Overview

overview

10

Static

static

3

SvinoLock.exe

windows10-2004-x64

SvinoLock.exe

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    49s
  • max time network
    142s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/08/2026, 19:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SvinoLock.exe
  • Size 5.7MB
  • Sample260809-ymd11axzgx
  • SHA256 73d2a83952d98351c700d89d3394dc2ad1701692c8f5dbdfb7f979db92b740eb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasionevasionexecutionimpactpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • UAC bypass 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 14 IoCs
    ransomwareevasion
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables RegEdit via registry modification 1 IoCs
    defense_evasion
  • Disables Task Manager via registry modification
    defense_evasion
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

    Clear artifacts associated with previously established persistence like scheduletasks on a host.

    defense_evasion
  • Drops file in System32 directory 3 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 16 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 58 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs
  • System policy modification 1 TTPs 4 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\SvinoLock.exe
    "C:\Users\Admin\AppData\Local\Temp\SvinoLock.exe"
    1⤵
    • Modifies Windows Defender DisableAntiSpyware settings
    • UAC bypass
    • Disables RegEdit via registry modification
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3360
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} safeboot minimal
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3324
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} safeboot minimal
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:4924
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} safeboot disabled
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3892
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} safeboot disabled
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:4340
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} safeboot disabled
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4176
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {current} safeboot disabled
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:2320
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootmenupolicy legacy
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4592
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} bootmenupolicy legacy
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:1828
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} advancedoptions false
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3464
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} advancedoptions false
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:2796
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} optionsedit false
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:6120
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} optionsedit false
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:3832
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reagentc /disable
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4356
      • C:\Windows\system32\ReAgentc.exe
        reagentc /disable
        3⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        PID:4660
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {default} recoverysequence
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2736
      • C:\Windows\system32\bcdedit.exe
        bcdedit /deletevalue {default} recoverysequence
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:2420
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {default} recoveryenabled
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3820
      • C:\Windows\system32\bcdedit.exe
        bcdedit /deletevalue {default} recoveryenabled
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:728
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {current} recoverysequence
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5568
      • C:\Windows\system32\bcdedit.exe
        bcdedit /deletevalue {current} recoverysequence
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:1300
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {current} recoveryenabled
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1772
      • C:\Windows\system32\bcdedit.exe
        bcdedit /deletevalue {current} recoveryenabled
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:1780
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5608
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} recoveryenabled No
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:5752
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3524
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:4664
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled No
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:6092
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {current} recoveryenabled No
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:844
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5668
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {current} bootstatuspolicy ignoreallfailures
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:2596
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:6064
      • C:\Windows\system32\vssadmin.exe
        vssadmin delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:5660
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" schtasks /delete /tn "MicrosoftUpdateTask_WindowsDefenderUpdate" /f
      2⤵
      • Indicator Removal: Clear Persistence
      PID:3520
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5640
  • C:\Windows\system32\userinit.exe
    C:\Windows\system32\userinit.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4992
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:5624
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4548
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5128
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
      PID:5988

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          Windows Command Shell

          1
          T1059.003

          Windows Management Instrumentation

          1
          T1047

          Persistence

          Boot or Logon Autostart Execution

          2
          T1547

          Active Setup

          1
          T1547.014

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Privilege Escalation

          Abuse Elevation Control Mechanism

          1
          T1548

          Bypass User Account Control

          1
          T1548.002

          Boot or Logon Autostart Execution

          2
          T1547

          Active Setup

          1
          T1547.014

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Defense Evasion

          Abuse Elevation Control Mechanism

          1
          T1548

          Bypass User Account Control

          1
          T1548.002

          Direct Volume Access

          1
          T1006

          Impair Defenses

          2
          T1562

          Disable or Modify Tools

          2
          T1562.001

          Indicator Removal

          3
          T1070

          Clear Persistence

          1
          T1070.009

          File Deletion

          2
          T1070.004

          Modify Registry

          6
          T1112

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Peripheral Device Discovery

          2
          T1120

          Query Registry

          3
          T1012

          System Information Discovery

          4
          T1082

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Inhibit System Recovery

          3
          T1490

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          Account Web Data-journal.encrypted
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Account Web Data-journal.encrypted
          • Size 16B
          • SHA256 2618c5a24fd834db2ad8763df3663bbac49bd811c4fa4e6128c72ed48a746acb
          • MD5 SHA1 SHA512
          Submit Download

          CURRENT.encrypted
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\CURRENT.encrypted
          • Size 32B
          • SHA256 ff42ad46d2afc28a870cfd2e4e0d92adadee4b6971eae5aa6362ba31e28f3f94
          • MD5 SHA1 SHA512
          Submit Download

          MANIFEST-000001.encrypted
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\MANIFEST-000001.encrypted
          • Size 48B
          • SHA256 f2bd073a5bb251c9b8d6f899fc8978b9f9f7581e1ff35ecce4ec226c3f3c18e7
          • MD5 SHA1 SHA512
          Submit Download

          data_0.encrypted
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_0.encrypted
          • Size 8KB
          • SHA256 bfe415ba6397d1f580418e9c52dfa75cd90ab72f4f417c8cc207cc06d81c393e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          data_1.encrypted
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1.encrypted
          • Size 264KB
          • SHA256 c2f97341ee06506a55fcaf73233924c27da23f04a5fd1491dbce18e660e0abee
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          data_2.encrypted
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_2.encrypted
          • Size 8KB
          • SHA256 4ae5e4ccb0082de99ce022fb37681c9f1b88e3801728b3f40e9191349598e057
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          data_3.encrypted
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_3.encrypted
          • Size 8KB
          • SHA256 6b6ca6c6af6bab29ac795e54894dfd9a7f67fe0cea68dc79958d252665547a00
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          prep_Activatable Class_Hermes_perf.cache
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
          • Size 607B
          • SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          1451318868ntouromlalnodry--epcr.sqlite-shm.encrypted
          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm.encrypted
          • Size 32KB
          • SHA256 66a0bc9133681385b7613b13ced7f05a0360b87c02dec541a50ae0f8e59941a5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          3561288849sdhlie.sqlite.encrypted
          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.encrypted
          • Size 48KB
          • SHA256 15885254e0c1647812fd239f706e9f1a2e7452258f2ddc08a161a4cf3dce9a88
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/3360-172-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
          Download

          memory/3360-214-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
          Download

          memory/3360-10-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
          Download

          memory/3360-11-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
          Download

          memory/3360-2-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
          Download

          memory/3360-1-0x0000019A8CC30000-0x0000019A8D1EC000-memory.dmp
          Download

          memory/3360-3-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
          Download

          memory/3360-4-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
          Download

          memory/3360-5-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
          Download

          memory/3360-171-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
          Download

          memory/3360-0-0x00007FFEB9E9F000-0x00007FFEB9EA0000-memory.dmp
          Download

          memory/3360-207-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
          Download

          memory/3360-208-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
          Download

          memory/3360-209-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
          Download

          memory/3360-210-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
          Download

          memory/3360-211-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
          Download

          memory/3360-212-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
          Download

          memory/3360-12-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
          Download

          memory/3360-213-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
          Download

          memory/3360-215-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
          Download

          memory/3360-216-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
          Download

          memory/3360-217-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
          Download

          memory/3360-218-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
          Download

          memory/3360-219-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
          Download

          memory/3360-9-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
          Download

          memory/3360-8-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
          Download

          memory/3360-7-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
          Download

          memory/3360-6-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
          Download

          memory/4548-41-0x000001AF001E0000-0x000001AF002E0000-memory.dmp
          Download

          memory/4548-56-0x000001AF13F00000-0x000001AF14000000-memory.dmp
          Download

          memory/4548-62-0x000001AF03E80000-0x000001AF03EA0000-memory.dmp
          Download

          memory/4548-55-0x000001AF03A50000-0x000001AF03A70000-memory.dmp
          Download

          memory/4548-87-0x000001AF142A0000-0x000001AF142C0000-memory.dmp
          Download