xenorat | 3ac1adc75ac38013eb7f2aa103c624b7ef5a628333b929841c043890aee42b79

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	SysUpd.exe

Executes dropped EXE 1 IoCs

pid	Process
4284	SysUpd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
4792	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3572	POWERPNT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3572	POWERPNT.EXE
3572	POWERPNT.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 4284	864	SysUpd.exe	92
PID 864 wrote to memory of 4284	864	SysUpd.exe	92
PID 864 wrote to memory of 4284	864	SysUpd.exe	92
PID 4284 wrote to memory of 4792	4284	SysUpd.exe	96
PID 4284 wrote to memory of 4792	4284	SysUpd.exe	96
PID 4284 wrote to memory of 4792	4284	SysUpd.exe	96

C:\Users\Admin\AppData\Local\Temp\SysUpd.exe
"C:\Users\Admin\AppData\Local\Temp\SysUpd.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:864
- C:\Users\Admin\AppData\Roaming\XenoManager\SysUpd.exe
  "C:\Users\Admin\AppData\Roaming\XenoManager\SysUpd.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4284
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /Create /TN "SysUpd" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF82B.tmp" /F
    3⤵
    - Creates scheduled task(s)
    PID:4792

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /s "C:\Users\Admin\Desktop\RequestPush.ppsm" /ou ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3572

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4012 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

Persistence

Scheduled Task/Job

1

Privilege Escalation

Scheduled Task/Job

1

Defense Evasion

Credential Access

Discovery

Query Registry

3

System Information Discovery

4