Analysis
- user interaction
yes - max time kernel
150s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/07/2026, 14:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SvinoLock.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
SvinoLock.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
19 signatures
150 seconds
General
- Target SvinoLock.exe
- Size 29KB
- Sample260716-rljrjaft2k
- SHA256 c8bd772b1a8cb2c8b735f6cc84307ff1e772a9a798d49c0879f9aae327aa05d8
- MD5 3aef881563a2c8c47b194806f445e638
- SHA1 8fba6d23dfbb79d22aac147e21756ef45c6d1280
- SHA512 031100660a5bf184c0917233be4ab8a0c057b1625da9c5751e0a01b93b8064b51d205b427d0cd11a17aeb7627da14fe9160c1f1be3a34c91e6a4ff1659cbd5da
- SSDEEP 384:Evq/JGWaMlq4oMvjXpmfD7RlQADT/28dEQUdMFfInvvb0DffcE:2q/JKPY4vF11FAb05
- TLSH T14DD20A80B3F45A27D6FE4BF85DB122810BB5B9667821E6CE1CD560CF09F2B448B60B57
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" SvinoLock.exe - UAC bypass 3 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" SvinoLock.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SvinoLock.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftUpdate = "C:\\Windows\\System32\\MicrosoftUpdateService.exe" SvinoLock.exe - Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SvinoLock.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SvinoLock.exe - Indicator Removal: Clear Persistence 1 TTPs 2 IoCs
Clear artifacts associated with previously established persistence like scheduletasks on a host.
pid Process 5048 cmd.exe 5132 cmd.exe - Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Recovery ReAgentc.exe File opened for modification C:\Windows\SysWOW64\Recovery\ReAgent.xml ReAgentc.exe File opened for modification C:\Windows\SysWOW64\Recovery\winre.wim SvinoLock.exe File created C:\Windows\SysWOW64\MicrosoftUpdateService.exe SvinoLock.exe File opened for modification C:\Windows\SysWOW64\MicrosoftUpdateService.exe SvinoLock.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Panther\UnattendGC\diagwrn.xml ReAgentc.exe File opened for modification C:\Windows\Logs\ReAgent\ReAgent.log ReAgentc.exe File opened for modification C:\Windows\Panther\UnattendGC\setuperr.log ReAgentc.exe File opened for modification C:\Windows\Panther\UnattendGC\diagerr.xml ReAgentc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 26 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ReAgentc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SvinoLock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4356 schtasks.exe 3608 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2076 SvinoLock.exe 2076 SvinoLock.exe 2076 SvinoLock.exe 2076 SvinoLock.exe 2076 SvinoLock.exe 2076 SvinoLock.exe 2076 SvinoLock.exe 2076 SvinoLock.exe 2076 SvinoLock.exe 2076 SvinoLock.exe 2076 SvinoLock.exe 2076 SvinoLock.exe 2076 SvinoLock.exe 2076 SvinoLock.exe 2076 SvinoLock.exe 2076 SvinoLock.exe 2076 SvinoLock.exe 2076 SvinoLock.exe 2076 SvinoLock.exe 2076 SvinoLock.exe 2076 SvinoLock.exe 2076 SvinoLock.exe 2076 SvinoLock.exe 2076 SvinoLock.exe 2076 SvinoLock.exe 2076 SvinoLock.exe 2076 SvinoLock.exe 2076 SvinoLock.exe 2076 SvinoLock.exe 2076 SvinoLock.exe 2076 SvinoLock.exe 2076 SvinoLock.exe 2076 SvinoLock.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 2076 SvinoLock.exe 2076 SvinoLock.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 2076 SvinoLock.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 2076 SvinoLock.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 2076 SvinoLock.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5748 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2076 SvinoLock.exe Token: SeSystemEnvironmentPrivilege 3772 svchost.exe Token: SeDebugPrivilege 5748 taskmgr.exe Token: SeSystemProfilePrivilege 5748 taskmgr.exe Token: SeCreateGlobalPrivilege 5748 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe 5748 taskmgr.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2076 SvinoLock.exe 5748 taskmgr.exe - Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 2076 wrote to memory of 4620 2076 SvinoLock.exe 88 PID 2076 wrote to memory of 936 2076 SvinoLock.exe 90 PID 2076 wrote to memory of 2416 2076 SvinoLock.exe 92 PID 2076 wrote to memory of 6060 2076 SvinoLock.exe 94 PID 2076 wrote to memory of 1204 2076 SvinoLock.exe 96 PID 2076 wrote to memory of 708 2076 SvinoLock.exe 98 PID 2076 wrote to memory of 5008 2076 SvinoLock.exe 100 PID 5008 wrote to memory of 5668 5008 cmd.exe 102 PID 2076 wrote to memory of 5844 2076 SvinoLock.exe 104 PID 2076 wrote to memory of 3972 2076 SvinoLock.exe 106 PID 2076 wrote to memory of 1452 2076 SvinoLock.exe 108 PID 2076 wrote to memory of 2424 2076 SvinoLock.exe 110 PID 2076 wrote to memory of 5472 2076 SvinoLock.exe 112 PID 2076 wrote to memory of 2400 2076 SvinoLock.exe 114 PID 2076 wrote to memory of 2744 2076 SvinoLock.exe 116 PID 2076 wrote to memory of 3308 2076 SvinoLock.exe 118 PID 2076 wrote to memory of 3564 2076 SvinoLock.exe 121 PID 2076 wrote to memory of 5048 2076 SvinoLock.exe 124 PID 5048 wrote to memory of 5228 5048 cmd.exe 126 PID 2076 wrote to memory of 1684 2076 SvinoLock.exe 127 PID 1684 wrote to memory of 4356 1684 cmd.exe 129 PID 2076 wrote to memory of 5132 2076 SvinoLock.exe 131 PID 5132 wrote to memory of 4812 5132 cmd.exe 133 PID 2076 wrote to memory of 3868 2076 SvinoLock.exe 134 PID 3868 wrote to memory of 3608 3868 cmd.exe 136 - System policy modification 1 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRecovery = "1" SvinoLock.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SvinoLock.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" SvinoLock.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose = "1" SvinoLock.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SvinoLock.exe"C:\Users\Admin\AppData\Local\Temp\SvinoLock.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2076 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} safeboot minimal2⤵
- System Location Discovery: System Language Discovery
PID:4620
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} safeboot disabled2⤵
- System Location Discovery: System Language Discovery
PID:936
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} safeboot disabled2⤵
- System Location Discovery: System Language Discovery
PID:2416
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootmenupolicy legacy2⤵
- System Location Discovery: System Language Discovery
PID:6060
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} advancedoptions false2⤵
- System Location Discovery: System Language Discovery
PID:1204
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} optionsedit false2⤵
- System Location Discovery: System Language Discovery
PID:708
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reagentc /disable2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Windows\SysWOW64\ReAgentc.exereagentc /disable3⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5668
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {default} recoverysequence2⤵
- System Location Discovery: System Language Discovery
PID:5844
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {default} recoveryenabled2⤵
- System Location Discovery: System Language Discovery
PID:3972
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {current} recoverysequence2⤵
- System Location Discovery: System Language Discovery
PID:1452
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {current} recoveryenabled2⤵
- System Location Discovery: System Language Discovery
PID:2424
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵
- System Location Discovery: System Language Discovery
PID:5472
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- System Location Discovery: System Language Discovery
PID:2400
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled No2⤵
- System Location Discovery: System Language Discovery
PID:2744
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures2⤵
- System Location Discovery: System Language Discovery
PID:3308
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet2⤵
- System Location Discovery: System Language Discovery
PID:3564
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /delete /tn "MicrosoftUpdateTask" /f2⤵
- Indicator Removal: Clear Persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftUpdateTask" /f3⤵
- System Location Discovery: System Language Discovery
PID:5228
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /tn "MicrosoftUpdateTask" /tr "C:\Windows\System32\MicrosoftUpdateService.exe" /sc onlogon /ru SYSTEM /rl HIGHEST /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "MicrosoftUpdateTask" /tr "C:\Windows\System32\MicrosoftUpdateService.exe" /sc onlogon /ru SYSTEM /rl HIGHEST /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4356
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /delete /tn "MicrosoftUpdateTask" /f2⤵
- Indicator Removal: Clear Persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5132 -
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftUpdateTask" /f3⤵
- System Location Discovery: System Language Discovery
PID:4812
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /tn "MicrosoftUpdateTask" /tr "C:\Windows\System32\MicrosoftUpdateService.exe" /sc onlogon /ru SYSTEM /rl HIGHEST /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "MicrosoftUpdateTask" /tr "C:\Windows\System32\MicrosoftUpdateService.exe" /sc onlogon /ru SYSTEM /rl HIGHEST /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3608
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3772
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5748
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4396
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
2Indicator Removal
1Clear Persistence
1Modify Registry
4