Overview

overview

10

Static

static

10

0e7ab19049...bd.exe

windows10-2004-x64

10

0e7ab19049...bd.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    133s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/07/2026, 15:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    0e7ab1904953aca8e89ce357f5bce8e3758aaa5faa546e876a5551ec28dfd2bd.exe
  • Size 8.1MB
  • Sample260716-tcb2facv8y
  • SHA256 0e7ab1904953aca8e89ce357f5bce8e3758aaa5faa546e876a5551ec28dfd2bd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasionevasionexecutionbqtlockimpactpersistenceransomwarespywarestealer

Malware Config

Signatures

  • Family: BQTLock

    BQTLock is a cross-platform ransomware that operates under a Ransomware-as-a-Service model.

    ransomwarebqtlock
  • Detects BQTLock Ransomware 4 IoCs
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Detect suspicious telegram bot 4 IoCs

    Detect suspicious telegram bot.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\0e7ab1904953aca8e89ce357f5bce8e3758aaa5faa546e876a5551ec28dfd2bd.exe
    "C:\Users\Admin\AppData\Local\Temp\0e7ab1904953aca8e89ce357f5bce8e3758aaa5faa546e876a5551ec28dfd2bd.exe"
    1⤵
    • Sets desktop wallpaper using registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:828
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe delete shadows /all /quiet
      2⤵
      • Interacts with shadow copies
      PID:1596
    • C:\Windows\System32\Wbem\wmic.exe
      wmic.exe shadowcopy delete
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3328
    • C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
      2⤵
      • Modifies boot configuration data using bcdedit
      PID:204
    • C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit.exe /set {default} recoveryenabled no
      2⤵
      • Modifies boot configuration data using bcdedit
      PID:52
    • C:\Windows\SYSTEM32\schtasks.exe
      schtasks.exe /create /tn "Microsoft\Windows\Maintenance\SystemHealthCheck" /tr "C:\Users\Admin\AppData\Local\Temp\0e7ab1904953aca8e89ce357f5bce8e3758aaa5faa546e876a5551ec28dfd2bd.exe" /sc onlogon /rl HIGHEST /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:4408
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /C "C:\Windows\Temp\delete_self_240809531.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2984
      • C:\Windows\system32\timeout.exe
        timeout /t 3 /nobreak
        3⤵
        • Delays execution with timeout.exe
        PID:2960
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3140
  • C:\Users\Admin\AppData\Local\Temp\0e7ab1904953aca8e89ce357f5bce8e3758aaa5faa546e876a5551ec28dfd2bd.exe
    C:\Users\Admin\AppData\Local\Temp\0e7ab1904953aca8e89ce357f5bce8e3758aaa5faa546e876a5551ec28dfd2bd.exe
    1⤵
      PID:4904

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          bqt_log.txt
          • Path C:\Windows\Temp\bqt_log.txt
          • Size 1KB
          • SHA256 f6eb9dc5aae1c81ab2eaa333928e41a970fe4bb61f3b91a5fa9e12850c4a9454
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          bqt_log.txt
          • Path C:\Windows\Temp\bqt_log.txt
          • Size 2KB
          • SHA256 aefb3b6f03c2a434b1c2071c8b39be495f01c1e420b35f9e83944ffb0d31bc47
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          delete_self_240809531.bat
          • Path C:\Windows\Temp\delete_self_240809531.bat
          • Size 211B
          • SHA256 ce3f360a55c76611dad15dbf081aa8489d8c7b8df18d8353dac108baeb81c9f8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/828-13-0x00007FF748130000-0x00007FF748959000-memory.dmp
          Download

          memory/828-69-0x00007FF748130000-0x00007FF748959000-memory.dmp
          Download

          memory/828-78-0x00007FF748130000-0x00007FF748959000-memory.dmp
          Download

          memory/4904-64-0x00007FF748130000-0x00007FF748959000-memory.dmp
          Download