23fd526a0be0d8d41244b3e2f2470a87c3d2af4818956e6767745f9e358aad4d

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/08/2026, 09:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FALCON_OFFLINE.bat
Size 1KB
Sample260809-ltawpsyvet
SHA256 23fd526a0be0d8d41244b3e2f2470a87c3d2af4818956e6767745f9e358aad4d
MD5 f5f0504eef7ebeed22d4f1820412a749
SHA1 8abbba04e7367ffe0cb82032f7d48706ad954d63
SHA512 8a9d68d49dbd22f3c1e5c7a5e0374e17e4c41a859a329d647330f0f0804e6e06b5745d44ddc62ff45b17a9e245445b935f2e74ebd39e9795bf0b96c50a776185
TLSH
T1EE41640B237C831F96E55783B9E211A3BB5902DF40091DCA12ADE32B240E38DA0FD0B9
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2688	powershell.exe
3284	powershell.exe
688	powershell.exe

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1828	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3640	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1040	timeout.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3400	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2688	powershell.exe
2688	powershell.exe
3284	powershell.exe
3284	powershell.exe
688	powershell.exe
688	powershell.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	2688	powershell.exe
Token: SeDebugPrivilege	3284	powershell.exe
Token: SeDebugPrivilege	688	powershell.exe
Token: SeIncreaseQuotaPrivilege	688	powershell.exe
Token: SeSecurityPrivilege	688	powershell.exe
Token: SeTakeOwnershipPrivilege	688	powershell.exe
Token: SeLoadDriverPrivilege	688	powershell.exe
Token: SeSystemProfilePrivilege	688	powershell.exe
Token: SeSystemtimePrivilege	688	powershell.exe
Token: SeProfSingleProcessPrivilege	688	powershell.exe
Token: SeIncBasePriorityPrivilege	688	powershell.exe
Token: SeCreatePagefilePrivilege	688	powershell.exe
Token: SeBackupPrivilege	688	powershell.exe
Token: SeRestorePrivilege	688	powershell.exe
Token: SeShutdownPrivilege	688	powershell.exe
Token: SeDebugPrivilege	688	powershell.exe
Token: SeSystemEnvironmentPrivilege	688	powershell.exe
Token: SeRemoteShutdownPrivilege	688	powershell.exe
Token: SeUndockPrivilege	688	powershell.exe
Token: SeManageVolumePrivilege	688	powershell.exe
Token: 33	688	powershell.exe
Token: 34	688	powershell.exe
Token: 35	688	powershell.exe
Token: 36	688	powershell.exe
Token: SeDebugPrivilege	1828	tasklist.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3640 wrote to memory of 2688	3640	cmd.exe	81
PID 2688 wrote to memory of 3400	2688	powershell.exe	82
PID 3640 wrote to memory of 3284	3640	cmd.exe	83
PID 3284 wrote to memory of 4680	3284	powershell.exe	84
PID 3640 wrote to memory of 688	3640	cmd.exe	85
PID 3640 wrote to memory of 1040	3640	cmd.exe	87
PID 3640 wrote to memory of 1828	3640	cmd.exe	88
PID 3640 wrote to memory of 1056	3640	cmd.exe	89

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\FALCON_OFFLINE.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\falcon_hosts.ps1" -Mode offline
  2⤵
  - Drops file in Drivers directory
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\system32\ipconfig.exe
    "C:\Windows\system32\ipconfig.exe" /flushdns
    3⤵
    - Gathers network information
    PID:3400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$c=Get-ChildItem Cert:\LocalMachine\Root | Where-Object { $_.Subject -match 'Falcon Local CA' }; if(-not $c){ certutil -addstore -f Root falcon_ca.crt | Out-Null; Write-Host ' CA installed' } else { Write-Host ' CA already trusted' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3284
- - C:\Windows\system32\certutil.exe
    "C:\Windows\system32\certutil.exe" -addstore -f Root falcon_ca.crt
    3⤵
    PID:4680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$p=Get-CimInstance Win32_Process | Where-Object { $_.Name -like 'python*' -and $_.CommandLine -like '*falcon_offline_server*' }; if(-not $p){ Start-Process -FilePath 'C:\Program Files\Python314\pythonw.exe' -ArgumentList 'falcon_offline_server.py' -WorkingDirectory 'C:\Users\Admin\AppData\Local\Temp\'; Write-Host ' server started' } else { Write-Host ' server already running' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:688
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1040
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq FAKE LAG.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1828
- C:\Windows\system32\find.exe
  find /I "FAKE LAG.exe"
  2⤵
  PID:1056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 7c6c09f48f03421430d707d27632810414e5e2bf2eecd5eb675fecf8b45a9a92
MD5 22e796539d05c5390c21787da1fb4c2b
SHA1 55320ebdedd3069b2aaf1a258462600d9ef53a58
SHA512 d9cc0cb22df56db72a71504bb3ebc36697e0a7a1d2869e0e0ab61349bda603298fe6c667737b79bf2235314fb49b883ba4c5f137d002e273e79391038ecf9c09
TLSH
T15061DC323375B0D4895A7F07192C19C463BF8356EA94AF4CB658620ED92B44BDF222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b9b64dbc0c0554d158ac1391f6ad1ffcbd05d872f371a2212c260237819f69ea
MD5 507b3fcfe6b8ffccb71ea0d5f9ec3fb1
SHA1 dc2327468b207e3594ed7cbdee07719dfa65653f
SHA512 1278f7a736564657ad91544f58b1835b52f59cecc78544db928323187339fd7872616a1c6fd54316a34b2947fc4b2c2e21aaeb5f739ceb8e4b5220c0e687d2c2
TLSH
T11C215633B3ACC135C8D9117A1088AD11B1B5C3CB449E8E9B6B84C508A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c083ccab97fceb75799ed345f02e4b90fc0fd18b40c431cd58fca9320ffe38ef
MD5 eafceea8e0d06f5cade7796d269e04b4
SHA1 98814508d185ddd7fdb35460fc884edea50a8f7c
SHA512 45314ac9b397108d93445ab37bca278f9dbe6e02308a039ff653c556e919a7886a2d3ead872e8896758c91ac63d9613f33706408f4e273efff36f0a11c837d60
TLSH
T12521DA33B3DCD234C8C9017A1089AD01B1B5C3CB449FDE8B6B84C508A17F99ADF681A4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_axh2aikg.soy.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_axh2aikg.soy.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

falcon_hosts.tmp

Path C:\Users\Admin\AppData\Local\Temp\falcon_hosts.tmp
Size 1KB
SHA256 ecf91dbae49315d4355cf9e3910478dd73ce43c237e54c5580a5fec4068dffd0
MD5 b5db8aa74f4c8a27e27ea7a30fe0b2b7
SHA1 636f2a050d74eac035c1efe4824d67d75d702ba3
SHA512 f4066edf121fca1a31250b0e68360674eca87df1b08334bf73d622ee2d8d6e0a2bbd85ce041397c8e3c14945434e3d0f32690a38ef9f4c4810254c9667f779e8
TLSH
T18431DC360A48A15D26B341D6191CF43FE25FD0DF4E2B9DCD3DAE414E7BA260C2356642
MD5 SHA1 SHA512 TLSH

Submit Download

memory/688-46-0x000002ACFD630000-0x000002ACFD65A000-memory.dmp

Download

memory/688-47-0x000002ACFD630000-0x000002ACFD654000-memory.dmp

Download

memory/688-45-0x000002ACFD5F0000-0x000002ACFD5FA000-memory.dmp

Download

memory/688-44-0x000002ACFD530000-0x000002ACFD5E3000-memory.dmp

Download

memory/688-43-0x000002ACFD510000-0x000002ACFD52C000-memory.dmp

Download

memory/2688-9-0x000002143B850000-0x000002143B860000-memory.dmp

Download

memory/2688-1-0x000002143B850000-0x000002143B860000-memory.dmp

Download

memory/2688-8-0x000002143B800000-0x000002143B822000-memory.dmp

Download

memory/2688-0-0x000002143B850000-0x000002143B860000-memory.dmp

Download

memory/3284-28-0x0000027D34320000-0x0000027D34330000-memory.dmp

Download

memory/3284-20-0x0000027D34320000-0x0000027D34330000-memory.dmp

Download

memory/3284-19-0x0000027D34320000-0x0000027D34330000-memory.dmp

Download