Overview
overview
8Static
static
1Falcon_Off...ge.zip
windows10-ltsc_2021-x64
1Falcon_Off...ge.zip
windows11-21h2-x64
1FALCON_OFFLINE.bat
windows10-ltsc_2021-x64
8FALCON_OFFLINE.bat
windows11-21h2-x64
8FALCON_RESTORE.bat
windows10-ltsc_2021-x64
8FALCON_RESTORE.bat
windows11-21h2-x64
8OFFLINE_REPORT.txt
windows10-ltsc_2021-x64
1OFFLINE_REPORT.txt
windows11-21h2-x64
3falcon_ca.crt
windows10-ltsc_2021-x64
8falcon_ca.crt
windows11-21h2-x64
8falcon_ca.key
windows10-ltsc_2021-x64
3falcon_ca.key
windows11-21h2-x64
3falcon_hosts.ps1
windows10-ltsc_2021-x64
8falcon_hosts.ps1
windows11-21h2-x64
8falcon_off...ver.py
windows10-ltsc_2021-x64
3falcon_off...ver.py
windows11-21h2-x64
3falcon_server.crt
windows10-ltsc_2021-x64
8falcon_server.crt
windows11-21h2-x64
8falcon_server.key
windows10-ltsc_2021-x64
3falcon_server.key
windows11-21h2-x64
3gen_cert2.py
windows10-ltsc_2021-x64
3gen_cert2.py
windows11-21h2-x64
3offline_se...og.txt
windows10-ltsc_2021-x64
1offline_se...og.txt
windows11-21h2-x64
3shot_final.png
windows10-ltsc_2021-x64
1shot_final.png
windows11-21h2-x64
spki_hash.py
windows10-ltsc_2021-x64
3spki_hash.py
windows11-21h2-x64
3Analysis
- max time kernel
149s - max time network
153s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
09/08/2026, 09:48
Static task
static1
Behavioral task
behavioral1
Sample
Falcon_Offline_Package.zip
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
Behavioral task
behavioral2
Sample
Falcon_Offline_Package.zip
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
FALCON_OFFLINE.bat
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
Behavioral task
behavioral4
Sample
FALCON_OFFLINE.bat
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
FALCON_RESTORE.bat
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
Behavioral task
behavioral6
Sample
FALCON_RESTORE.bat
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
OFFLINE_REPORT.txt
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
Behavioral task
behavioral8
Sample
OFFLINE_REPORT.txt
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
falcon_ca.crt
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
Behavioral task
behavioral10
Sample
falcon_ca.crt
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
falcon_ca.key
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
Behavioral task
behavioral12
Sample
falcon_ca.key
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
falcon_hosts.ps1
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
Behavioral task
behavioral14
Sample
falcon_hosts.ps1
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
falcon_offline_server.py
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
Behavioral task
behavioral16
Sample
falcon_offline_server.py
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
falcon_server.crt
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
Behavioral task
behavioral18
Sample
falcon_server.crt
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
falcon_server.key
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
Behavioral task
behavioral20
Sample
falcon_server.key
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
gen_cert2.py
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
Behavioral task
behavioral22
Sample
gen_cert2.py
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
offline_server_log.txt
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
Behavioral task
behavioral24
Sample
offline_server_log.txt
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
shot_final.png
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
Behavioral task
behavioral26
Sample
shot_final.png
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
spki_hash.py
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
Behavioral task
behavioral28
Sample
spki_hash.py
Resource
win11-20260513-en
windows11-21h2-x64
General
- Target OFFLINE_REPORT.txt
- Size 4KB
- Sample260809-ltawpsyvet
- SHA256 7d6b1825f27ccd6953c529fbc32f0358c7f3fea1d0f4a5d24cd4a1fc4cba3275
- MD5 f30447919bf693b29891f3b6b6cdbe6c
- SHA1 9745cfee5751dc546013092a5d0dcd3679288f2d
- SHA512 2f1945294eba12040b4fecb9ac2f094c580a0c75e7947cc5f2a5ab50c948ea69b85f7cd51803e90f9f29dc1e5bbc3d177d02b36853190789638d4d020b94ad10
- SSDEEP 96:8Ue7Kbfuave0Ofz24LuKpe/eH12EyY7hbVb8cBPuO3lQ3911:8U12hrlapg2RY7hW/4G3p
- TLSH T10E91EFD21E1884320A55DE0ED0D27878E8B6FE27D74AFD34399F09611B9B723E18D276
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Opens file in notepad (likely ransom note) 1 IoCs
pid Process 4860 NOTEPAD.EXE