23fd526a0be0d8d41244b3e2f2470a87c3d2af4818956e6767745f9e358aad4d

Analysis

max time kernel
149s
max time network
153s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
09/08/2026, 09:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FALCON_OFFLINE.bat
Size 1KB
Sample260809-ltawpsyvet
SHA256 23fd526a0be0d8d41244b3e2f2470a87c3d2af4818956e6767745f9e358aad4d
MD5 f5f0504eef7ebeed22d4f1820412a749
SHA1 8abbba04e7367ffe0cb82032f7d48706ad954d63
SHA512 8a9d68d49dbd22f3c1e5c7a5e0374e17e4c41a859a329d647330f0f0804e6e06b5745d44ddc62ff45b17a9e245445b935f2e74ebd39e9795bf0b96c50a776185
TLSH
T1EE41640B237C831F96E55783B9E211A3BB5902DF40091DCA12ADE32B240E38DA0FD0B9
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4932	powershell.exe
4984	powershell.exe
3320	powershell.exe

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
6044	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5212	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5800	timeout.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5488	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4932	powershell.exe
4932	powershell.exe
4984	powershell.exe
4984	powershell.exe
3320	powershell.exe
3320	powershell.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	4932	powershell.exe
Token: SeDebugPrivilege	4984	powershell.exe
Token: SeDebugPrivilege	3320	powershell.exe
Token: SeIncreaseQuotaPrivilege	3320	powershell.exe
Token: SeSecurityPrivilege	3320	powershell.exe
Token: SeTakeOwnershipPrivilege	3320	powershell.exe
Token: SeLoadDriverPrivilege	3320	powershell.exe
Token: SeSystemProfilePrivilege	3320	powershell.exe
Token: SeSystemtimePrivilege	3320	powershell.exe
Token: SeProfSingleProcessPrivilege	3320	powershell.exe
Token: SeIncBasePriorityPrivilege	3320	powershell.exe
Token: SeCreatePagefilePrivilege	3320	powershell.exe
Token: SeBackupPrivilege	3320	powershell.exe
Token: SeRestorePrivilege	3320	powershell.exe
Token: SeShutdownPrivilege	3320	powershell.exe
Token: SeDebugPrivilege	3320	powershell.exe
Token: SeSystemEnvironmentPrivilege	3320	powershell.exe
Token: SeRemoteShutdownPrivilege	3320	powershell.exe
Token: SeUndockPrivilege	3320	powershell.exe
Token: SeManageVolumePrivilege	3320	powershell.exe
Token: 33	3320	powershell.exe
Token: 34	3320	powershell.exe
Token: 35	3320	powershell.exe
Token: 36	3320	powershell.exe
Token: SeDebugPrivilege	6044	tasklist.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5212 wrote to memory of 4932	5212	cmd.exe	84
PID 4932 wrote to memory of 5488	4932	powershell.exe	85
PID 5212 wrote to memory of 4984	5212	cmd.exe	86
PID 4984 wrote to memory of 4052	4984	powershell.exe	87
PID 5212 wrote to memory of 3320	5212	cmd.exe	88
PID 5212 wrote to memory of 5800	5212	cmd.exe	91
PID 5212 wrote to memory of 6044	5212	cmd.exe	92
PID 5212 wrote to memory of 6048	5212	cmd.exe	93

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\FALCON_OFFLINE.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\falcon_hosts.ps1" -Mode offline
  2⤵
  - Drops file in Drivers directory
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4932
- - C:\Windows\system32\ipconfig.exe
    "C:\Windows\system32\ipconfig.exe" /flushdns
    3⤵
    - Gathers network information
    PID:5488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$c=Get-ChildItem Cert:\LocalMachine\Root | Where-Object { $_.Subject -match 'Falcon Local CA' }; if(-not $c){ certutil -addstore -f Root falcon_ca.crt | Out-Null; Write-Host ' CA installed' } else { Write-Host ' CA already trusted' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Windows\system32\certutil.exe
    "C:\Windows\system32\certutil.exe" -addstore -f Root falcon_ca.crt
    3⤵
    PID:4052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$p=Get-CimInstance Win32_Process | Where-Object { $_.Name -like 'python*' -and $_.CommandLine -like '*falcon_offline_server*' }; if(-not $p){ Start-Process -FilePath 'C:\Program Files\Python314\pythonw.exe' -ArgumentList 'falcon_offline_server.py' -WorkingDirectory 'C:\Users\Admin\AppData\Local\Temp\'; Write-Host ' server started' } else { Write-Host ' server already running' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3320
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5800
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq FAKE LAG.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:6044
- C:\Windows\system32\find.exe
  find /I "FAKE LAG.exe"
  2⤵
  PID:6048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 b254694891c8c9da1394c3c469cee50f145c72582e6d1cf0045cab4e72f48e7f
MD5 87c29700d926d094566f97a4ca94661f
SHA1 edbc46e5510447273bbaae1a5d13e6984b003594
SHA512 0c6ba3544daa14af98f338fa24d01624f9e93f9633b2bd6b4c031f7f1ecd4265dddde4469a8b96e81d802401ec8f3ba1d0120afe53ee6fa5345f9f3f7ab94290
TLSH
T12B61DB313275B0E4C95A7F47192819C063BF8395FA98AF5CB65C521EE92740B9B223F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b77671604d3f64333aa27da2cd789a03e544500ec274746fd26d6517efcd26dc
MD5 fe915b2410b4ba2389ab7ae5718a6619
SHA1 eb4b5523ed0cb5b90cfba216cba98310f1c2bb2c
SHA512 0d8011b302a017c44132e6f0140de4447fb3080f353f207a58120e3c17c9cb115bfcc1d0737bc129bb3a4bb5be11abff3d262fd9ba3ea1f6301b4a3086dfc8d3
TLSH
T178218927B3DCC911CC89423B008C8D6075B2D7C7809EDF9B6FC4C208A07F599CB21190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3a531f9767cd468f507371d11052372034bc9d517dd889905e3a772128125794
MD5 303321ef9c404691bd61e5644128e29c
SHA1 3af59516308b38921c085a34d98dd74d938588c8
SHA512 c81f2054e3302fb97e83ac34c366d83cb298c4d18b3c0fa5be1fe18c65755236c463b2b82985cbf73e43c3950299ef4ffba5358b39d5bbf060f86eea49914573
TLSH
T1D721B723B3DDC921CC89013B108D8D5035B2D3C380DE9F9B6FC4C609A07F9A8CB211A0
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_oxpnb0za.bjv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oxpnb0za.bjv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3320-40-0x0000024F73990000-0x0000024F739B4000-memory.dmp

Download

memory/3320-39-0x0000024F73990000-0x0000024F739BA000-memory.dmp

Download

memory/4932-0-0x00000231F27B0000-0x00000231F27C0000-memory.dmp

Download

memory/4932-9-0x00000231F4B40000-0x00000231F4B62000-memory.dmp

Download

memory/4932-10-0x00000231F27B0000-0x00000231F27C0000-memory.dmp

Download

memory/4932-1-0x00000231F27B0000-0x00000231F27C0000-memory.dmp

Download

memory/4984-18-0x000002C56FB00000-0x000002C56FB10000-memory.dmp

Download

memory/4984-30-0x000002C5721B0000-0x000002C57227D000-memory.dmp

Download

memory/4984-28-0x000002C56FB00000-0x000002C56FB10000-memory.dmp

Download

memory/4984-19-0x000002C56FB00000-0x000002C56FB10000-memory.dmp

Download