gozi | 9b615cbd7e76bd7ba8eb200282d80eeb80acf6d7093b91eb539b61fe5f56f94d

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2672 cmd.exe

pid	process
2672	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

Processes:

6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\FXSCXT32 = "C:\\Windows\\system32\\cnvfore6.exe"	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

Processes:

6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\system32\cnvfore6.exe	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe
File created	C:\Windows\system32\cnvfore6.exe	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe

description	pid	process	target process
PID 1752 set thread context of 2456	1752	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe
PID 2456 set thread context of 2744	2456	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 5 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe

pid process

2456 6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

2744 explorer.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe

pid process

2456 6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe

pid	process
2456	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe

pid	process
2456	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

explorer.exe

description	pid	process
Token: SeShutdownPrivilege	2744	explorer.exe
Token: SeShutdownPrivilege	2744	explorer.exe
Token: SeShutdownPrivilege	2744	explorer.exe
Token: SeShutdownPrivilege	2744	explorer.exe
Token: SeShutdownPrivilege	2744	explorer.exe
Token: SeShutdownPrivilege	2744	explorer.exe
Token: SeShutdownPrivilege	2744	explorer.exe
Token: SeShutdownPrivilege	2744	explorer.exe
Token: SeShutdownPrivilege	2744	explorer.exe
Token: SeShutdownPrivilege	2744	explorer.exe
Token: SeShutdownPrivilege	2744	explorer.exe
Token: SeShutdownPrivilege	2744	explorer.exe

Suspicious use of FindShellTrayWindow 28 IoCs

Processes:

explorer.exe

pid	process
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe

Suspicious use of SendNotifyMessage 18 IoCs

Processes:

explorer.exe

pid	process
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

explorer.exe

pid process

2744 explorer.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe6695e787f16834aba9284a71dbb79820_JaffaCakes118.execmd.exe

description	pid	process	target process
PID 1752 wrote to memory of 2440	1752	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe
PID 1752 wrote to memory of 2440	1752	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe
PID 1752 wrote to memory of 2440	1752	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe
PID 1752 wrote to memory of 2440	1752	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe
PID 1752 wrote to memory of 2456	1752	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe
PID 1752 wrote to memory of 2456	1752	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe
PID 1752 wrote to memory of 2456	1752	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe
PID 1752 wrote to memory of 2456	1752	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe
PID 1752 wrote to memory of 2456	1752	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe
PID 1752 wrote to memory of 2456	1752	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe
PID 1752 wrote to memory of 2456	1752	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe
PID 1752 wrote to memory of 2456	1752	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe
PID 1752 wrote to memory of 2456	1752	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe
PID 1752 wrote to memory of 2456	1752	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe
PID 1752 wrote to memory of 2456	1752	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe
PID 2456 wrote to memory of 2744	2456	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe	explorer.exe
PID 2456 wrote to memory of 2744	2456	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe	explorer.exe
PID 2456 wrote to memory of 2744	2456	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe	explorer.exe
PID 2456 wrote to memory of 2744	2456	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe	explorer.exe
PID 2456 wrote to memory of 2744	2456	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe	explorer.exe
PID 2456 wrote to memory of 2744	2456	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe	explorer.exe
PID 2456 wrote to memory of 2744	2456	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe	explorer.exe
PID 2456 wrote to memory of 2672	2456	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe	cmd.exe
PID 2456 wrote to memory of 2672	2456	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe	cmd.exe
PID 2456 wrote to memory of 2672	2456	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe	cmd.exe
PID 2456 wrote to memory of 2672	2456	6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe	cmd.exe
PID 2672 wrote to memory of 2544	2672	cmd.exe	attrib.exe
PID 2672 wrote to memory of 2544	2672	cmd.exe	attrib.exe
PID 2672 wrote to memory of 2544	2672	cmd.exe	attrib.exe
PID 2672 wrote to memory of 2544	2672	cmd.exe	attrib.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

2544 attrib.exe

pid	process
2544	attrib.exe

C:\Users\Admin\AppData\Local\Temp\6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1752

C:\Users\Admin\AppData\Local\Temp\6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe"
2⤵
PID:2440

C:\Users\Admin\AppData\Local\Temp\6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe"
2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2456

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
3⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2744

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\259399024.bat" "C:\Users\Admin\AppData\Local\Temp\6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe""
3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2672

C:\Windows\SysWOW64\attrib.exe
attrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\6695e787f16834aba9284a71dbb79820_JaffaCakes118.exe"
4⤵
- Views/modifies file attributes
PID:2544

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

T1112

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

Query Registry