masslogger | 92c9a0926da348abc0898bcd4ca5dc955f2c09f14a22b525cc380fa68060154a

General

Target

233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe
Size

1.3MB
MD5

233dbd416c7d4fa86ea366ea562ce9dc
SHA1

b46eae66bc15448cf4221bd0f9d1b1a9c62643d1
SHA256

92c9a0926da348abc0898bcd4ca5dc955f2c09f14a22b525cc380fa68060154a
SHA512

7d4b8781c606001ce87698458e4a686102280d6c80f028f32b227cc51e486d5d88682fc7aa38d262f61a26c26a1c72a00ea1968a12e53c3868317c0b62e6053a
SSDEEP

24576:Vol7KQqoo0Q6NnacFPo38MUeMbBhCw/s8i+5P92L+WEvIfwf:So0Q6NnbPoAVBhCw/s8i+5V1WE3

Score

10^/10

masslogger discovery spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4920-17-0x0000000000400000-0x000000000049A000-memory.dmp	family_masslogger

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

52 api.ipify.org

flow	ioc
52	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe

description	pid	process	target process
PID 4832 set thread context of 4920	4832	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
1428	4920	WerFault.exe	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe
2628	4920	WerFault.exe	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exeschtasks.exe233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

1464 schtasks.exe

pid	process
1464	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe

pid	process
4832	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe
4832	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe
4832	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe
4832	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe
4832	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe
4832	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe
4920	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe
4920	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	4832	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe
Token: SeDebugPrivilege	4920	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe

pid process

4920 233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe

pid	process
4920	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe

description	pid	process	target process
PID 4832 wrote to memory of 1464	4832	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe	schtasks.exe
PID 4832 wrote to memory of 1464	4832	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe	schtasks.exe
PID 4832 wrote to memory of 1464	4832	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe	schtasks.exe
PID 4832 wrote to memory of 5112	4832	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe
PID 4832 wrote to memory of 5112	4832	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe
PID 4832 wrote to memory of 5112	4832	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe
PID 4832 wrote to memory of 4920	4832	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe
PID 4832 wrote to memory of 4920	4832	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe
PID 4832 wrote to memory of 4920	4832	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe
PID 4832 wrote to memory of 4920	4832	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe
PID 4832 wrote to memory of 4920	4832	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe
PID 4832 wrote to memory of 4920	4832	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe
PID 4832 wrote to memory of 4920	4832	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe
PID 4832 wrote to memory of 4920	4832	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe	233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4832

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RSiGbDk" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4BBA.tmp"
2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1464

C:\Users\Admin\AppData\Local\Temp\233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe"
2⤵
PID:5112

C:\Users\Admin\AppData\Local\Temp\233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe"
2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 1904
3⤵
- Program crash
PID:1428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 1904
3⤵
- Program crash
PID:2628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4920 -ip 4920
1⤵
PID:1160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4920 -ip 4920
1⤵
PID:1776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\233dbd416c7d4fa86ea366ea562ce9dc_JaffaCakes118.exe.log

Filesize
1KB

MD5
21e594849d9d68d6e77d327848021e5c

SHA1
812590cb60e0e7d11f0350ea46a484a2758178c2

SHA256
b503f7214e23e0c8881eba99991af376427074bd9410e2a52fcf009b0a73db9e

SHA512
8c63c8ae84d626869f93af20a5dcc46fd26cdf4573848631adfe905313dea255d3c2337f7d45a63e72dc9297c60d7a18107bbf72b34e4b448109797aaa50377a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4BBA.tmp

Filesize
1KB

MD5
ded05ff48b378de9bb1c470e1a928fe1

SHA1
ed27a5781072f659841988b07b7ef4e6aaab6d91

SHA256
0ea4172f33b3d3ec6ac6a18ec0fd8c72be7e0d0c8b07a785e2326a8315e061c6

SHA512
d263b678b50a6c6cc48b7087bf30c6572be89bb1ba4d12a1399fcfd6758a20a1042b756bbffa7cdfc958313968d8cd999a9ffda5d5f1cdc14304ad9c3c8340c8

Download Submit
memory/4832-10-0x0000000006450000-0x000000000650C000-memory.dmp

Filesize
752KB

Download
memory/4832-20-0x0000000074C50000-0x0000000075400000-memory.dmp

Filesize
7.7MB

Download
memory/4832-4-0x0000000005400000-0x000000000549C000-memory.dmp

Filesize
624KB

Download
memory/4832-5-0x0000000074C50000-0x0000000075400000-memory.dmp

Filesize
7.7MB

Download
memory/4832-6-0x0000000005340000-0x000000000534A000-memory.dmp

Filesize
40KB

Download
memory/4832-7-0x0000000005350000-0x0000000005358000-memory.dmp

Filesize
32KB

Download
memory/4832-8-0x0000000074C5E000-0x0000000074C5F000-memory.dmp

Filesize
4KB

Download
memory/4832-9-0x0000000074C50000-0x0000000075400000-memory.dmp

Filesize
7.7MB

Download
memory/4832-0-0x0000000074C5E000-0x0000000074C5F000-memory.dmp

Filesize
4KB

Download
memory/4832-11-0x0000000006510000-0x00000000065AC000-memory.dmp

Filesize
624KB

Download
memory/4832-2-0x0000000005730000-0x0000000005CD4000-memory.dmp

Filesize
5.6MB

Download
memory/4832-3-0x0000000005360000-0x00000000053F2000-memory.dmp

Filesize
584KB

Download
memory/4832-1-0x00000000004A0000-0x00000000005EA000-memory.dmp

Filesize
1.3MB

Download
memory/4920-17-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/4920-21-0x0000000005480000-0x00000000054C4000-memory.dmp

Filesize
272KB

Download
memory/4920-22-0x0000000074C50000-0x0000000075400000-memory.dmp

Filesize
7.7MB

Download
memory/4920-24-0x0000000074C50000-0x0000000075400000-memory.dmp

Filesize
7.7MB

Download
memory/4920-23-0x0000000005530000-0x0000000005596000-memory.dmp

Filesize
408KB

Download
memory/4920-25-0x0000000074C50000-0x0000000075400000-memory.dmp

Filesize
7.7MB

Download
memory/4920-26-0x0000000074C50000-0x0000000075400000-memory.dmp

Filesize
7.7MB

Download
memory/4920-27-0x0000000074C50000-0x0000000075400000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads