48100ddb70b147760604c7fa766252d7b3f97fdb96b3a6b7fb1fd1074ee47edd

Analysis

max time kernel
149s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 12:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
paymentsl.exe
Size 230KB
Sample260930-n62w3aware
SHA256 48100ddb70b147760604c7fa766252d7b3f97fdb96b3a6b7fb1fd1074ee47edd
MD5 eb78929ba43c989619bf9a3b14446da4
SHA1 cefcffbb6952763994b1a97d4980929816bbeb82
SHA512 03fef1803fb4a8e8a5439d4240e6973542e9c640dddc47e9f6ec52b4e268873342c9256a40264c34227f4a860a99904d0f19c24f80226287077b1314210cf14e
SSDEEP 3072:f/clZSYF9d2rH8izoJpG5iiaqacrYrGDmbA3c64M+lmsolAIrRuw+mqv9j1MWLQE:MlZSy2rHpcpGLaiYjbqp+lDAA
TLSH
T13634C5F5B740C864C86B897A843BDAA3A523E25E9C28961D39D1FF5B3C733464417C8B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fastwebsvr.lnk	paymentsl.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fastwebsvr.lnk	paymentsl.exe

Executes dropped EXE 1 IoCs

pid	Process
2888	fastwebsvr.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fastwebsvr = "C:\\Users\\Admin\\AppData\\Roaming\\fastwebsvr.exe"	paymentsl.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	paymentsl.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	paymentsl.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4776	paymentsl.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4776	paymentsl.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4776	paymentsl.exe
Token: SeDebugPrivilege	2888	fastwebsvr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4776	paymentsl.exe

C:\Users\Admin\AppData\Local\Temp\paymentsl.exe
"C:\Users\Admin\AppData\Local\Temp\paymentsl.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4776

C:\Users\Admin\AppData\Roaming\fastwebsvr.exe
C:\Users\Admin\AppData\Roaming\fastwebsvr.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fastwebsvr.exe

Path C:\Users\Admin\AppData\Roaming\fastwebsvr.exe
Size 230KB
SHA256 48100ddb70b147760604c7fa766252d7b3f97fdb96b3a6b7fb1fd1074ee47edd
MD5 eb78929ba43c989619bf9a3b14446da4
SHA1 cefcffbb6952763994b1a97d4980929816bbeb82
SHA512 03fef1803fb4a8e8a5439d4240e6973542e9c640dddc47e9f6ec52b4e268873342c9256a40264c34227f4a860a99904d0f19c24f80226287077b1314210cf14e
SSDEEP 3072:f/clZSYF9d2rH8izoJpG5iiaqacrYrGDmbA3c64M+lmsolAIrRuw+mqv9j1MWLQE:MlZSy2rHpcpGLaiYjbqp+lDAA
TLSH
T13634C5F5B740C864C86B897A843BDAA3A523E25E9C28961D39D1FF5B3C733464417C8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4776-0-0x0000000000A30000-0x0000000000A70000-memory.dmp

Download

memory/4776-5-0x000000001B610000-0x000000001B620000-memory.dmp

Download

memory/4776-6-0x000000001B610000-0x000000001B620000-memory.dmp

Download

memory/4776-10-0x000000001B610000-0x000000001B620000-memory.dmp

Download

memory/4776-11-0x000000001B610000-0x000000001B620000-memory.dmp

Download