c4467151c928d9e1448ac4821b34b9dd6395775cd23395a7428266e55a97b9df

Analysis

geolocation tags

asiadelhiinindia
max time kernel
900s
max time network
277s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 12:17

Target
CreativeEAX.exe
Size 1.5MB
Sample261102-pf13hsvz2p
SHA256 c4467151c928d9e1448ac4821b34b9dd6395775cd23395a7428266e55a97b9df
MD5 7d67db49e76a8884c2e6ea3a3450f253
SHA1 767e7b35da79a6f2eb94ffd78eb33a8acd2d09d5
SHA512 d319d1ee6e383ffab2712bb1827b5105dee4e3774515f031029be747252c05169342b9a4210e202d01657d178a5aa5741cba9f8878cd55a521f46a5dbd4e9b95
SSDEEP 24576:PbSDBQEV+5sWmgQOiphp8b8u6ath+c3I/aDpJW8svmU:zS1QEV+5sWmgQoYbcRvf
TLSH
T160758E02A2A402ECD1BBD1798AA56D17E732380507B09AEF07D089691F777D15FBB723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

persistence

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3396	CreativeEAX.exe
3396	CreativeEAX.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4200	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4200	AUDIODG.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3396 wrote to memory of 2036	3396	CreativeEAX.exe	90
PID 3396 wrote to memory of 3728	3396	CreativeEAX.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\CreativeEAX.exe
"C:\Users\Admin\AppData\Local\Temp\CreativeEAX.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3396
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Query /TN "OctopusEAX"
  2⤵
  PID:2036
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Query /TN "MasonEAX"
  2⤵
  PID:3728

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004CC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2936

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5216

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/4200-0-0x000001960F000000-0x000001960F49B000-memory.dmp

Download