Overview

overview

10

Static

static

3

SvinoLock.exe

windows10-2004-x64

10

SvinoLock.exe

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/08/2026, 19:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SvinoLock.exe
  • Size 5.7MB
  • Sample260809-yc2pbavbmd
  • SHA256 519b3e216d49612a0c069fc7100f8fb39ce6aa5914b56ea646857dd039fa641b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryevasionexecutionimpactpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • UAC bypass 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 14 IoCs
    ransomwareevasion
  • Renames multiple (1213) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables RegEdit via registry modification 1 IoCs
    defense_evasion
  • Disables Task Manager via registry modification
    defense_evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

    Clear artifacts associated with previously established persistence like scheduletasks on a host.

    defense_evasion
  • Drops file in System32 directory 3 IoCs
  • Drops file in Windows directory 4 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 16 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs
  • System policy modification 1 TTPs 4 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\SvinoLock.exe
    "C:\Users\Admin\AppData\Local\Temp\SvinoLock.exe"
    1⤵
    • Modifies Windows Defender DisableAntiSpyware settings
    • UAC bypass
    • Disables RegEdit via registry modification
    • Checks computer location settings
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4344
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} safeboot minimal
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2940
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} safeboot minimal
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:4820
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} safeboot disabled
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5004
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} safeboot disabled
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:2752
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} safeboot disabled
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4300
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {current} safeboot disabled
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:4716
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootmenupolicy legacy
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2548
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} bootmenupolicy legacy
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:3228
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} advancedoptions false
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1844
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} advancedoptions false
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:1580
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} optionsedit false
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4616
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} optionsedit false
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:1028
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reagentc /disable
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3232
      • C:\Windows\system32\ReAgentc.exe
        reagentc /disable
        3⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        PID:4740
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {default} recoverysequence
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1100
      • C:\Windows\system32\bcdedit.exe
        bcdedit /deletevalue {default} recoverysequence
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:1472
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {default} recoveryenabled
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1784
      • C:\Windows\system32\bcdedit.exe
        bcdedit /deletevalue {default} recoveryenabled
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:212
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {current} recoverysequence
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4408
      • C:\Windows\system32\bcdedit.exe
        bcdedit /deletevalue {current} recoverysequence
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:2748
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {current} recoveryenabled
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2304
      • C:\Windows\system32\bcdedit.exe
        bcdedit /deletevalue {current} recoveryenabled
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:1880
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1624
      • C:\Windows\System32\Conhost.exe
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        3⤵
          PID:1580
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} recoveryenabled No
          3⤵
          • Modifies boot configuration data using bcdedit
          PID:3120
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4312
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} bootstatuspolicy ignoreallfailures
          3⤵
          • Modifies boot configuration data using bcdedit
          PID:3944
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled No
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4532
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {current} recoveryenabled No
          3⤵
          • Modifies boot configuration data using bcdedit
          PID:1096
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1132
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {current} bootstatuspolicy ignoreallfailures
          3⤵
          • Modifies boot configuration data using bcdedit
          PID:3616
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3752
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          3⤵
          • Interacts with shadow copies
          PID:3324
      • C:\Windows\SYSTEM32\cmd.exe
        "cmd.exe" schtasks /delete /tn "MicrosoftUpdateTask_WindowsDefenderUpdate" /f
        2⤵
        • Indicator Removal: Clear Persistence
        PID:4200
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:3584
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3344
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3468
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
        PID:4608

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            1
            T1059

            Windows Command Shell

            1
            T1059.003

            Windows Management Instrumentation

            1
            T1047

            Persistence

            Boot or Logon Autostart Execution

            2
            T1547

            Active Setup

            1
            T1547.014

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Privilege Escalation

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Boot or Logon Autostart Execution

            2
            T1547

            Active Setup

            1
            T1547.014

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Defense Evasion

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Direct Volume Access

            1
            T1006

            Impair Defenses

            2
            T1562

            Disable or Modify Tools

            2
            T1562.001

            Indicator Removal

            3
            T1070

            Clear Persistence

            1
            T1070.009

            File Deletion

            2
            T1070.004

            Modify Registry

            5
            T1112

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Browser Information Discovery

            1
            T1217

            Peripheral Device Discovery

            2
            T1120

            Query Registry

            4
            T1012

            System Information Discovery

            5
            T1082

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Exfiltration

            Impact

            Inhibit System Recovery

            3
            T1490

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            Account Web Data-journal.encrypted
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Account Web Data-journal.encrypted
            • Size 16B
            • SHA256 7dbc288302be443d566de6f867d2fae03ff547cf1be07b984ba9dbd00adcbc9a
            • MD5 SHA1 SHA512
            Submit Download

            CURRENT.encrypted
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT.encrypted
            • Size 32B
            • SHA256 dd8e1229eaf4288c89b184169778e5a4c17ba2db5ca1839e1d9b16d786deed7a
            • MD5 SHA1 SHA512
            Submit Download

            MANIFEST-000001.encrypted
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\MANIFEST-000001.encrypted
            • Size 48B
            • SHA256 92dc58fd218f18f34897c29d216b0bbe142b347443b9caf9ba2e289e7b01ec73
            • MD5 SHA1 SHA512
            Submit Download

            index.encrypted
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index.encrypted
            • Size 32B
            • SHA256 0f327a97f51da28dd5542a6cd14dafbedb0976025d4880c0b58580bc0551641e
            • MD5 SHA1 SHA512
            Submit Download

            data_0.encrypted
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_0.encrypted
            • Size 8KB
            • SHA256 c1a59064e0253dcc4c5ff1896a3326b74ff27dcebe5d76806a8cf40f7500b097
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            data_1.encrypted
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_1.encrypted
            • Size 264KB
            • SHA256 dba5bdc2637193180a7671ee498c05fd7dc8ef936a25b5b2d8ce9fb4b7ef5c47
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            data_2.encrypted
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_2.encrypted
            • Size 8KB
            • SHA256 b87214b9f29938da3f03b45265ed7e30dd4aee93e7fc015f9dfef6d9d15b8f61
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            data_3.encrypted
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_3.encrypted
            • Size 8KB
            • SHA256 22237dacb524706cede9cc5fc85b74d08724738a8555c4d5f56ee393bdf66f34
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            0.0.filtertrie.intermediate.txt
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{6724e3de-039c-42b5-ae0e-154930657c25}\0.0.filtertrie.intermediate.txt
            • Size 29KB
            • SHA256 c54bd5c423aba3824d122bf533518824cc4866a584d6cdbb3361a30d05a5cb19
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            0.1.filtertrie.intermediate.txt
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{6724e3de-039c-42b5-ae0e-154930657c25}\0.1.filtertrie.intermediate.txt
            • Size 5B
            • SHA256 8e1e6a3d56796a245d0c7b0849548932fee803bbdb03f6e289495830e017f14c
            • MD5 SHA1 SHA512
            Submit Download

            0.2.filtertrie.intermediate.txt
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{6724e3de-039c-42b5-ae0e-154930657c25}\0.2.filtertrie.intermediate.txt
            • Size 5B
            • SHA256 d65b6a3bf11a27a1ced1f7e98082246e40cf01289fd47fe4a5ed46c221f2f73f
            • MD5 SHA1 SHA512
            Submit Download

            Apps.ft
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{6724e3de-039c-42b5-ae0e-154930657c25}\Apps.ft
            • Size 39KB
            • SHA256 c229e61e88d631f1918d3e7116e3305eb40c31a8294341de27412c36a96403e7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Apps.index
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{6724e3de-039c-42b5-ae0e-154930657c25}\Apps.index
            • Size 1.0MB
            • SHA256 38e7be51edf99f513b3924f06d165c203e38c57f4dd9987a5caffdffe469da8a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AppCache134307779794438828.txt
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134307779794438828.txt
            • Size 79KB
            • SHA256 61801e0434bb3f258cc5a183be30245a86622b0c88ee05a810c2d858bca36100
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            2823318777ntouromlalnodry--naod.sqlite-shm.encrypted
            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm.encrypted
            • Size 32KB
            • SHA256 bcf1dc752ff822add81ae45e9588d4d607deba5558eb2101d52696f58ee3f473
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            3561288849sdhlie.sqlite.encrypted
            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.encrypted
            • Size 48KB
            • SHA256 8fca2b23a91a50fa39c59b234be27cef77eea9f2c62e2078c2950e9d2711d755
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/3468-27-0x000001BC20420000-0x000001BC20440000-memory.dmp
            Download

            memory/3468-46-0x000001BC207E0000-0x000001BC20800000-memory.dmp
            Download

            memory/3468-36-0x000001BC201D0000-0x000001BC201F0000-memory.dmp
            Download

            memory/3468-23-0x000001BC1F400000-0x000001BC1F500000-memory.dmp
            Download

            memory/3584-28-0x0000000005280000-0x0000000005281000-memory.dmp
            Download

            memory/4344-0-0x000001B62C6C0000-0x000001B62CC7A000-memory.dmp
            Download

            memory/4344-161-0x000001B647220000-0x000001B647230000-memory.dmp
            Download

            memory/4344-18-0x000001B647220000-0x000001B647230000-memory.dmp
            Download

            memory/4344-15-0x000001B647220000-0x000001B647230000-memory.dmp
            Download

            memory/4344-3-0x000001B647220000-0x000001B647230000-memory.dmp
            Download

            memory/4344-2-0x000001B647220000-0x000001B647230000-memory.dmp
            Download

            memory/4344-1-0x000001B647220000-0x000001B647230000-memory.dmp
            Download