Overview

overview

10

Static

static

3

SvinoLock.exe

windows10-2004-x64

10

SvinoLock.exe

windows11-ltsc_2024-x64

Analysis

  • user interaction
    yes
  • max time kernel
    128s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/08/2026, 19:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SvinoLock.exe
  • Size 5.7MB
  • Sample260809-yp8y6avdpg
  • SHA256 689946c4b66ea7e4fdd310a915463a1a9493bcd87f239b8c310199efe4a56ddd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryevasionexecutionimpactpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs
    evasiontrojan
  • UAC bypass 3 TTPs 4 IoCs
    defense_evasiontrojan
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 10 IoCs
    ransomwareevasion
  • Renames multiple (1213) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 9 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables RegEdit via registry modification 2 IoCs
    defense_evasion
  • Disables Task Manager via registry modification
    defense_evasion
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 10 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: Clear Persistence 1 TTPs 10 IoCs

    Clear artifacts associated with previously established persistence like scheduletasks on a host.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 42 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 8 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\SvinoLock.exe
    "C:\Users\Admin\AppData\Local\Temp\SvinoLock.exe"
    1⤵
    • Modifies Windows Defender DisableAntiSpyware settings
    • UAC bypass
    • Disables RegEdit via registry modification
    • Checks computer location settings
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:5020
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} safeboot minimal
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1636
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} safeboot minimal
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:1840
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} safeboot disabled
      2⤵
      • Executes a command shell one-liner
      PID:2744
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} safeboot disabled
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2920
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {current} safeboot disabled
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:4088
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootmenupolicy legacy
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4808
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} bootmenupolicy legacy
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:3964
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} advancedoptions false
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3948
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} advancedoptions false
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:2132
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} optionsedit false
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2352
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} optionsedit false
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:1764
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reagentc /disable
      2⤵
      • Executes a command shell one-liner
      PID:4212
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {default} recoverysequence
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4000
      • C:\Windows\system32\bcdedit.exe
        bcdedit /deletevalue {default} recoverysequence
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:4956
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {default} recoveryenabled
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5028
      • C:\Windows\system32\bcdedit.exe
        bcdedit /deletevalue {default} recoveryenabled
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:2020
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {current} recoverysequence
      2⤵
      • Executes a command shell one-liner
      PID:3600
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {current} recoveryenabled
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4852
      • C:\Windows\system32\bcdedit.exe
        bcdedit /deletevalue {current} recoveryenabled
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:4020
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No
      2⤵
      • Executes a command shell one-liner
      PID:2268
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
      2⤵
      • Executes a command shell one-liner
      PID:896
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled No
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2124
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {current} recoveryenabled No
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:4928
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3492
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {current} bootstatuspolicy ignoreallfailures
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:3512
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4376
      • C:\Windows\system32\vssadmin.exe
        vssadmin delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:4712
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" schtasks /delete /tn "MicrosoftUpdateTask_WindowsDefenderUpdate" /f
      2⤵
      • Indicator Removal: Clear Persistence
      PID:5044
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c schtasks /create /tn "MicrosoftUpdateTask_WindowsDefenderUpdate" /tr "C:\ProgramData\Microsoft\Windows\Caches\WindowsDefenderUpdate.exe" /sc onlogon /ru "Admin" /rl HIGHEST /f
      2⤵
      • Executes a command shell one-liner
      PID:5100
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" schtasks /delete /tn "MicrosoftUpdateTask_MicrosoftEdgeUpdate" /f
      2⤵
      • Indicator Removal: Clear Persistence
      PID:4412
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c schtasks /create /tn "MicrosoftUpdateTask_MicrosoftEdgeUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe" /sc onlogon /ru "Admin" /rl HIGHEST /f
      2⤵
      • Executes a command shell one-liner
      PID:1204
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" schtasks /delete /tn "MicrosoftUpdateTask_OneDriveSetup" /f
      2⤵
      • Indicator Removal: Clear Persistence
      PID:3732
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c schtasks /create /tn "MicrosoftUpdateTask_OneDriveSetup" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\OneDriveSetup.exe" /sc onlogon /ru "Admin" /rl HIGHEST /f
      2⤵
      • Executes a command shell one-liner
      PID:896
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" schtasks /delete /tn "MicrosoftUpdateTask_SystemRestoreHelper" /f
      2⤵
      • Indicator Removal: Clear Persistence
      PID:1760
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c schtasks /create /tn "MicrosoftUpdateTask_SystemRestoreHelper" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\SystemRestoreHelper.exe" /sc onlogon /ru "Admin" /rl HIGHEST /f
      2⤵
      • Executes a command shell one-liner
      PID:3576
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" schtasks /delete /tn "MicrosoftUpdateTask_MicrosoftUpdateService" /f
      2⤵
      • Indicator Removal: Clear Persistence
      PID:3448
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c schtasks /create /tn "MicrosoftUpdateTask_MicrosoftUpdateService" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\MicrosoftUpdateService.exe" /sc onlogon /ru "Admin" /rl HIGHEST /f
      2⤵
      • Executes a command shell one-liner
      PID:280
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\MicrosoftUpdateService.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\MicrosoftUpdateService.exe"
      2⤵
      • Modifies Windows Defender DisableAntiSpyware settings
      • UAC bypass
      • Disables RegEdit via registry modification
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1248
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} safeboot minimal
        3⤵
        • Executes a command shell one-liner
        PID:3288
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} safeboot disabled
        3⤵
        • Executes a command shell one-liner
        PID:4608
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} safeboot disabled
        3⤵
        • Executes a command shell one-liner
        PID:2496
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootmenupolicy legacy
        3⤵
        • Executes a command shell one-liner
        PID:1340
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} advancedoptions false
        3⤵
        • Executes a command shell one-liner
        PID:764
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} optionsedit false
        3⤵
        • Executes a command shell one-liner
        PID:2972
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c reagentc /disable
        3⤵
        • Executes a command shell one-liner
        PID:1784
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {default} recoverysequence
        3⤵
        • Executes a command shell one-liner
        PID:3052
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {default} recoveryenabled
        3⤵
        • Executes a command shell one-liner
        PID:1912
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {current} recoverysequence
        3⤵
        • Executes a command shell one-liner
        PID:1128
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {current} recoveryenabled
        3⤵
        • Executes a command shell one-liner
        PID:4232
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No
        3⤵
        • Executes a command shell one-liner
        PID:3232
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
        3⤵
        • Executes a command shell one-liner
        PID:1884
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled No
        3⤵
        • Executes a command shell one-liner
        PID:2428
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
        3⤵
        • Executes a command shell one-liner
        PID:3156
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet
        3⤵
        • Executes a command shell one-liner
        PID:3772
      • C:\Windows\SYSTEM32\cmd.exe
        "cmd.exe" schtasks /delete /tn "MicrosoftUpdateTask_WindowsDefenderUpdate" /f
        3⤵
        • Indicator Removal: Clear Persistence
        PID:1140
      • C:\Windows\SYSTEM32\cmd.exe
        "cmd.exe" /c schtasks /create /tn "MicrosoftUpdateTask_WindowsDefenderUpdate" /tr "C:\ProgramData\Microsoft\Windows\Caches\WindowsDefenderUpdate.exe" /sc onlogon /ru "Admin" /rl HIGHEST /f
        3⤵
        • Executes a command shell one-liner
        PID:4672
      • C:\Windows\SYSTEM32\cmd.exe
        "cmd.exe" schtasks /delete /tn "MicrosoftUpdateTask_MicrosoftEdgeUpdate" /f
        3⤵
        • Indicator Removal: Clear Persistence
        PID:3924
      • C:\Windows\SYSTEM32\cmd.exe
        "cmd.exe" /c schtasks /create /tn "MicrosoftUpdateTask_MicrosoftEdgeUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe" /sc onlogon /ru "Admin" /rl HIGHEST /f
        3⤵
        • Executes a command shell one-liner
        PID:3484
        • C:\Windows\System32\Conhost.exe
          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          4⤵
            PID:3448
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd.exe" schtasks /delete /tn "MicrosoftUpdateTask_OneDriveSetup" /f
          3⤵
          • Indicator Removal: Clear Persistence
          PID:3304
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd.exe" /c schtasks /create /tn "MicrosoftUpdateTask_OneDriveSetup" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\OneDriveSetup.exe" /sc onlogon /ru "Admin" /rl HIGHEST /f
          3⤵
          • Executes a command shell one-liner
          PID:4396
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd.exe" schtasks /delete /tn "MicrosoftUpdateTask_SystemRestoreHelper" /f
          3⤵
          • Indicator Removal: Clear Persistence
          PID:2872
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd.exe" /c schtasks /create /tn "MicrosoftUpdateTask_SystemRestoreHelper" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\SystemRestoreHelper.exe" /sc onlogon /ru "Admin" /rl HIGHEST /f
          3⤵
          • Executes a command shell one-liner
          PID:1512
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd.exe" schtasks /delete /tn "MicrosoftUpdateTask_MicrosoftUpdateService" /f
          3⤵
          • Indicator Removal: Clear Persistence
          PID:644
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd.exe" /c schtasks /create /tn "MicrosoftUpdateTask_MicrosoftUpdateService" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\MicrosoftUpdateService.exe" /sc onlogon /ru "Admin" /rl HIGHEST /f
          3⤵
          • Executes a command shell one-liner
          PID:4468
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3400
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2280
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2080
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4292
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:724
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4868
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2384
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4592
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of FindShellTrayWindow
      PID:2020
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Modifies registry class
      PID:1228

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          Windows Command Shell

          1
          T1059.003

          Windows Management Instrumentation

          1
          T1047

          Persistence

          Boot or Logon Autostart Execution

          2
          T1547

          Active Setup

          1
          T1547.014

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Privilege Escalation

          Abuse Elevation Control Mechanism

          1
          T1548

          Bypass User Account Control

          1
          T1548.002

          Boot or Logon Autostart Execution

          2
          T1547

          Active Setup

          1
          T1547.014

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Defense Evasion

          Abuse Elevation Control Mechanism

          1
          T1548

          Bypass User Account Control

          1
          T1548.002

          Direct Volume Access

          1
          T1006

          Impair Defenses

          2
          T1562

          Disable or Modify Tools

          2
          T1562.001

          Indicator Removal

          3
          T1070

          Clear Persistence

          1
          T1070.009

          File Deletion

          2
          T1070.004

          Modify Registry

          5
          T1112

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Browser Information Discovery

          1
          T1217

          Peripheral Device Discovery

          2
          T1120

          Query Registry

          4
          T1012

          System Information Discovery

          5
          T1082

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Inhibit System Recovery

          3
          T1490

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          Account Web Data-journal.encrypted
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Account Web Data-journal.encrypted
          • Size 16B
          • SHA256 6b0f9833024b21532cde36217d505566c08c27f31bf83ffa87633e9e7d146e1b
          • MD5 SHA1 SHA512
          Submit Download

          CURRENT.encrypted
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT.encrypted
          • Size 32B
          • SHA256 5f9978d96576a3047fdeb1f10a948314490b9d04eb3a00e9533ddc9f440e6a31
          • MD5 SHA1 SHA512
          Submit Download

          MANIFEST-000001.encrypted
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\MANIFEST-000001.encrypted
          • Size 48B
          • SHA256 18a1e112ea2c6d2b8e2110440dafed3c185e1d3008bd56f18ed90d38b4fad703
          • MD5 SHA1 SHA512
          Submit Download

          index.encrypted
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index.encrypted
          • Size 32B
          • SHA256 33591b30e7ecc26964a39fa0afbb757106839261ea345f9b8b2a12b4ed787a4f
          • MD5 SHA1 SHA512
          Submit Download

          data_0.encrypted
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_0.encrypted
          • Size 8KB
          • SHA256 7c6b2f82be29303df2b37c73a97849c721475da6065e7d40ec4bdb19ff60728a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          data_1.encrypted
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_1.encrypted
          • Size 264KB
          • SHA256 a07e0c5fd27955c0438d8d7eee4f90f306da9a4a6493963fd9371229fc3cb1db
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          data_2.encrypted
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_2.encrypted
          • Size 8KB
          • SHA256 83d8c2295ef55e5d259b25e004d6ca09bc254e7a8773d105fe33cbcf4794a6e7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          data_3.encrypted
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_3.encrypted
          • Size 8KB
          • SHA256 e69d8f713b0f644da00564cba7128d592b202b42d8e5ab552ed281e5e961adda
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MicrosoftEdgeUpdate.exe
          • Path C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe
          • Size 5.7MB
          • SHA256 689946c4b66ea7e4fdd310a915463a1a9493bcd87f239b8c310199efe4a56ddd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          2823318777ntouromlalnodry--naod.sqlite-shm.encrypted
          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm.encrypted
          • Size 32KB
          • SHA256 39fe8190a482aeebb589a87e8799f2ea84c506b474d1c66936919508072e2f95
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          3561288849sdhlie.sqlite.encrypted
          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.encrypted
          • Size 48KB
          • SHA256 8848f6961f16635c1b2e20e0900e8e91f09bde092daacb88421376fca8de469a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/5020-8-0x000001C4BD460000-0x000001C4BD470000-memory.dmp
          Download

          memory/5020-0-0x000001C4BCAD0000-0x000001C4BD08C000-memory.dmp
          Download

          memory/5020-1-0x000001C4BD460000-0x000001C4BD470000-memory.dmp
          Download

          memory/5020-2-0x000001C4BD460000-0x000001C4BD470000-memory.dmp
          Download

          memory/5020-3-0x000001C4BD460000-0x000001C4BD470000-memory.dmp
          Download

          memory/5020-9-0x000001C4BD460000-0x000001C4BD470000-memory.dmp
          Download

          memory/5020-10-0x000001C4BD460000-0x000001C4BD470000-memory.dmp
          Download