dc5a2e8fbc47a06670594254a3ea647446355a81598922c4315438588a80c932

Analysis

max time kernel
149s
max time network
150s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
09/08/2026, 09:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FALCON_RESTORE.bat
Size 1020B
Sample260809-ltawpsyvet
SHA256 dc5a2e8fbc47a06670594254a3ea647446355a81598922c4315438588a80c932
MD5 1437f18e8cf3827d211ef4b5cf8afa6c
SHA1 e691ea075e0d50a9034833b728e5cfdecfe1536e
SHA512 be898d12961d362e554ee8bca2c000123072bbf534f08e74592fcc0b82a82ea545a4a8a81a45199a34485e22f11dd7c5cc8bfde55f4f6e9dc3cc4d28a80fd316
TLSH
T12211E116232C923D19D656A6F9955063FEC900CA420A6EC271BFE1BE350938D56FC4ED
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5724	powershell.exe
4320	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4372	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5320	timeout.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1196	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5724	powershell.exe
5724	powershell.exe
4320	powershell.exe
4320	powershell.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	5724	powershell.exe
Token: SeIncreaseQuotaPrivilege	5724	powershell.exe
Token: SeSecurityPrivilege	5724	powershell.exe
Token: SeTakeOwnershipPrivilege	5724	powershell.exe
Token: SeLoadDriverPrivilege	5724	powershell.exe
Token: SeSystemProfilePrivilege	5724	powershell.exe
Token: SeSystemtimePrivilege	5724	powershell.exe
Token: SeProfSingleProcessPrivilege	5724	powershell.exe
Token: SeIncBasePriorityPrivilege	5724	powershell.exe
Token: SeCreatePagefilePrivilege	5724	powershell.exe
Token: SeBackupPrivilege	5724	powershell.exe
Token: SeRestorePrivilege	5724	powershell.exe
Token: SeShutdownPrivilege	5724	powershell.exe
Token: SeDebugPrivilege	5724	powershell.exe
Token: SeSystemEnvironmentPrivilege	5724	powershell.exe
Token: SeRemoteShutdownPrivilege	5724	powershell.exe
Token: SeUndockPrivilege	5724	powershell.exe
Token: SeManageVolumePrivilege	5724	powershell.exe
Token: 33	5724	powershell.exe
Token: 34	5724	powershell.exe
Token: 35	5724	powershell.exe
Token: 36	5724	powershell.exe
Token: SeDebugPrivilege	4320	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 5724	4372	cmd.exe	82
PID 4372 wrote to memory of 4320	4372	cmd.exe	84
PID 4320 wrote to memory of 1196	4320	powershell.exe	85
PID 4372 wrote to memory of 2636	4372	cmd.exe	86
PID 4372 wrote to memory of 5320	4372	cmd.exe	87

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\FALCON_RESTORE.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$p=Get-CimInstance Win32_Process | Where-Object { $_.Name -like 'python*' -and $_.CommandLine -like '*falcon_offline_server*' }; if($p){ $p | ForEach-Object { Stop-Process -Id $_.ProcessId -Force }; Write-Host ' server stopped' } else { Write-Host ' no server running' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\falcon_hosts.ps1" -Mode restore
  2⤵
  - Drops file in Drivers directory
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Windows\system32\ipconfig.exe
    "C:\Windows\system32\ipconfig.exe" /flushdns
    3⤵
    - Gathers network information
    PID:1196
- C:\Windows\system32\certutil.exe
  certutil -delstore Root "Falcon Local CA"
  2⤵
  PID:2636
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 11abbd39c37e78163bb159315d2771342b9f4761c117dde4d950691279e4fa9e
MD5 4817c9686cc0f425997b300cafbbd2cd
SHA1 cbe91fb33b7a07fc278071b68c952092dcec5a11
SHA512 2e6c025fe434d7424a83a99595884e545e7adaac06285c88ef172bd61f09f0f31521102911416b51ab9ee9b01f0e42df1d596aaba67ff67714804acc8c9d2aab
TLSH
T1F471EF323375A0D4C9667F07192C19C063BF4396E698AF5C765C521EE92750B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f788d5b43f757b8b679ddeee1a2c55239cbed0acb6b30fc2af6440c44ca19fdd
MD5 46a7f121eb580f60ffd6da7fe3204d3b
SHA1 ffaf9da8207faaaa04222819bd801536bdf20f2a
SHA512 cb93708d816d3a7c79f3f99b6e9d4c5214ce42d50eca4e0b479e44ce36aaa32ebfff0264b48423cddcbcab0ff20a4fa7c1a7f3c057c2716c75622365e88d47c6
TLSH
T1F0218727B79DC861CC99553B209C9DA172B6D7C780DEDF8B2FC4C218A03F698DB21690
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_2hphom41.0a1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2hphom41.0a1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4320-17-0x00000134A7310000-0x00000134A7320000-memory.dmp

Download

memory/4320-16-0x00000134A7310000-0x00000134A7320000-memory.dmp

Download

memory/4320-26-0x00000134A7310000-0x00000134A7320000-memory.dmp

Download

memory/5724-0-0x000002509A290000-0x000002509A2A0000-memory.dmp

Download

memory/5724-8-0x00000250B4CD0000-0x00000250B4CF2000-memory.dmp

Download

memory/5724-9-0x000002509A290000-0x000002509A2A0000-memory.dmp

Download

memory/5724-11-0x00000250B50B0000-0x00000250B50D4000-memory.dmp

Download

memory/5724-10-0x00000250B50B0000-0x00000250B50DA000-memory.dmp

Download

memory/5724-12-0x000002509A290000-0x000002509A2A0000-memory.dmp

Download