f3cb6b4abc5b037c7e277fc0ba044641b249a760c18555cfe4f6c9cf3453be61

Analysis

max time kernel
165s
max time network
136s
platform
windows7_x64
resource
win7-en-20210920
submitted
28-09-2021 11:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

M20S.exe
Size

53KB
MD5

c6731f9725749aae21f0ef0e06d4c631
SHA1

68de72f9a02fd52e4cf740fcd301f71203117977
SHA256

f3cb6b4abc5b037c7e277fc0ba044641b249a760c18555cfe4f6c9cf3453be61
SHA512

f3a5ee1f6c67a0c752629390202c7db8684779aac3f8b958b3a7e72a22c78f72dc70b24584747cb0eaabdef23bc8ef49f2120fc42c92317002b04e885010fe31

Score

8^/10

persistence ransomware spyware stealer

Malware Config

Signatures

Modifies extensions of user files 15 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

M20S.exe

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\MountRedo.crw => C:\Users\Admin\Pictures\MountRedo.crw.marlock20	M20S.exe
File renamed	C:\Users\Admin\Pictures\RestartLimit.tif => C:\Users\Admin\Pictures\RestartLimit.tif.marlock20	M20S.exe
File renamed	C:\Users\Admin\Pictures\RestoreProtect.raw => C:\Users\Admin\Pictures\RestoreProtect.raw.marlock20	M20S.exe
File renamed	C:\Users\Admin\Pictures\SyncExpand.tif => C:\Users\Admin\Pictures\SyncExpand.tif.marlock20	M20S.exe
File renamed	C:\Users\Admin\Pictures\TraceRestore.tiff => C:\Users\Admin\Pictures\TraceRestore.tiff.marlock20	M20S.exe
File opened for modification	C:\Users\Admin\Pictures\InitializeStep.tiff	M20S.exe
File renamed	C:\Users\Admin\Pictures\EnterRead.tiff => C:\Users\Admin\Pictures\EnterRead.tiff.marlock20	M20S.exe
File renamed	C:\Users\Admin\Pictures\LimitCompare.tif => C:\Users\Admin\Pictures\LimitCompare.tif.marlock20	M20S.exe
File renamed	C:\Users\Admin\Pictures\MoveUnpublish.crw => C:\Users\Admin\Pictures\MoveUnpublish.crw.marlock20	M20S.exe
File renamed	C:\Users\Admin\Pictures\ReceiveSwitch.raw => C:\Users\Admin\Pictures\ReceiveSwitch.raw.marlock20	M20S.exe
File renamed	C:\Users\Admin\Pictures\SendResolve.png => C:\Users\Admin\Pictures\SendResolve.png.marlock20	M20S.exe
File opened for modification	C:\Users\Admin\Pictures\TraceRestore.tiff	M20S.exe
File opened for modification	C:\Users\Admin\Pictures\EnterRead.tiff	M20S.exe
File renamed	C:\Users\Admin\Pictures\InitializeStep.tiff => C:\Users\Admin\Pictures\InitializeStep.tiff.marlock20	M20S.exe
File renamed	C:\Users\Admin\Pictures\CheckpointClose.png => C:\Users\Admin\Pictures\CheckpointClose.png.marlock20	M20S.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid	Process
1652	cmd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

M20S.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	M20S.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\M20S.exe"	M20S.exe

Drops desktop.ini file(s) 37 IoCs

Processes:

M20S.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	M20S.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	M20S.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\desktop.ini	M20S.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	M20S.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	M20S.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	M20S.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	M20S.exe
File opened for modification	C:\Program Files\desktop.ini	M20S.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	M20S.exe
File opened for modification	C:\Users\Public\desktop.ini	M20S.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	M20S.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	M20S.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	M20S.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	M20S.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	M20S.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	M20S.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	M20S.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	M20S.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	M20S.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	M20S.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\desktop.ini	M20S.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	M20S.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	M20S.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	M20S.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	M20S.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	M20S.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	M20S.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	M20S.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	M20S.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	M20S.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	M20S.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	M20S.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	M20S.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	M20S.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3456797065-1076791440-4146276586-1000\desktop.ini	M20S.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	M20S.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	M20S.exe

Drops file in Program Files directory 64 IoCs

Processes:

M20S.exe

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\how_to_back_files.html	M20S.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_bullets.gif	M20S.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR20F.GIF	M20S.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD08808_.WMF	M20S.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0103850.WMF	M20S.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Manila	M20S.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\rollinghills.png	M20S.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0102762.WMF	M20S.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TAIL.WMF	M20S.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.71\psmachine_64.dll	M20S.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-visual.xml	M20S.exe
File created	C:\Program Files\Java\jre7\lib\amd64\how_to_back_files.html	M20S.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_ButtonGraphic.png	M20S.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGWEBCAL.XML	M20S.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SL00286_.WMF	M20S.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightRegular.ttf	M20S.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_ButtonGraphic.png	M20S.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LABEL.XML	M20S.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD10358_.GIF	M20S.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Fakaofo	M20S.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\eclipse.inf	M20S.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Creston	M20S.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Grid.xml	M20S.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_chromecast_plugin.dll	M20S.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\librawaud_plugin.dll	M20S.exe
File created	C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\how_to_back_files.html	M20S.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.fca	M20S.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedbck2.gif	M20S.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ulaanbaatar	M20S.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\OrielResume.Dotx	M20S.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\CircleIconsMask.bmp	M20S.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow\TAB_ON.GIF	M20S.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00489_.WMF	M20S.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\15x15dot.png	M20S.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-border.png	M20S.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-ImageMask.png	M20S.exe
File opened for modification	C:\Program Files\Windows Journal\Templates\Shorthand.jtp	M20S.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libbluescreen_plugin.dll	M20S.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\control\libdummy_plugin.dll	M20S.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\hrtfs\dodeca_and_7channel_3DSL_HRTF.sofa	M20S.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\SAVE.GIF	M20S.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02810J.JPG	M20S.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Nome	M20S.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack.dll	M20S.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Apex.xml	M20S.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Civic.xml	M20S.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0215718.WMF	M20S.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Boa_Vista	M20S.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_zh_4.4.0.v20140623020002.jar	M20S.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATHEDITOR_F_COL.HXK	M20S.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00486_.WMF	M20S.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\spu\how_to_back_files.html	M20S.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_ja_4.4.0.v20140623020002.jar	M20S.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00452_.WMF	M20S.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Phoenix	M20S.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Tasks.accdt	M20S.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\MSART10.BDR	M20S.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18210_.WMF	M20S.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0196142.WMF	M20S.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\BTOPENWORLD.COM.XML	M20S.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-spi-quicksearch.xml	M20S.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\how_to_back_files.html	M20S.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-back-static.png	M20S.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dhaka	M20S.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

M20S.exe

description	pid	Process	procid_target
PID 1112 wrote to memory of 1652	1112	M20S.exe	31
PID 1112 wrote to memory of 1652	1112	M20S.exe	31
PID 1112 wrote to memory of 1652	1112	M20S.exe	31
PID 1112 wrote to memory of 1652	1112	M20S.exe	31

C:\Users\Admin\AppData\Local\Temp\M20S.exe
"C:\Users\Admin\AppData\Local\Temp\M20S.exe"
1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\M20S.exe > nul
  2⤵
  - Deletes itself
  PID:1652

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3456797065-1076791440-4146276586-1000\desktop.ini

MD5
980847c1e5d6cb5ee3cf683f9f0a6fd6

SHA1
a4935db384cb6c783058adf8f06a448a2fc696b0

SHA256
5c828e7cac431555ea7e35f7d468428749be650cf7d55a63f716c443eb1420e2

SHA512
ea6abfcae8a47393467fd16fcfbef0243c516ee1056b2adebcc8413bdbe1a6e897ccf2fde3fa6d8f406d4f31c01cfef4f3c672b3373411b4e1774ca59fc7fbbd

Download Submit
memory/1112-53-0x0000000075871000-0x0000000075873000-memory.dmp

Filesize
8KB

Download
memory/1652-55-0x0000000000000000-mapping.dmp

Download