027545e09f397707e98abf5c192c35e5b01a51a74edc2070b9f950140b5c3ef2

General

Target

Overstretch/Automobilfirmaers/Natchezan/Outreckon.ps1
Size

55KB
MD5

85bee3407dc99a55d809e31f5b8822f3
SHA1

898e5873998c61dc48e6a01e43ba667f9a70f571
SHA256

2afd7f567beb13e65577a1d2ee4d6a161c4a1b01cb154c7129846d7ed74ad0c0
SHA512

06140520fedab28d7a982dc0d1563aed53b59a943131ed58cff405620c412e63f9dd7019661677bd562bd8813a09613b0e1f44752b983e953eef891af4941587
SSDEEP

1536:z9Ie8eKpSG2o84eXnjC0TcpW+acHuDuqSTd+1:zee8Bv87DcTuSqX1

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Modifies registry class 5 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

powershell.exe

pid	process
1688	powershell.exe
1688	powershell.exe
1688	powershell.exe
1688	powershell.exe
1688	powershell.exe
1688	powershell.exe
1688	powershell.exe
1688	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

2356 explorer.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

Processes:

powershell.exeexplorer.exe

description	pid	process
Token: SeDebugPrivilege	1688	powershell.exe
Token: SeShutdownPrivilege	2356	explorer.exe
Token: SeShutdownPrivilege	2356	explorer.exe
Token: SeShutdownPrivilege	2356	explorer.exe
Token: SeShutdownPrivilege	2356	explorer.exe
Token: SeShutdownPrivilege	2356	explorer.exe
Token: SeShutdownPrivilege	2356	explorer.exe
Token: SeShutdownPrivilege	2356	explorer.exe
Token: SeShutdownPrivilege	2356	explorer.exe
Token: SeShutdownPrivilege	2356	explorer.exe
Token: SeShutdownPrivilege	2356	explorer.exe
Token: SeShutdownPrivilege	2356	explorer.exe
Token: SeShutdownPrivilege	2356	explorer.exe

Suspicious use of FindShellTrayWindow 30 IoCs

Processes:

explorer.exe

pid	process
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe

Suspicious use of SendNotifyMessage 19 IoCs

Processes:

explorer.exe

pid	process
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1688 wrote to memory of 2544	1688	powershell.exe	cmd.exe
PID 1688 wrote to memory of 2544	1688	powershell.exe	cmd.exe
PID 1688 wrote to memory of 2544	1688	powershell.exe	cmd.exe
PID 1688 wrote to memory of 1760	1688	powershell.exe	wermgr.exe
PID 1688 wrote to memory of 1760	1688	powershell.exe	wermgr.exe
PID 1688 wrote to memory of 1760	1688	powershell.exe	wermgr.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Overstretch\Automobilfirmaers\Natchezan\Outreckon.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
2⤵
PID:2544

C:\Windows\system32\wermgr.exe
"C:\Windows\system32\wermgr.exe" "-outproc" "1688" "1140"
2⤵
PID:1760

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2356

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259437014.txt
Filesize
1KB

MD5
3fa762fb911640c709e56e7fbf8b3c03

SHA1
7b4ab600c7d0c4d011ab892b727183b9eaedeb87

SHA256
856943570735119709e23ffebbf51a2f81da1955a2341a8cf4f48b408d2ceb73

SHA512
5450340ef1c59fa7fd70caaaf0a383a4afbf72c6ccf48a3ea17e12aa109d16495ce5b1433df19e1b772fad2056610cce48395f8404b987ab384069277a652e1f

Download Submit
memory/1688-13-0x00000000025B0000-0x0000000002630000-memory.dmp

Filesize
512KB

Download
memory/1688-14-0x0000000002920000-0x0000000002924000-memory.dmp

Filesize
16KB

Download
memory/1688-5-0x000007FEF5CA0000-0x000007FEF663D000-memory.dmp

Filesize
9.6MB

Download
memory/1688-8-0x000007FEF5CA0000-0x000007FEF663D000-memory.dmp

Filesize
9.6MB

Download
memory/1688-9-0x00000000025B0000-0x0000000002630000-memory.dmp

Filesize
512KB

Download
memory/1688-10-0x00000000025B0000-0x0000000002630000-memory.dmp

Filesize
512KB

Download
memory/1688-7-0x00000000025B0000-0x0000000002630000-memory.dmp

Filesize
512KB

Download
memory/1688-4-0x000000001B2E0000-0x000000001B5C2000-memory.dmp

Filesize
2.9MB

Download
memory/1688-11-0x00000000025B0000-0x0000000002630000-memory.dmp

Filesize
512KB

Download
memory/1688-6-0x0000000001E50000-0x0000000001E58000-memory.dmp

Filesize
32KB

Download
memory/1688-17-0x00000000025B0000-0x0000000002630000-memory.dmp

Filesize
512KB

Download
memory/1688-18-0x000007FEF5CA0000-0x000007FEF663D000-memory.dmp

Filesize
9.6MB

Download
memory/2356-19-0x0000000004520000-0x0000000004521000-memory.dmp

Filesize
4KB

Download
memory/2356-20-0x0000000004520000-0x0000000004521000-memory.dmp

Filesize
4KB

Download
memory/2356-25-0x0000000002680000-0x0000000002690000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads