Analysis
- max time kernel
150s - max time network
8s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 22:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Creative EAX Settings (Bypassed).exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Creative EAX Settings (Bypassed).exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target Creative EAX Settings (Bypassed).exe
- Size 7.0MB
- Sample261102-2prawsfy3j
- SHA256 a420be0c60c446017d6381d658b38435a1d0543acc141e41b4528f3bbfb7e0fd
- MD5 faa226ad7bda3096f1f69983d2c3a7e9
- SHA1 cab6029a8fb146f4a2312a54d7cf7bf59d1d70e4
- SHA512 36dcd34a4b92afcdabfca8243db6ba5a3bf5792f0a7660603e60b35933c8d05c24fd98139f5524064da72b7e9ad3dee1806d394d69a34dcce5c0fa6f031a919a
- SSDEEP 196608:3YwES/pRYy6H62j9Diyol4QwCVvbxI4cQw:PpRYymhjxYl2qvNYN
- TLSH T1AD76012173E50912D3BF5F75E0B10901CBB1B7532756E74F298295A91EA3B80FA12F2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
pid Process 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Creative EAX Settings (Bypassed).exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Creative EAX Settings (Bypassed).exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe 4388 Creative EAX Settings (Bypassed).exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4388 Creative EAX Settings (Bypassed).exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4388 wrote to memory of 708 4388 Creative EAX Settings (Bypassed).exe 89 PID 708 wrote to memory of 1368 708 csc.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\Creative EAX Settings (Bypassed).exe"C:\Users\Admin\AppData\Local\Temp\Creative EAX Settings (Bypassed).exe"1⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\Creative EAX Settings (Bypassed).exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_55516aa6170b4ba1bde3971ccc1a377b.cs"2⤵
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7E5E.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB95CC24C67B1446DBB5E5E78D032DA6F.TMP"3⤵PID:1368
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\.net\Creative EAX Settings (Bypassed)\Hrqkp01comoaZrSEHPNWNWSdYvuIbfY=\Creative EAX Settings.dll
- Size 5.9MB
- SHA256 32adaddaef69557d330fedbad4577fd498add729da9f6946d3176d3e20d8a7e3
- MD5 e7e93f70e25ebac2daa892abf19f1161
- SHA1 00a1b74418b588aec793661a06ad3b3eb8c1a864
- SHA512 436f5a915cbc4605ae74045ed4c64c7ad053ca77ba6d5308ae3a4432e14fc535f688234e2a24fb960611481d487b54edb986b6fce5a5b822709418fd9fa691fb
- SSDEEP 98304:NSpGXPPq0iwEAf/UaRYJ0s1DH62d9C4Xla67+y34sve14QwmaAVZRb0qzIXor:PYwES/pRYy6H62j9Diyol4QwCVvbxI4
- TLSH T138561235B7D70902D3AF1F76E1714A159AB6B7432B81A74F208380691EA3F94FA01F6D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RES7E5E.tmp
- Size 1KB
- SHA256 fcd08ac80e9b9c9381121ad8b8956165944b6a8586c803876b68ae4763b2f4cb
- MD5 9d9dea772bd42fdb4cf1caee0c8e6bef
- SHA1 e0fdfb881f68dc2b4add29f49b4948c7848e6652
- SHA512 304bf6cfdf7c0b860242c7fc2dc72413525270ab1cfc19eef8c8e1ce4aa66c8302cb001efb8d7b48c0f66621df6113ca70dec8689c653b478373b8274e7252b0
- TLSH T15341304183D84B0AF1724731A9F7971AA6B8BE59DEAA939D75C4022E1E12740CDD33B2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Creative\Eaxset\Default\Console_BG212.bmp
- Size 679KB
- SHA256 b0e34ac0afefb3443f6120dce099ddcb95ffc10e14909a7c5d032c8af262c3eb
- MD5 646010101c12b89ba9c343b1530f0917
- SHA1 1941edbd9482fdd1bb833c3cace676d81caead6c
- SHA512 3a269f66478855ba28778e5877ad983f6ffbc86bcf6ce60aced50171ac25a2543bdf51197cf7bf0d62537a4f7cb46fd13514c6f140745af7410ef250cd385bfd
- SSDEEP 384:wPnr6/r8eQLfOE4Dxg9xf6+HmtN1YU5WkERYPhS5:wP2wnOE4FgT6/u4WkDk
- TLSH T1B1E4D70FEC494A96F64C08006589B5D201E42E0D91ECE6166EEEF55BE5B1F87723CE2F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Users\Admin\AppData\Local\Temp\CSCB95CC24C67B1446DBB5E5E78D032DA6F.TMP
- Size 1KB
- SHA256 aad6d67d64ce85517a61f228f4ca1e5447aed0ee074f2af4a521f51844d6eddd
- MD5 5f64bbd3f63749ecf7e55958747a8a36
- SHA1 0b4758184e3b608d0121ce430ac6ae8ea91bc2f8
- SHA512 4f64f92ec592b798f8403af8e53f2483536c187f759a733bb32b6ebb223469cc962204dda9a152018f9f05d8d16781d540a796fbf036ac0d717e882a55c3b72c
- TLSH T10E218E81A2E84619F1B34B7079F5D26391A8BE55CD7A82EC34C8135F1B25A0085937B1
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_55516aa6170b4ba1bde3971ccc1a377b.cs
- Size 4KB
- SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
- MD5 b7d40eb7e1328728d647678e1ea0a4dc
- SHA1 43850a88c7f012df9e7349886497271c83e2bdaa
- SHA512 a531df01588357b0d669d563fada88e78b0b3d1453e40605a872e9fba6091bb46a623b0817aafab946b01f92d5810ed7eb97ed9373eaeacb9970b316278667a4
- SSDEEP 96:noO1V0E4Yt1YOC3idfygNzkfK1Sg5vpVIHZZ:jl481hC3i1ygNzw5g5vpVw3
- TLSH T19F911298954DA2D69872223AFB03D15BF603103322FF9A20FEADD3505F3D0018678F69
- MD5 SHA1 SHA512 SSDEEP TLSH