Overview

overview

10

Static

static

3

SvinoLock.exe

windows10-2004-x64

10

SvinoLock.exe

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    57s
  • max time network
    145s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/08/2026, 19:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SvinoLock.exe
  • Size 5.7MB
  • Sample260809-yc2pbavbmd
  • SHA256 519b3e216d49612a0c069fc7100f8fb39ce6aa5914b56ea646857dd039fa641b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasionevasionexecutionimpactpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • UAC bypass 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 14 IoCs
    ransomwareevasion
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables RegEdit via registry modification 1 IoCs
    defense_evasion
  • Disables Task Manager via registry modification
    defense_evasion
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

    Clear artifacts associated with previously established persistence like scheduletasks on a host.

    defense_evasion
  • Drops file in System32 directory 3 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 16 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious use of AdjustPrivilegeToken 39 IoCs
  • Suspicious use of FindShellTrayWindow 59 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs
  • System policy modification 1 TTPs 4 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\SvinoLock.exe
    "C:\Users\Admin\AppData\Local\Temp\SvinoLock.exe"
    1⤵
    • Modifies Windows Defender DisableAntiSpyware settings
    • UAC bypass
    • Disables RegEdit via registry modification
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:5012
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} safeboot minimal
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4920
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} safeboot minimal
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:1716
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} safeboot disabled
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1524
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} safeboot disabled
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:1748
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} safeboot disabled
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:6108
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {current} safeboot disabled
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:5132
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootmenupolicy legacy
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4848
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} bootmenupolicy legacy
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:1872
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} advancedoptions false
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1996
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} advancedoptions false
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:264
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} optionsedit false
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5020
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} optionsedit false
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:4656
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reagentc /disable
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3332
      • C:\Windows\system32\ReAgentc.exe
        reagentc /disable
        3⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        PID:2336
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {default} recoverysequence
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5708
      • C:\Windows\system32\bcdedit.exe
        bcdedit /deletevalue {default} recoverysequence
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:1244
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {default} recoveryenabled
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3384
      • C:\Windows\system32\bcdedit.exe
        bcdedit /deletevalue {default} recoveryenabled
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:4108
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {current} recoverysequence
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1820
      • C:\Windows\system32\bcdedit.exe
        bcdedit /deletevalue {current} recoverysequence
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:3104
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {current} recoveryenabled
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:240
      • C:\Windows\system32\bcdedit.exe
        bcdedit /deletevalue {current} recoveryenabled
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:4296
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2876
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} recoveryenabled No
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:4452
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:6044
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:5836
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled No
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2700
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {current} recoveryenabled No
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:3508
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:6080
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {current} bootstatuspolicy ignoreallfailures
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:1212
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5716
      • C:\Windows\system32\vssadmin.exe
        vssadmin delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:2732
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" schtasks /delete /tn "MicrosoftUpdateTask_WindowsDefenderUpdate" /f
      2⤵
      • Indicator Removal: Clear Persistence
      PID:5808
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2004
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4676
  • C:\Windows\system32\userinit.exe
    C:\Windows\system32\userinit.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4440
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:576
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3868
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3808

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        1
        T1059

        Windows Command Shell

        1
        T1059.003

        Windows Management Instrumentation

        1
        T1047

        Persistence

        Boot or Logon Autostart Execution

        2
        T1547

        Active Setup

        1
        T1547.014

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Privilege Escalation

        Abuse Elevation Control Mechanism

        1
        T1548

        Bypass User Account Control

        1
        T1548.002

        Boot or Logon Autostart Execution

        2
        T1547

        Active Setup

        1
        T1547.014

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Defense Evasion

        Abuse Elevation Control Mechanism

        1
        T1548

        Bypass User Account Control

        1
        T1548.002

        Direct Volume Access

        1
        T1006

        Impair Defenses

        2
        T1562

        Disable or Modify Tools

        2
        T1562.001

        Indicator Removal

        3
        T1070

        Clear Persistence

        1
        T1070.009

        File Deletion

        2
        T1070.004

        Modify Registry

        6
        T1112

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Peripheral Device Discovery

        2
        T1120

        Query Registry

        3
        T1012

        System Information Discovery

        4
        T1082

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Inhibit System Recovery

        3
        T1490

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Account Web Data-journal.encrypted
        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Account Web Data-journal.encrypted
        • Size 16B
        • SHA256 d83cc962b0b50e36d103a74676f669d7d1388d45ae62cc4196278a38a820474c
        • MD5 SHA1 SHA512
        Submit Download

        CURRENT.encrypted
        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\CURRENT.encrypted
        • Size 32B
        • SHA256 e40d6a84791f7e8683a057e17059f01d16b997ff21fddb4b2d96af383e99090b
        • MD5 SHA1 SHA512
        Submit Download

        MANIFEST-000001.encrypted
        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\MANIFEST-000001.encrypted
        • Size 48B
        • SHA256 7d6ce7589c103740322ca383206e3de13392086c310813d6b7b66b1ed8cfd122
        • MD5 SHA1 SHA512
        Submit Download

        data_0.encrypted
        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_0.encrypted
        • Size 8KB
        • SHA256 42e42318b7ba158cc5d7028d82a462550e72860c6161a4da9d89fcced7abcff1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        data_1.encrypted
        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1.encrypted
        • Size 264KB
        • SHA256 48c2ce13521caba4a7f0df0a5ba4c262f1c8b4e68b27a53d13415f348c144189
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        data_2.encrypted
        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_2.encrypted
        • Size 8KB
        • SHA256 876147a2b48b510e6c661d658fd69543a5d8892bba1ebee2baf9ec41b71b57c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        data_3.encrypted
        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_3.encrypted
        • Size 8KB
        • SHA256 a989209caf5a296b7083f6db313b0cc637e57cd0d869768764dd3f8f509f95e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 607B
        • SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        1451318868ntouromlalnodry--epcr.sqlite-shm.encrypted
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm.encrypted
        • Size 32KB
        • SHA256 0bea1ca4ff9d0f1db58307f28a5e10b9b700312c1cc41391a81ff0178196bc3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        3561288849sdhlie.sqlite.encrypted
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.encrypted
        • Size 48KB
        • SHA256 78b60571d715927dc20c6144e892461e2476bf498dcba0781336d0bfb1c97a2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3808-61-0x0000015E01DF0000-0x0000015E01E10000-memory.dmp
        Download

        memory/3808-40-0x0000015E001E0000-0x0000015E002E0000-memory.dmp
        Download

        memory/3808-50-0x0000015E01A50000-0x0000015E01A70000-memory.dmp
        Download

        memory/3808-51-0x0000015E01E70000-0x0000015E01F70000-memory.dmp
        Download

        memory/3808-85-0x0000015E14270000-0x0000015E14290000-memory.dmp
        Download

        memory/5012-174-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
        Download

        memory/5012-213-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
        Download

        memory/5012-10-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
        Download

        memory/5012-11-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
        Download

        memory/5012-149-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
        Download

        memory/5012-0-0x00007FFCF573F000-0x00007FFCF5740000-memory.dmp
        Download

        memory/5012-206-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
        Download

        memory/5012-207-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
        Download

        memory/5012-208-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
        Download

        memory/5012-210-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
        Download

        memory/5012-209-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
        Download

        memory/5012-211-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
        Download

        memory/5012-212-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
        Download

        memory/5012-16-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
        Download

        memory/5012-214-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
        Download

        memory/5012-215-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
        Download

        memory/5012-217-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
        Download

        memory/5012-218-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
        Download

        memory/5012-219-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
        Download

        memory/5012-9-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
        Download

        memory/5012-8-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
        Download

        memory/5012-7-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
        Download

        memory/5012-6-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
        Download

        memory/5012-5-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
        Download

        memory/5012-4-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
        Download

        memory/5012-3-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
        Download

        memory/5012-2-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
        Download

        memory/5012-1-0x000001A80E220000-0x000001A80E7DA000-memory.dmp
        Download