xenorat | 40ec6278632cd557b1b4a71756f605cd1579e1c54f1534c74f15751199fd521c

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	MJSQCNZV.exe

Executes dropped EXE 8 IoCs

pid	Process
5104	MJSQCNZV.exe
3636	MJSQCNZV.exe
3600	MJSQCNZV.exe
2272	MJSQCNZV.exe
184	MJSQCNZV.exe
2544	MJSQCNZV.exe
4500	MJSQCNZV.exe
2152	MJSQCNZV.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 5104 set thread context of 3636	5104	MJSQCNZV.exe	92
PID 5104 set thread context of 3600	5104	MJSQCNZV.exe	93
PID 5104 set thread context of 2272	5104	MJSQCNZV.exe	94
PID 184 set thread context of 2544	184	MJSQCNZV.exe	101
PID 184 set thread context of 4500	184	MJSQCNZV.exe	102
PID 184 set thread context of 2152	184	MJSQCNZV.exe	103

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4520	2272	WerFault.exe	94
4128	3600	WerFault.exe
2412	2152	WerFault.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
5104	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4932	EXCEL.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5104	MJSQCNZV.exe
Token: SeDebugPrivilege	184	MJSQCNZV.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
4932	EXCEL.EXE
4932	EXCEL.EXE
4932	EXCEL.EXE
4932	EXCEL.EXE
4932	EXCEL.EXE
4932	EXCEL.EXE
4932	EXCEL.EXE
4932	EXCEL.EXE
4932	EXCEL.EXE
4932	EXCEL.EXE
4932	EXCEL.EXE
4932	EXCEL.EXE
4932	EXCEL.EXE
4932	EXCEL.EXE
4932	EXCEL.EXE
4932	EXCEL.EXE
4932	EXCEL.EXE
4932	EXCEL.EXE

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 5104	4932	EXCEL.EXE	89
PID 4932 wrote to memory of 5104	4932	EXCEL.EXE	89
PID 4932 wrote to memory of 5104	4932	EXCEL.EXE	89
PID 5104 wrote to memory of 3636	5104	MJSQCNZV.exe	92
PID 5104 wrote to memory of 3636	5104	MJSQCNZV.exe	92
PID 5104 wrote to memory of 3636	5104	MJSQCNZV.exe	92
PID 5104 wrote to memory of 3636	5104	MJSQCNZV.exe	92
PID 5104 wrote to memory of 3636	5104	MJSQCNZV.exe	92
PID 5104 wrote to memory of 3636	5104	MJSQCNZV.exe	92
PID 5104 wrote to memory of 3636	5104	MJSQCNZV.exe	92
PID 5104 wrote to memory of 3636	5104	MJSQCNZV.exe	92
PID 5104 wrote to memory of 3600	5104	MJSQCNZV.exe	93
PID 5104 wrote to memory of 3600	5104	MJSQCNZV.exe	93
PID 5104 wrote to memory of 3600	5104	MJSQCNZV.exe	93
PID 5104 wrote to memory of 3600	5104	MJSQCNZV.exe	93
PID 5104 wrote to memory of 3600	5104	MJSQCNZV.exe	93
PID 5104 wrote to memory of 3600	5104	MJSQCNZV.exe	93
PID 5104 wrote to memory of 3600	5104	MJSQCNZV.exe	93
PID 5104 wrote to memory of 3600	5104	MJSQCNZV.exe	93
PID 5104 wrote to memory of 2272	5104	MJSQCNZV.exe	94
PID 5104 wrote to memory of 2272	5104	MJSQCNZV.exe	94
PID 5104 wrote to memory of 2272	5104	MJSQCNZV.exe	94
PID 5104 wrote to memory of 2272	5104	MJSQCNZV.exe	94
PID 5104 wrote to memory of 2272	5104	MJSQCNZV.exe	94
PID 5104 wrote to memory of 2272	5104	MJSQCNZV.exe	94
PID 5104 wrote to memory of 2272	5104	MJSQCNZV.exe	94
PID 5104 wrote to memory of 2272	5104	MJSQCNZV.exe	94
PID 3636 wrote to memory of 184	3636	MJSQCNZV.exe	98
PID 3636 wrote to memory of 184	3636	MJSQCNZV.exe	98
PID 3636 wrote to memory of 184	3636	MJSQCNZV.exe	98
PID 184 wrote to memory of 2544	184	MJSQCNZV.exe	101
PID 184 wrote to memory of 2544	184	MJSQCNZV.exe	101
PID 184 wrote to memory of 2544	184	MJSQCNZV.exe	101
PID 184 wrote to memory of 2544	184	MJSQCNZV.exe	101
PID 184 wrote to memory of 2544	184	MJSQCNZV.exe	101
PID 184 wrote to memory of 2544	184	MJSQCNZV.exe	101
PID 184 wrote to memory of 2544	184	MJSQCNZV.exe	101
PID 184 wrote to memory of 2544	184	MJSQCNZV.exe	101
PID 184 wrote to memory of 4500	184	MJSQCNZV.exe	102
PID 184 wrote to memory of 4500	184	MJSQCNZV.exe	102
PID 184 wrote to memory of 4500	184	MJSQCNZV.exe	102
PID 184 wrote to memory of 4500	184	MJSQCNZV.exe	102
PID 184 wrote to memory of 4500	184	MJSQCNZV.exe	102
PID 184 wrote to memory of 4500	184	MJSQCNZV.exe	102
PID 184 wrote to memory of 4500	184	MJSQCNZV.exe	102
PID 184 wrote to memory of 4500	184	MJSQCNZV.exe	102
PID 184 wrote to memory of 2152	184	MJSQCNZV.exe	103
PID 184 wrote to memory of 2152	184	MJSQCNZV.exe	103
PID 184 wrote to memory of 2152	184	MJSQCNZV.exe	103
PID 184 wrote to memory of 2152	184	MJSQCNZV.exe	103
PID 184 wrote to memory of 2152	184	MJSQCNZV.exe	103
PID 184 wrote to memory of 2152	184	MJSQCNZV.exe	103
PID 184 wrote to memory of 2152	184	MJSQCNZV.exe	103
PID 184 wrote to memory of 2152	184	MJSQCNZV.exe	103
PID 2544 wrote to memory of 5104	2544	MJSQCNZV.exe	111
PID 2544 wrote to memory of 5104	2544	MJSQCNZV.exe	111
PID 2544 wrote to memory of 5104	2544	MJSQCNZV.exe	111

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Transaccion_Recibos.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\MJSQCNZV.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\MJSQCNZV.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\MJSQCNZV.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\MJSQCNZV.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3636
  - - C:\Users\Admin\AppData\Roaming\XenoManager\MJSQCNZV.exe
      "C:\Users\Admin\AppData\Roaming\XenoManager\MJSQCNZV.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:184
    - - C:\Users\Admin\AppData\Roaming\XenoManager\MJSQCNZV.exe
        
        C:\Users\Admin\AppData\Roaming\XenoManager\MJSQCNZV.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2544
      - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks.exe" /Create /TN "cms" /XML "C:\Users\Admin\AppData\Local\Temp\tmp41C7.tmp" /F
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5104
    - - C:\Users\Admin\AppData\Roaming\XenoManager\MJSQCNZV.exe
        
        C:\Users\Admin\AppData\Roaming\XenoManager\MJSQCNZV.exe
        5⤵
        Executes dropped EXE
        
        PID:4500
    - - C:\Users\Admin\AppData\Roaming\XenoManager\MJSQCNZV.exe
        
        C:\Users\Admin\AppData\Roaming\XenoManager\MJSQCNZV.exe
        5⤵
        Executes dropped EXE
        
        PID:2152
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 152
        6⤵
        Program crash
        
        PID:2412
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\MJSQCNZV.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\MJSQCNZV.exe
    3⤵
    - Executes dropped EXE
    PID:3600
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 80
      4⤵
      Program crash
      PID:4128
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\MJSQCNZV.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\MJSQCNZV.exe
    3⤵
    - Executes dropped EXE
    PID:2272
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 80
      4⤵
      Program crash
      PID:4520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2272 -ip 2272
1⤵
PID:1540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3600 -ip 3600
1⤵
PID:3292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2152 -ip 2152
1⤵
PID:764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery