Analysis
- max time kernel
149s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/10/2026, 15:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Creative EAX Settings.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
Creative EAX Settings.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target Creative EAX Settings.exe
- Size 7.0MB
- Sample261003-tabb5aea78
- SHA256 86d9f77cb460b9e8f049ff344f814fa4cd71bf73701a65ef123e32c28e3d07ab
- MD5 ee0e870ddeae89b7a462b0b764756bb3
- SHA1 f42e58c3d16788050dc7df492f513fa46bffa0c1
- SHA512 bb3556872188d21d5106620b943604365b22f326a57ab3533d60e6a746b804fc404a216a4996735ffa66ca4fd36b16053bdbeb34745c66e2588c55c06706dfb2
- SSDEEP 196608:tYwES/pRYy6H62j9Diyol4QwCVvbxIaQw:hpRYymhjxYl2qvNNN
- TLSH T17476012173E50952D3BF5F75E0B109018BB1B7533746E74F298295A91EA3B80FA12F2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
pid Process 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F:\ Creative EAX Settings.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Creative EAX Settings.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Creative EAX Settings.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe 3204 Creative EAX Settings.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3204 Creative EAX Settings.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3204 wrote to memory of 3636 3204 Creative EAX Settings.exe 88 PID 3636 wrote to memory of 4172 3636 csc.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\Creative EAX Settings.exe"C:\Users\Admin\AppData\Local\Temp\Creative EAX Settings.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\Creative EAX Settings.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_be1487b1c32e4912a30a967e7f0a3c5a.cs"2⤵
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9764.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCDBFAD6B2BFD34A4F9F843D4A7823D099.TMP"3⤵PID:4172
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\.net\Creative EAX Settings\Hrqkp01comoaZrSEHPNWNWSdYvuIbfY=\Creative EAX Settings.dll
- Size 5.9MB
- SHA256 11d7ac9e8dc6d86db4bce99452d2d6712cbaba21927606946d1f3edfc332f113
- MD5 6e658862ac80ac47c15652a832399611
- SHA1 41cda27220677c8177fc8b14d6377ce87bbdafc5
- SHA512 7a5ef303e2e3763ce48c0b90e402648fd6f861222dd850af6e6b6898757e191f0d005519836039de90f20129b8eafad3958b4e4c3dbc638ed98163c3b81f436a
- SSDEEP 98304:xcpGXPPq0iwEAf/UaRYJ0s1DH62d9C4Xla67+y34sve14QwmaAVZRb0qzIXp:lYwES/pRYy6H62j9Diyol4QwCVvbxI
- TLSH T1DD561235B7E70C42D3AF1F76E1714A159AB6B7532781A74F204380690EA3B94FA02F6D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RES9764.tmp
- Size 1KB
- SHA256 85b39c2d67983ce130a24bee7c49221f7fd333c96d516f37569dec1c60c33758
- MD5 92031c1f325f50da5b91abcb4babb27b
- SHA1 e389c626a3a50e9e33861ff609c7dda76e9087e2
- SHA512 a34065606d35f6b2e4ae90c8b6606d95f747dd503bf39e10606e4b83a593964db0462d486bda8f30886e79dd483e232c220e4155cbcedb55fa923eb839af51e1
- TLSH T12841204583E84B1EF1B2033169F79329A674BE55DEAA975DB588023E1F12340CDC37B1
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Users\Admin\AppData\Local\Temp\CSCDBFAD6B2BFD34A4F9F843D4A7823D099.TMP
- Size 1KB
- SHA256 b415296044fdec40b92a7bcf1b2df43f3ecb7a8ee0f464dc830001ba42937789
- MD5 0d908bcfeab9734734ffdfc67915b5cb
- SHA1 5b3235bab4ef9a31b20e3cc822b682ce50807048
- SHA512 70499ed40a843bbe22592c0ef25b485f76ede6456c7a724e0025a2bab9b79b8b00d766474788f9057710447d3a26f7916a0db8114394406a39bc7e7d53d55e13
- TLSH T17C21C04693E8461DF1F3577079F6C3629168BE56CC7A83DC34C8135F1B2560085937B1
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_be1487b1c32e4912a30a967e7f0a3c5a.cs
- Size 4KB
- SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
- MD5 b7d40eb7e1328728d647678e1ea0a4dc
- SHA1 43850a88c7f012df9e7349886497271c83e2bdaa
- SHA512 a531df01588357b0d669d563fada88e78b0b3d1453e40605a872e9fba6091bb46a623b0817aafab946b01f92d5810ed7eb97ed9373eaeacb9970b316278667a4
- SSDEEP 96:noO1V0E4Yt1YOC3idfygNzkfK1Sg5vpVIHZZ:jl481hC3i1ygNzw5g5vpVw3
- TLSH T19F911298954DA2D69872223AFB03D15BF603103322FF9A20FEADD3505F3D0018678F69
- MD5 SHA1 SHA512 SSDEEP TLSH