715b3362e95fc7d1f61278dd8b1c815f4604ffdd65afa1ae0077b06073c4a507

Analysis

user interaction
yes
max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 08:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SvinoLock.exe
Size 5.7MB
Sample260719-ktxj2af12p
SHA256 715b3362e95fc7d1f61278dd8b1c815f4604ffdd65afa1ae0077b06073c4a507
MD5 de0d73b17f6030175b142dc2cd78fd12
SHA1 06ec918f89d7d80e5adb921e077d79835181fa84
SHA512 e2a977579c7f44cc9aa59f56f5e36f50d1d03ee34eda3884b7213c4e93acd7502bfac800d0a56b84e6658151bebc1731d6910c138d150d09d32d8b55537172ed
SSDEEP 98304:BvqmGvGWyDQJ563ouCv25J0UHKacMSLLeay6bjjqy6bjjyy6bjjD:cBnPJ564zaJ0UhvGia5O525n
TLSH
T1E9563308828A4959F07DB1B638955490CBE77E58D3628BCF28C95BF33A07368FD257B1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery evasion execution persistence trojan

Malware Config

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	WindowsDefenderUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	SvinoLock.exe

UAC bypass 3 TTPs 4 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SvinoLock.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SvinoLock.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WindowsDefenderUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WindowsDefenderUpdate.exe

Executes dropped EXE 1 IoCs

pid	Process
5908	WindowsDefenderUpdate.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderUpdate.exe = "C:\\ProgramData\\Microsoft\\Windows\\Caches\\WindowsDefenderUpdate.exe"	SvinoLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderUpdate.exe = "C:\\ProgramData\\Microsoft\\Windows\\Caches\\WindowsDefenderUpdate.exe"	WindowsDefenderUpdate.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SvinoLock.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WindowsDefenderUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WindowsDefenderUpdate.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SvinoLock.exe

Indicator Removal: Clear Persistence 1 TTPs 4 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4616	cmd.exe
5508	cmd.exe
4620	cmd.exe
4356	cmd.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\SysWOW64\Recovery\ReAgent.xml	ReAgentc.exe
File opened for modification	C:\Windows\SysWOW64\Recovery\winre.wim	SvinoLock.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 34 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5512	cmd.exe
5804	cmd.exe
1568	cmd.exe
2460	cmd.exe
3856	cmd.exe
4576	cmd.exe
2092	cmd.exe
5460	cmd.exe
1884	cmd.exe
5584	cmd.exe
4868	cmd.exe
5868	cmd.exe
5932	cmd.exe
4548	cmd.exe
5764	cmd.exe
984	cmd.exe
4864	cmd.exe
5932	cmd.exe
4544	cmd.exe
1692	cmd.exe
3528	cmd.exe
1560	cmd.exe
4996	cmd.exe
1864	cmd.exe
3240	cmd.exe
964	cmd.exe
5416	cmd.exe
3116	cmd.exe
2860	cmd.exe
3972	cmd.exe
5312	cmd.exe
4376	cmd.exe
4960	cmd.exe
3348	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 46 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsDefenderUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReAgentc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReAgentc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SvinoLock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
1300	timeout.exe
2248	timeout.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
4484	SvinoLock.exe
4484	SvinoLock.exe
4484	SvinoLock.exe
4484	SvinoLock.exe
4484	SvinoLock.exe
4484	SvinoLock.exe
4484	SvinoLock.exe
4484	SvinoLock.exe
4484	SvinoLock.exe
4484	SvinoLock.exe
4484	SvinoLock.exe
4484	SvinoLock.exe
4484	SvinoLock.exe
4484	SvinoLock.exe
4484	SvinoLock.exe
4484	SvinoLock.exe
4484	SvinoLock.exe
4484	SvinoLock.exe
4484	SvinoLock.exe
4484	SvinoLock.exe
4484	SvinoLock.exe
4484	SvinoLock.exe
4484	SvinoLock.exe
4484	SvinoLock.exe
5908	WindowsDefenderUpdate.exe
5908	WindowsDefenderUpdate.exe
5908	WindowsDefenderUpdate.exe
5908	WindowsDefenderUpdate.exe
5908	WindowsDefenderUpdate.exe
5908	WindowsDefenderUpdate.exe
5908	WindowsDefenderUpdate.exe
5908	WindowsDefenderUpdate.exe
5908	WindowsDefenderUpdate.exe
5908	WindowsDefenderUpdate.exe
5908	WindowsDefenderUpdate.exe
5908	WindowsDefenderUpdate.exe
5908	WindowsDefenderUpdate.exe
5908	WindowsDefenderUpdate.exe
5908	WindowsDefenderUpdate.exe
5908	WindowsDefenderUpdate.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4484	SvinoLock.exe
Token: SeSystemEnvironmentPrivilege	1576	svchost.exe
Token: SeDebugPrivilege	5908	WindowsDefenderUpdate.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4484	SvinoLock.exe
5908	WindowsDefenderUpdate.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 4576	4484	SvinoLock.exe	89
PID 4484 wrote to memory of 1864	4484	SvinoLock.exe	91
PID 4484 wrote to memory of 3240	4484	SvinoLock.exe	93
PID 4484 wrote to memory of 5460	4484	SvinoLock.exe	95
PID 4484 wrote to memory of 4548	4484	SvinoLock.exe	97
PID 4484 wrote to memory of 5932	4484	SvinoLock.exe	99
PID 4484 wrote to memory of 3972	4484	SvinoLock.exe	101
PID 3972 wrote to memory of 4220	3972	cmd.exe	103
PID 4484 wrote to memory of 5764	4484	SvinoLock.exe	105
PID 4484 wrote to memory of 4544	4484	SvinoLock.exe	107
PID 4484 wrote to memory of 1692	4484	SvinoLock.exe	109
PID 4484 wrote to memory of 3348	4484	SvinoLock.exe	111
PID 4484 wrote to memory of 1884	4484	SvinoLock.exe	113
PID 4484 wrote to memory of 5512	4484	SvinoLock.exe	115
PID 4484 wrote to memory of 5804	4484	SvinoLock.exe	117
PID 4484 wrote to memory of 5312	4484	SvinoLock.exe	119
PID 4484 wrote to memory of 984	4484	SvinoLock.exe	122
PID 4484 wrote to memory of 4620	4484	SvinoLock.exe	125
PID 5908 wrote to memory of 4864	5908	WindowsDefenderUpdate.exe	129
PID 5908 wrote to memory of 5584	5908	WindowsDefenderUpdate.exe	131
PID 5908 wrote to memory of 964	5908	WindowsDefenderUpdate.exe	133
PID 5908 wrote to memory of 2460	5908	WindowsDefenderUpdate.exe	135
PID 5908 wrote to memory of 5416	5908	WindowsDefenderUpdate.exe	137
PID 5908 wrote to memory of 3116	5908	WindowsDefenderUpdate.exe	139
PID 5908 wrote to memory of 3528	5908	WindowsDefenderUpdate.exe	141
PID 3528 wrote to memory of 6136	3528	cmd.exe	143
PID 5908 wrote to memory of 3856	5908	WindowsDefenderUpdate.exe	144
PID 5908 wrote to memory of 1568	5908	WindowsDefenderUpdate.exe	146
PID 5908 wrote to memory of 4868	5908	WindowsDefenderUpdate.exe	148
PID 5908 wrote to memory of 5868	5908	WindowsDefenderUpdate.exe	150
PID 5908 wrote to memory of 4376	5908	WindowsDefenderUpdate.exe	152
PID 5908 wrote to memory of 1560	5908	WindowsDefenderUpdate.exe	154
PID 5908 wrote to memory of 5932	5908	WindowsDefenderUpdate.exe	156
PID 5908 wrote to memory of 2860	5908	WindowsDefenderUpdate.exe	158
PID 5908 wrote to memory of 4960	5908	WindowsDefenderUpdate.exe	160
PID 5908 wrote to memory of 4356	5908	WindowsDefenderUpdate.exe	162
PID 5908 wrote to memory of 4244	5908	WindowsDefenderUpdate.exe	165
PID 5908 wrote to memory of 4616	5908	WindowsDefenderUpdate.exe	166
PID 4616 wrote to memory of 5804	4616	cmd.exe	168
PID 5908 wrote to memory of 2092	5908	WindowsDefenderUpdate.exe	169
PID 2092 wrote to memory of 1300	2092	cmd.exe	171
PID 5908 wrote to memory of 2672	5908	WindowsDefenderUpdate.exe	172
PID 5908 wrote to memory of 5508	5908	WindowsDefenderUpdate.exe	173
PID 5508 wrote to memory of 5728	5508	cmd.exe	176
PID 5908 wrote to memory of 4996	5908	WindowsDefenderUpdate.exe	177
PID 4996 wrote to memory of 2248	4996	cmd.exe	179

System policy modification 1 TTPs 8 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WindowsDefenderUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose = "1"	WindowsDefenderUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRecovery = "1"	SvinoLock.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SvinoLock.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SvinoLock.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose = "1"	SvinoLock.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRecovery = "1"	WindowsDefenderUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WindowsDefenderUpdate.exe

C:\Users\Admin\AppData\Local\Temp\SvinoLock.exe
"C:\Users\Admin\AppData\Local\Temp\SvinoLock.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4484
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} safeboot minimal
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4576
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} safeboot disabled
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1864
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} safeboot disabled
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3240
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootmenupolicy legacy
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5460
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} advancedoptions false
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4548
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} optionsedit false
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5932
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reagentc /disable
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3972
- - C:\Windows\SysWOW64\ReAgentc.exe
    reagentc /disable
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4220
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {default} recoverysequence
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5764
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {default} recoveryenabled
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4544
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {current} recoverysequence
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1692
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {current} recoveryenabled
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3348
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1884
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5512
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled No
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5804
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5312
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:984
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" schtasks /delete /tn "MicrosoftUpdateTask_WindowsDefenderUpdate" /f
  2⤵
  - Indicator Removal: Clear Persistence
  - System Location Discovery: System Language Discovery
  PID:4620

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1576

C:\ProgramData\Microsoft\Windows\Caches\WindowsDefenderUpdate.exe
C:\ProgramData\Microsoft\Windows\Caches\WindowsDefenderUpdate.exe
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5908
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} safeboot minimal
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4864
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} safeboot disabled
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5584
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} safeboot disabled
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:964
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootmenupolicy legacy
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2460
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} advancedoptions false
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5416
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} optionsedit false
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3116
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reagentc /disable
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3528
- - C:\Windows\SysWOW64\ReAgentc.exe
    reagentc /disable
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:6136
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {default} recoverysequence
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3856
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {default} recoveryenabled
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1568
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {current} recoverysequence
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4868
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {current} recoveryenabled
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5868
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4376
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1560
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled No
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5932
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2860
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4960
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" schtasks /delete /tn "MicrosoftUpdateTask_WindowsDefenderUpdate" /f
  2⤵
  - Indicator Removal: Clear Persistence
  - System Location Discovery: System Language Discovery
  PID:4356
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Modifies registry class
  PID:4244
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /delete /tn "MicrosoftUpdateTask*" /f
  2⤵
  - Indicator Removal: Clear Persistence
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4616
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftUpdateTask*" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5804
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 2 & del "C:\ProgramData\Microsoft\Windows\Caches\WindowsDefenderUpdate.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 2
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:1300
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Modifies registry class
  PID:2672
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /delete /tn "MicrosoftUpdateTask*" /f
  2⤵
  - Indicator Removal: Clear Persistence
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5508
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftUpdateTask*" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5728
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 2 & del "C:\ProgramData\Microsoft\Windows\Caches\WindowsDefenderUpdate.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 2
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WindowsDefenderUpdate.exe

Path C:\ProgramData\Microsoft\Windows\Caches\WindowsDefenderUpdate.exe
Size 5.7MB
SHA256 715b3362e95fc7d1f61278dd8b1c815f4604ffdd65afa1ae0077b06073c4a507
MD5 de0d73b17f6030175b142dc2cd78fd12
SHA1 06ec918f89d7d80e5adb921e077d79835181fa84
SHA512 e2a977579c7f44cc9aa59f56f5e36f50d1d03ee34eda3884b7213c4e93acd7502bfac800d0a56b84e6658151bebc1731d6910c138d150d09d32d8b55537172ed
SSDEEP 98304:BvqmGvGWyDQJ563ouCv25J0UHKacMSLLeay6bjjqy6bjjyy6bjjD:cBnPJ564zaJ0UhvGia5O525n
TLSH
T1E9563308828A4959F07DB1B638955490CBE77E58D3628BCF28C95BF33A07368FD257B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 4KB
SHA256 2bb4b719fc7e9d03d98da6198a4d6e0a7d7abe8f35e1609dd3ed076138171402
MD5 236189f1872d1a294a126fca1c095b65
SHA1 0bf37f361e2da24d8669163bdf1334c183b0a65a
SHA512 aa72cb37027cee5d8e687bab948657d6da3db9e5f95cdf190ae6e9c06ea3ef9cffbc413d1db995b9eee8e19f767a633510b32d27d62f21b0a14dc080271e98db
SSDEEP 96:RBvBYBvB+BoBDBoBjBoB6BoBABoBWBoBjBoB7BoBqJBZBsBi5ByxBqBRBKmBmBad:RBvBYBvB+BoBDBoBjBoB6BoBABoBWBoK
TLSH
T123A189330E8AC67D590AD641E7758B9ADD43B1A5170EB4103ABF3481BB0A74B4CFE98C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 14KB
SHA256 19504e12e08d05d05130fb7edfc5c98c757d1a01e48049bcd3c8baa4b50fe5a9
MD5 9b79f7cb1bb2b2b23d064fdb692e2b73
SHA1 10c5e61e39227ed13d92361fe67890f5de48a674
SHA512 cd87b279dd5fa0ca916b1e6c8712c3f4826f0a03cda804ff358c20c9c7c2001be3ea2860d1f6ff0fea429c0d4321ecfa588fd67739ba2ccb3ea65f2a1f133c96
SSDEEP 192:53gbq3gbq3gbHWxiM/1LUWwMWBvp3gbq3gbq3gbq3gbt:53Iq3Iq3IS63Iq3Iq3Iq3It
TLSH
T1FC62A629B1992EBB5C9446F9DFD038C26F8097794106A03795C4FDAFA279082F5B07CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 16KB
SHA256 af500110db9984dc13bb2e37aa90db993510c89ca8ea2adb55d9f16db6597607
MD5 051bdfa5d65717f8039b32597329f84b
SHA1 f21a0cc4df2b2dbddbf80660a328a9800e0c5931
SHA512 3ca01a17acb5457000925528f0b76796a20648b36d31d086bcd115feda361c721c5fdcdafb5cab55e287a334a90f56a0795f1ea6b9b196d9c29e04ce976debbd
SSDEEP 192:53gbq3gbECcd4EVJVsVLp3gbY3gbq3gbq3gbEBBBBBBBv3gbt:53Iq3ILcs3IY3Iq3Iq3Iq3It
TLSH
T13A72F938B1952FBB5C5046E8DBE038C26B8097794116A037A5C5FDAFB279042F9B17CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReAgent.xml

Path C:\Windows\SysWOW64\Recovery\ReAgent.xml
Size 1KB
SHA256 0f7d35d68a237b9c7d6d24c736e9a758761bb0840c113686b81e2ce33928ef65
MD5 7ba1a1ae453e18669377cbd6eb101109
SHA1 e57bd758fffefce630ab1399876f5c50e67c7804
SHA512 7060bf7aeeaeaf1fb85f427307463ca00f3050318f8630e08a92d7be9f0a4870d8c44c3323c9b81df6f1651ad8171009c0abde3b11f766da238c785f72ba05ff
TLSH
T11311AB4681B858A6C7B1D266F1F8BD60463FF1DD02E18A5CE029F7D39447452C75F970
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4484-4-0x00000000056F0000-0x00000000056FA000-memory.dmp

Download

memory/4484-10-0x0000000007590000-0x00000000075F6000-memory.dmp

Download

memory/4484-11-0x00000000748F2000-0x00000000748F3000-memory.dmp

Download

memory/4484-12-0x00000000748E0000-0x000000007509C000-memory.dmp

Download

memory/4484-5-0x00000000748E0000-0x000000007509C000-memory.dmp

Download

memory/4484-14-0x00000000748E0000-0x000000007509C000-memory.dmp

Download

memory/4484-0-0x00000000748F2000-0x00000000748F3000-memory.dmp

Download

memory/4484-3-0x00000000057D0000-0x0000000005862000-memory.dmp

Download

memory/4484-2-0x0000000005D90000-0x000000000634A000-memory.dmp

Download

memory/4484-1-0x0000000000760000-0x0000000000D1A000-memory.dmp

Download

memory/4484-23-0x00000000748E0000-0x000000007509C000-memory.dmp

Download