c3d16788050dc7df492f513fa46bffa0c1
- SHA512 bb3556872188d21d5106620b943604365b22f326a57ab3533d60e6a746b804fc404a216a4996735ffa66ca4fd36b16053bdbeb34745c66e2588c55c06706dfb2
- SSDEEP 196608:tYwES/pRYy6H62j9Diyol4QwCVvbxIaQw:hpRYymhjxYl2qvNNN
- TLSH T17476012173E50952D3BF5F75E0B109018BB1B7533746E74F298295A91EA3B80FA12F2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
pid Process 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe 832 Creative EAX Settings (1).exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 832 Creative EAX Settings (1).exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 832 wrote to memory of 3080 832 Creative EAX Settings (1).exe 89 PID 3080 wrote to memory of 3284 3080 csc.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\Creative EAX Settings (1).exe"C:\Users\Admin\AppData\Local\Temp\Creative EAX Settings (1).exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\Creative EAX Settings (1).exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_4f0398e5a08c4910af960372e1603d53.cs"2⤵
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6363.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC601135E57A0D4E84AABE1DFE4E64B111.TMP"3⤵PID:3284
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5668
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\.net\Creative EAX Settings (1)\Hrqkp01comoaZrSEHPNWNWSdYvuIbfY=\Creative EAX Settings.dll
- Size 5.9MB
- SHA256 11d7ac9e8dc6d86db4bce99452d2d6712cbaba21927606946d1f3edfc332f113
- MD5 6e658862ac80ac47c15652a832399611
- SHA1 41cda27220677c8177fc8b14d6377ce87bbdafc5
- SHA512 7a5ef303e2e3763ce48c0b90e402648fd6f861222dd850af6e6b6898757e191f0d005519836039de90f20129b8eafad3958b4e4c3dbc638ed98163c3b81f436a
- SSDEEP 98304:xcpGXPPq0iwEAf/UaRYJ0s1DH62d9C4Xla67+y34sve14QwmaAVZRb0qzIXp:lYwES/pRYy6H62j9Diyol4QwCVvbxI
- TLSH T1DD561235B7E70C42D3AF1F76E1714A159AB6B7532781A74F204380690EA3B94FA02F6D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RES6363.tmp
- Size 1KB
- SHA256 c4cef3b1b9794b3b5681767d7e0a5076877506838b0c9c2f347bc5ff8d470dc7
- MD5 906da263c0d6cd9a14fcc1c0dba4b714
- SHA1 96b233dc70360e9b7232258d347c56a0af6057b9
- SHA512 4d36360977f316405e7f64d39b19e44d49f9a429d4dbcfdff1557479e7d017badb27fe0ff01151290283d81d4e6f9f696fff35d3bbcf0a26939ba9363624c814
- TLSH T19341424183D84B1FF172473169FB9319A274BE95DEAA979EB584022E1F22740DEC3371
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Users\Admin\AppData\Local\Temp\CSC601135E57A0D4E84AABE1DFE4E64B111.TMP
- Size 1KB
- SHA256 ddf40c952d9416f9645a6b8d92fb0ebf30cd104e87e0542911fd028614b36a9d
- MD5 cfa7d282d45ecd896414c2479eb29ae5
- SHA1 b8a0cbf748c51e2be20eac53df3742db0b204027
- SHA512 79ef38a261a6a8a5618796b4884a5522024170a43b7105f02dc8355f9de5df810276b759f68f8b937e6e3e927bf41b6f567c0c918e0d053fb5ee72e18c310443
- TLSH T13D21AD8292E8461EF1F3477069F683639168BE55CC7A83DC74D8175F5B25A0085937B1
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_4f0398e5a08c4910af960372e1603d53.cs
- Size 4KB
- SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
- MD5 b7d40eb7e1328728d647678e1ea0a4dc
- SHA1 43850a88c7f012df9e7349886497271c83e2bdaa
- SHA512 a531df01588357b0d669d563fada88e78b0b3d1453e40605a872e9fba6091bb46a623b0817aafab946b01f92d5810ed7eb97ed9373eaeacb9970b316278667a4
- SSDEEP 96:noO1V0E4Yt1YOC3idfygNzkfK1Sg5vpVIHZZ:jl481hC3i1ygNzw5g5vpVw3
- TLSH T19F911298954DA2D69872223AFB03D15BF603103322FF9A20FEADD3505F3D0018678F69
- MD5 SHA1 SHA512 SSDEEP TLSH