dc5a2e8fbc47a06670594254a3ea647446355a81598922c4315438588a80c932

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/08/2026, 09:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FALCON_RESTORE.bat
Size 1020B
Sample260809-ltawpsyvet
SHA256 dc5a2e8fbc47a06670594254a3ea647446355a81598922c4315438588a80c932
MD5 1437f18e8cf3827d211ef4b5cf8afa6c
SHA1 e691ea075e0d50a9034833b728e5cfdecfe1536e
SHA512 be898d12961d362e554ee8bca2c000123072bbf534f08e74592fcc0b82a82ea545a4a8a81a45199a34485e22f11dd7c5cc8bfde55f4f6e9dc3cc4d28a80fd316
TLSH
T12211E116232C923D19D656A6F9955063FEC900CA420A6EC271BFE1BE350938D56FC4ED
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2100	powershell.exe
2600	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4288	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
492	timeout.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4048	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2600	powershell.exe
2600	powershell.exe
2100	powershell.exe
2100	powershell.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	2600	powershell.exe
Token: SeIncreaseQuotaPrivilege	2600	powershell.exe
Token: SeSecurityPrivilege	2600	powershell.exe
Token: SeTakeOwnershipPrivilege	2600	powershell.exe
Token: SeLoadDriverPrivilege	2600	powershell.exe
Token: SeSystemProfilePrivilege	2600	powershell.exe
Token: SeSystemtimePrivilege	2600	powershell.exe
Token: SeProfSingleProcessPrivilege	2600	powershell.exe
Token: SeIncBasePriorityPrivilege	2600	powershell.exe
Token: SeCreatePagefilePrivilege	2600	powershell.exe
Token: SeBackupPrivilege	2600	powershell.exe
Token: SeRestorePrivilege	2600	powershell.exe
Token: SeShutdownPrivilege	2600	powershell.exe
Token: SeDebugPrivilege	2600	powershell.exe
Token: SeSystemEnvironmentPrivilege	2600	powershell.exe
Token: SeRemoteShutdownPrivilege	2600	powershell.exe
Token: SeUndockPrivilege	2600	powershell.exe
Token: SeManageVolumePrivilege	2600	powershell.exe
Token: 33	2600	powershell.exe
Token: 34	2600	powershell.exe
Token: 35	2600	powershell.exe
Token: 36	2600	powershell.exe
Token: SeDebugPrivilege	2100	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 2600	4288	cmd.exe	81
PID 4288 wrote to memory of 2100	4288	cmd.exe	83
PID 2100 wrote to memory of 4048	2100	powershell.exe	84
PID 4288 wrote to memory of 668	4288	cmd.exe	85
PID 4288 wrote to memory of 492	4288	cmd.exe	86

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\FALCON_RESTORE.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$p=Get-CimInstance Win32_Process | Where-Object { $_.Name -like 'python*' -and $_.CommandLine -like '*falcon_offline_server*' }; if($p){ $p | ForEach-Object { Stop-Process -Id $_.ProcessId -Force }; Write-Host ' server stopped' } else { Write-Host ' no server running' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\falcon_hosts.ps1" -Mode restore
  2⤵
  - Drops file in Drivers directory
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2100
- - C:\Windows\system32\ipconfig.exe
    "C:\Windows\system32\ipconfig.exe" /flushdns
    3⤵
    - Gathers network information
    PID:4048
- C:\Windows\system32\certutil.exe
  certutil -delstore Root "Falcon Local CA"
  2⤵
  PID:668
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 7f8f97ee615f534fb3a3d4ab1d554cd33b788f10c559754714d1e7ce0726b362
MD5 a71e351e0584693771a3e1ab5ed855ee
SHA1 5bbadb2db8240a293fce7bf6a965634703e51aa4
SHA512 95148933c9fc727c3f88c9b5a0bd489f660bc0b24b3cb8b8e6e7ffbec937810d473cf57ff0c8a34075ce7f822f0c007be8893daa409738cd4782ab526bb5a185
TLSH
T18B71EE323375B0D4C9663F07192C1AC463BF4396EA58AF4CB658521ED92710BDB222F7
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 18034a7189fd0fea83cfdd56bf3e1d7c1ab309e9757596992643b01bcd9ae53a
MD5 2ae30329e1b56d71f9342e2fe598287b
SHA1 e8f086483f68be75927330bb41483f4ff1d4f3d4
SHA512 789f0956fd532ce99a2f9731bcf9520f8904ae6c07b69cd2e03b547a58414e21f502f6a1fe1c4916294e389c089fca4bf7fec1596f7913aa6bd317d8bbf9294f
TLSH
T149218B33B7ADC165C8D9117A20CC9D00B275C3C744DECF8B2A84C228A97F5DADB945E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_2c4j2nno.gxs.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2c4j2nno.gxs.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

falcon_hosts.tmp

Path C:\Users\Admin\AppData\Local\Temp\falcon_hosts.tmp
Size 1KB
SHA256 f783f9473ade3ce3244b8475de3e68e0f0703ef3d08a839ca4ce82d52851d79a
MD5 b09f012e6e0ac851dfaaa66c05b57944
SHA1 27b2e3d49f8f122f0f198df7d44e59c94b44fe33
SHA512 c651cee11159fb87fbce4cb197888fcb30e99dee48b1d2f6cd087eae3bd11bd3a71bba711c08614fb9420fc2cbf3b32ac8eef848605c321b986c006075be4e72
TLSH
T11321AD260A44915D36B345E5091CF42FA35FD1EF4E3B8D8D3D8E414F7BE221C6326642
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2100-26-0x000001CBF74A0000-0x000001CBF74B0000-memory.dmp

Download

memory/2600-9-0x0000023779010000-0x0000023779020000-memory.dmp

Download

memory/2600-17-0x000002377DEC0000-0x000002377DEDC000-memory.dmp

Download

memory/2600-18-0x000002377DEE0000-0x000002377DF93000-memory.dmp

Download

memory/2600-19-0x000002377DCA0000-0x000002377DCAA000-memory.dmp

Download

memory/2600-20-0x000002377E120000-0x000002377E14A000-memory.dmp

Download

memory/2600-21-0x000002377E120000-0x000002377E144000-memory.dmp

Download

memory/2600-22-0x0000023779010000-0x0000023779020000-memory.dmp

Download

memory/2600-10-0x00007FF4E8CE0000-0x00007FF4E8CF0000-memory.dmp

Download

memory/2600-1-0x0000023779010000-0x0000023779020000-memory.dmp

Download

memory/2600-2-0x000002377DC00000-0x000002377DC22000-memory.dmp

Download

memory/2600-0-0x0000023779010000-0x0000023779020000-memory.dmp

Download