Analysis
-
max time kernel
165s -
max time network
136s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
28/09/2021, 11:10
Static task
static1
Behavioral task
behavioral1
Sample
M20S.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
M20S.exe
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
General
-
Target
M20S.exe
-
Size
53KB
-
MD5
c6731f9725749aae21f0ef0e06d4c631
-
SHA1
68de72f9a02fd52e4cf740fcd301f71203117977
-
SHA256
f3cb6b4abc5b037c7e277fc0ba044641b249a760c18555cfe4f6c9cf3453be61
-
SHA512
f3a5ee1f6c67a0c752629390202c7db8684779aac3f8b958b3a7e72a22c78f72dc70b24584747cb0eaabdef23bc8ef49f2120fc42c92317002b04e885010fe31
Score
8/10
Malware Config
Signatures
-
Modifies extensions of user files 15 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\MountRedo.crw => C:\Users\Admin\Pictures\MountRedo.crw.marlock20 M20S.exe File renamed C:\Users\Admin\Pictures\RestartLimit.tif => C:\Users\Admin\Pictures\RestartLimit.tif.marlock20 M20S.exe File renamed C:\Users\Admin\Pictures\RestoreProtect.raw => C:\Users\Admin\Pictures\RestoreProtect.raw.marlock20 M20S.exe File renamed C:\Users\Admin\Pictures\SyncExpand.tif => C:\Users\Admin\Pictures\SyncExpand.tif.marlock20 M20S.exe File renamed C:\Users\Admin\Pictures\TraceRestore.tiff => C:\Users\Admin\Pictures\TraceRestore.tiff.marlock20 M20S.exe File opened for modification C:\Users\Admin\Pictures\InitializeStep.tiff M20S.exe File renamed C:\Users\Admin\Pictures\EnterRead.tiff => C:\Users\Admin\Pictures\EnterRead.tiff.marlock20 M20S.exe File renamed C:\Users\Admin\Pictures\LimitCompare.tif => C:\Users\Admin\Pictures\LimitCompare.tif.marlock20 M20S.exe File renamed C:\Users\Admin\Pictures\MoveUnpublish.crw => C:\Users\Admin\Pictures\MoveUnpublish.crw.marlock20 M20S.exe File renamed C:\Users\Admin\Pictures\ReceiveSwitch.raw => C:\Users\Admin\Pictures\ReceiveSwitch.raw.marlock20 M20S.exe File renamed C:\Users\Admin\Pictures\SendResolve.png => C:\Users\Admin\Pictures\SendResolve.png.marlock20 M20S.exe File opened for modification C:\Users\Admin\Pictures\TraceRestore.tiff M20S.exe File opened for modification C:\Users\Admin\Pictures\EnterRead.tiff M20S.exe File renamed C:\Users\Admin\Pictures\InitializeStep.tiff => C:\Users\Admin\Pictures\InitializeStep.tiff.marlock20 M20S.exe File renamed C:\Users\Admin\Pictures\CheckpointClose.png => C:\Users\Admin\Pictures\CheckpointClose.png.marlock20 M20S.exe -
Deletes itself 1 IoCs
pid Process 1652 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce M20S.exe Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\M20S.exe" M20S.exe -
Drops desktop.ini file(s) 37 IoCs
description ioc Process File opened for modification C:\Users\Admin\Desktop\desktop.ini M20S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI M20S.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini M20S.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini M20S.exe File opened for modification C:\Users\Public\Libraries\desktop.ini M20S.exe File opened for modification C:\Users\Admin\Links\desktop.ini M20S.exe File opened for modification C:\Users\Admin\Documents\desktop.ini M20S.exe File opened for modification C:\Program Files\desktop.ini M20S.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini M20S.exe File opened for modification C:\Users\Public\desktop.ini M20S.exe File opened for modification C:\Users\Public\Music\desktop.ini M20S.exe File opened for modification C:\Users\Admin\Videos\desktop.ini M20S.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini M20S.exe File opened for modification C:\Users\Admin\Music\desktop.ini M20S.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini M20S.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini M20S.exe File opened for modification C:\Users\Public\Downloads\desktop.ini M20S.exe File opened for modification C:\Program Files (x86)\desktop.ini M20S.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini M20S.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini M20S.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini M20S.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini M20S.exe File opened for modification C:\Users\Public\Documents\desktop.ini M20S.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini M20S.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini M20S.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini M20S.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini M20S.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini M20S.exe File opened for modification C:\Users\Admin\Searches\desktop.ini M20S.exe File opened for modification C:\Users\Public\Pictures\desktop.ini M20S.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini M20S.exe File opened for modification C:\Users\Public\Desktop\desktop.ini M20S.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini M20S.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini M20S.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-3456797065-1076791440-4146276586-1000\desktop.ini M20S.exe File opened for modification C:\Users\Public\Videos\desktop.ini M20S.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini M20S.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\how_to_back_files.html M20S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_bullets.gif M20S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR20F.GIF M20S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD08808_.WMF M20S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0103850.WMF M20S.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Manila M20S.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\rollinghills.png M20S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0102762.WMF M20S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TAIL.WMF M20S.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\psmachine_64.dll M20S.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-visual.xml M20S.exe File created C:\Program Files\Java\jre7\lib\amd64\how_to_back_files.html M20S.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_ButtonGraphic.png M20S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGWEBCAL.XML M20S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SL00286_.WMF M20S.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightRegular.ttf M20S.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_ButtonGraphic.png M20S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LABEL.XML M20S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD10358_.GIF M20S.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Fakaofo M20S.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\eclipse.inf M20S.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Creston M20S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Grid.xml M20S.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_chromecast_plugin.dll M20S.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\librawaud_plugin.dll M20S.exe File created C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\how_to_back_files.html M20S.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.fca M20S.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedbck2.gif M20S.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ulaanbaatar M20S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\OrielResume.Dotx M20S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\CircleIconsMask.bmp M20S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow\TAB_ON.GIF M20S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00489_.WMF M20S.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\15x15dot.png M20S.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-border.png M20S.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-ImageMask.png M20S.exe File opened for modification C:\Program Files\Windows Journal\Templates\Shorthand.jtp M20S.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libbluescreen_plugin.dll M20S.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\libdummy_plugin.dll M20S.exe File opened for modification C:\Program Files\VideoLAN\VLC\hrtfs\dodeca_and_7channel_3DSL_HRTF.sofa M20S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\SAVE.GIF M20S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02810J.JPG M20S.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Nome M20S.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack.dll M20S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Apex.xml M20S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Civic.xml M20S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0215718.WMF M20S.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Boa_Vista M20S.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_zh_4.4.0.v20140623020002.jar M20S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATHEDITOR_F_COL.HXK M20S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00486_.WMF M20S.exe File created C:\Program Files\VideoLAN\VLC\plugins\spu\how_to_back_files.html M20S.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_ja_4.4.0.v20140623020002.jar M20S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00452_.WMF M20S.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Phoenix M20S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Tasks.accdt M20S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\MSART10.BDR M20S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18210_.WMF M20S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0196142.WMF M20S.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\BTOPENWORLD.COM.XML M20S.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-spi-quicksearch.xml M20S.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\how_to_back_files.html M20S.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-back-static.png M20S.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dhaka M20S.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1112 wrote to memory of 1652 1112 M20S.exe 31 PID 1112 wrote to memory of 1652 1112 M20S.exe 31 PID 1112 wrote to memory of 1652 1112 M20S.exe 31 PID 1112 wrote to memory of 1652 1112 M20S.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\M20S.exe"C:\Users\Admin\AppData\Local\Temp\M20S.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\M20S.exe > nul2⤵
- Deletes itself
PID:1652
-