c4f1244546720ccc5cc91be16c6991a50031e3cf5b1c1178b9ecde561a900295

Analysis

geolocation tags

eueuropefrfrance
max time kernel
29s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/06/2026, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LEEQEZ PREMIUM TWEAKING UTILITY.exe
Size 79KB
Sample260621-xtdhdafx5x
SHA256 c4f1244546720ccc5cc91be16c6991a50031e3cf5b1c1178b9ecde561a900295
MD5 9f515ab9c394c3b3c0c7d260a16d6dca
SHA1 c23b93438d003c7c834e96c57369873bac98db14
SHA512 96f56eabadbb2395c3713fa6c13ebbad4f199af721e9ba3d67751f859784b7feed825737253d1714a43e891c925b7628b53b17478345aa2a9fc50db97d312382
SSDEEP 1536:CwVKAj6aCjrenJYdOBvnUlZEyvxTBv5+VGBHhP:ZK26jnenOOB/Ulmyv/v4MHhP
TLSH
T19183291ABD2000A9F156F6B9EAE7490ED773B84583A253CBA7A4A3710F171C42D3FD52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

defense_evasion execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Start PowerShell.

execution

PowerShell

T1059.001

pid	Process
2416	powershell.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5268	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2416	powershell.exe
2416	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2416	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 2332	4448	LEEQEZ PREMIUM TWEAKING UTILITY.exe	89
PID 2332 wrote to memory of 2416	2332	cmd.exe	90
PID 2416 wrote to memory of 6004	2416	powershell.exe	91
PID 6004 wrote to memory of 5344	6004	cmd.exe	93
PID 6004 wrote to memory of 5268	6004	cmd.exe	94
PID 4448 wrote to memory of 4992	4448	LEEQEZ PREMIUM TWEAKING UTILITY.exe	95

C:\Users\Admin\AppData\Local\Temp\LEEQEZ PREMIUM TWEAKING UTILITY.exe
"C:\Users\Admin\AppData\Local\Temp\LEEQEZ PREMIUM TWEAKING UTILITY.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "Start-Process cmd -ArgumentList '/c color 4F & mode 110,30 & title CRACKED BY @NTPX AND DXO & cls & echo.&echo.&echo. CRACKED BY @NTPX AND DXO&echo.&echo. crackd by ntpx&echo.&timeout /t 99 >nul'" -WindowStyle Normal"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Start-Process cmd -ArgumentList '/c color 4F & mode 110,30 & title CRACKED BY @NTPX AND DXO & cls & echo.&echo.&echo. CRACKED BY @NTPX AND DXO&echo.&echo. crackd by ntpx&echo.&timeout /t 99 >nul'" -WindowStyle Normal"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2416
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c color 4F & mode 110,30 & title CRACKED BY @NTPX AND DXO & cls & echo.&echo.&echo. CRACKED BY @NTPX AND DXO&echo.&echo. crackd by ntpx&echo.&timeout /t 99 >nul
      4⤵
      Suspicious use of WriteProcessMemory
      PID:6004
    - - C:\Windows\system32\mode.com
        
        mode 110,30
        5⤵
        
        PID:5344
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 99
        5⤵
        Delays execution with timeout.exe
        
        PID:5268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2416-0-0x00007FFC7185F000-0x00007FFC71860000-memory.dmp

Download

memory/2416-1-0x00007FFC716D0000-0x00007FFC72074000-memory.dmp

Download

memory/2416-4-0x000002A7F1B90000-0x000002A7F1BB2000-memory.dmp

Download

memory/2416-5-0x00007FFC716D0000-0x00007FFC72074000-memory.dmp

Download

memory/2416-6-0x00007FFC716D0000-0x00007FFC72074000-memory.dmp

Download

memory/2416-7-0x00007FFC716D0000-0x00007FFC72074000-memory.dmp

Download

memory/2416-8-0x00007FFC716D0000-0x00007FFC72074000-memory.dmp

Download

memory/2416-9-0x00007FFC716D0000-0x00007FFC72074000-memory.dmp

Download

memory/2416-10-0x00007FFC716D0000-0x00007FFC72074000-memory.dmp

Download

memory/2416-12-0x00007FFC716D0000-0x00007FFC72074000-memory.dmp

Download