8fbacedb88c87c8e7f6b51c14190c1a83bf92ffa19d0a15042128309087bbbc0

Analysis

user interaction
yes
max time kernel
53s
max time network
111s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 23:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BQTLock_Payload_20260811_023428.exe
Size 8.7MB
Sample260810-3p2bja1fjd
SHA256 8fbacedb88c87c8e7f6b51c14190c1a83bf92ffa19d0a15042128309087bbbc0
MD5 be1042780f58defe9ecf539b5481fd35
SHA1 69d136f41dbd3b456a8a632ff2bc4264f67f210f
SHA512 a647398475fde6b5f88fa45918d2d14a6b395cdcaa33f55949e8f433369a93c894178450be234ecad8150e62e1a35718168d61a384354aa28f8cb619ec322028
SSDEEP 196608:9JFdBklM9otdQMKRoUKPoVHLzD30cipF1ca:9pBk48dQMKRoUKPgHLzD30cipF1ca
TLSH
T1C2963937F16710D8C56BC170C256B7B2BD31B8A40874BE6AEE50DAB12E21E505E7EF24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence privilege_escalation ransomware spyware stealer

Malware Config

Signatures

Renames multiple (953) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\BQTLock_2906 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\BQTLock_Payload_20260811_023428.exe"	BQTLock_Payload_20260811_023428.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\BQTLock_5921 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\BQTLock_Payload_20260811_023428.exe"	BQTLock_Payload_20260811_023428.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	icanhazip.com

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Temp\\bqt_wallpaper.bmp"	BQTLock_Payload_20260811_023428.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Temp\\bqt_wallpaper.bmp"	BQTLock_Payload_20260811_023428.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\lt_get.svg.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_120.jpg.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files\7-Zip\Lang\kab.txt.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\SmallLogoCanary.png.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\R	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-200.png.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\Words.pdf.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\it-it\R	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\R	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\icudtl.dat.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\HardwareJumpListLogo.png.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\R	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ko_135x40.svg.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WindowsSecurityWideTile.scale-400_contrast-white.png.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WindowsSecurityAppList.targetsize-96_altform-unplated_contrast-white.png.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filter-focus_32.svg.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_retina_thumb_highContrast_bow.png.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\WindowsSecurityAppList.targetsize-48_altform-lightunplated.png.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files\7-Zip\Lang\uz.txt.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\R	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files\Java\jdk-1.8\jre\R	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\VisualElements\SmallLogoDev.png.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\s_thumbnailview_18.svg.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\PrivacySandboxAttestationsPreloaded\privacy-sandbox-attestations.dat.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\WindowsSecurityMedTile.scale-125.png.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files\Windows NT\TableTextService\TableTextServiceYi.txt.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\R	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\aic_file_icons_retina_thumb.png.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\tool-search-2x.png.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ms_get.svg.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files\7-Zip\Lang\nb.txt.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_folder-focus_32.svg.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filter-disabled_32.svg.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\s_filetype_xd.svg.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themeless\close.svg.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files\7-Zip\Lang\en.ttt.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\selection-actions2x.png.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\s_close_h2x.png.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-cn\PlayStore_icon.svg.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\R	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files\Java\jdk-1.8\jre\README.txt.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\speaker-32.png.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WindowsSecurityMedTile.scale-150_contrast-black.png.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\cross.png.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\R	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\GameBarWidgetUI\Icons\icon.targetsize-44.png.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\S_IlluEmptyStateCCFiles_280x192.svg.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\tr-tr\R	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files\7-Zip\Lang\ky.txt.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Accessibility.dll.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrome.7z.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_gloss-wave_35_f6a828_500x100.png.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.8_8.2310.30001.0_x64__8wekyb3d8bbwe\logo.png.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filter-hover_32.svg.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\selection-actions.png.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\aic_file_icons_retina_thumb_new.png.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files\7-Zip\Lang\ug.txt.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\ccloud.png.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\back-arrow-default.svg.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\vi_get.svg.tmp	BQTLock_Payload_20260811_023428.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\R	BQTLock_Payload_20260811_023428.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4676	cmd.exe
1520	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4676	cmd.exe
2168	netsh.exe
1520	cmd.exe
3056	netsh.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\.bqtlo	BQTLock_Payload_20260811_023428.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\.bqtlo\ = "BQTLock.File.bqtlo"	BQTLock_Payload_20260811_023428.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\BQTLock.File.bqtlo\DefaultIcon	BQTLock_Payload_20260811_023428.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\BQTLock.File.bqtlo	BQTLock_Payload_20260811_023428.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\.bqtlo\ = "BQTLock.File.bqtlo"	BQTLock_Payload_20260811_023428.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\BQTLock.File.bqtlo\DefaultIcon	BQTLock_Payload_20260811_023428.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\BQTLock.File.bqtlo\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\BQTLock_Payload_20260811_023428.exe,0"	BQTLock_Payload_20260811_023428.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\.bqtlo	BQTLock_Payload_20260811_023428.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\BQTLock.File.bqtlo\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\BQTLock_Payload_20260811_023428.exe,0"	BQTLock_Payload_20260811_023428.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4460	BQTLock_Payload_20260811_023428.exe
5592	BQTLock_Payload_20260811_023428.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4460	BQTLock_Payload_20260811_023428.exe
4460	BQTLock_Payload_20260811_023428.exe
4460	BQTLock_Payload_20260811_023428.exe
4460	BQTLock_Payload_20260811_023428.exe
5592	BQTLock_Payload_20260811_023428.exe
5592	BQTLock_Payload_20260811_023428.exe
5592	BQTLock_Payload_20260811_023428.exe
5592	BQTLock_Payload_20260811_023428.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4460	BQTLock_Payload_20260811_023428.exe
5592	BQTLock_Payload_20260811_023428.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 4676	4460	BQTLock_Payload_20260811_023428.exe	90
PID 4676 wrote to memory of 2168	4676	cmd.exe	92
PID 5592 wrote to memory of 1520	5592	BQTLock_Payload_20260811_023428.exe	97
PID 1520 wrote to memory of 3056	1520	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\BQTLock_Payload_20260811_023428.exe
"C:\Users\Admin\AppData\Local\Temp\BQTLock_Payload_20260811_023428.exe"
1⤵
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh wlan show profiles 2>&1
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:4676
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2168

C:\Users\Admin\AppData\Local\Temp\BQTLock_Payload_20260811_023428.exe
C:\Users\Admin\AppData\Local\Temp\BQTLock_Payload_20260811_023428.exe
1⤵
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh wlan show profiles 2>&1
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

chrome.7z.tmp

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrome.7z.tmp
Size 408.1MB
SHA256 325eb736cbce46d0e0e1eb399ed571cc354d8eed2ef4bbb6e19e66f04c8e2240
MD5 71f28af3a19767acbe500a0dd79d6def
SHA1 20455de68e6c9823883fa955b5702d2e786a5e71
SHA512 1b8ba5a9f622426a5e82048e79647351bf6b3f3016647cdb96622c35f045b00a3a523c466ec1a8f2e1f515762c3620d162bf6dc9ed4510bc606e24e91f7bb797
SSDEEP 12582912:KK7T/5uX8AuoCg8RXNjWE+2PViBw+091x1:77ThusAV8zjWvUFD1z
TLSH
T1B71933498A939B5AC867DBF3CC619FF76DD2974D3492CE825B0424D08BB423EC84AD1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Program Files\dotnet\R
Size 307B
SHA256 8aa86d607537ad2ecdbb57704754d1be46d11cbd686fb97683a91165d9714907
MD5 69cd8e0ef76427137376f525fbad9453
SHA1 9578c001c067fab8ec41ece96dda1457cc71bb38
SHA512 7d6398e16fcda78aaca11b8d45919e62df2edc9c32afc8181bd6ba3accfe7e6a75102cd789f91563488ab62ab1adfc59829b87f273c23a34a3994179c185aaf0
TLSH
T130E07D1FF9BDD0630BF535D0389EE03DC31CE10C679941567831870855B7239A2808F5
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 e87bb0106931fc2b00695494e0208f870802313b0ba505f3e62344f209602861
MD5 71f93a25cacdd56e54ab150cb3be33da
SHA1 728e681bc5b9e70b1da8a8cc344279fda03ed805
SHA512 9db6535035ee864ed25b3ebe09d053f8ed31a092579f77e4e94eba89aba9938025e688f994f9e5a7d727af33b1d822529ed6f84c24a5849d17eaf01fc47605fe
TLSH
T13D41A7D95A1C3475BF45CE841E78CF332D3CF5909840545A74FB88B23896BE16D06C5C
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 36888dd390adfc1b3e610cc2b126e496d9dad1ada8c77a0b5ac8ed1a383c59d2
MD5 a2bd5c475a37bb20e13031f39e89b1a9
SHA1 0939ddfb7f3bfb7e09dc1845a7a1cfe5299eda52
SHA512 e46e33845cc4915845c14ba38133429a089d250f6c24c1727688b3ab55163ae52ca36633635c0b20989616edb1e88ef602af884da5235af477ab467fc8d52a2f
TLSH
T18441F8EB1F1A7564BE02DF8A6DB8C5352E38E8BA428008957673C8D711AF7905D0794C
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 5c8056d2eea69344ba3f8579c4cfb864b6b8949c749077229e09d54e15a43bf9
MD5 c0bed0175d52e61fbc661240cd950a13
SHA1 b019a41df793c97c0135de4b31deb66fba8b5a2a
SHA512 25ff60ba85278b70e8aface91fdfa42023e55dc352daadd5282f1741494d7eca433552e8a34d99d38f248aa0f74c96d42c96f853e0774dbace415314d0520135
TLSH
T170F068223DFF603BF537997487CF61B24865F225340257B915B6532C6E16F112C51609
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 13cc8ad87ccf5f168f3bb3e58ef6cebb0198e992d32a2aea45a57f73ed1491e4
MD5 98f94478ed6f53cc6e1b4d9235bfe1bb
SHA1 acbe54e2e106b8cc1cfbb56e5263ce91a9999d09
SHA512 a8f49a55eea35873caa03b49b7872f2673fc037f2d49bf880496d7573ccf05bc9db141730b61c0b8f99e62e03d6c5f614ca1317097b052d6a09e575ff44cdddc
TLSH
T16CF0AB7A25E7016DF132D5BC02C52BD58A33F1327014366D3672120A1D41F00AD6091A
MD5 SHA1 SHA512 TLSH

Submit Download

bqt_passwords.txt

Path C:\Windows\Temp\bqt_passwords.txt
Size 149B
SHA256 9fbd1578be1b263171f410f3a5f204ea77f959e04d3c8f6baa2f6de3928ebb00
MD5 8b36744378b89f673f943484f97ce43f
SHA1 4933a5315652a2653a19a80f6b36a813bd3d1c03
SHA512 05c7a54f65967c0063fb36ed51f5fad3c2c1a500dc4398c1b8266da0cdb15d49b837cf4715d3288d577105c70e0ed3f909db9dd969e1d0c5a52e786744a6f848
TLSH
T167C04CA041195D2867776281176811E0F54E5912848501A8AADF121F6EBF586D51D16A
MD5 SHA1 SHA512 TLSH

Submit Download

bqt_wallpaper.bmp

Path C:\Windows\Temp\bqt_wallpaper.bmp
Size 20B
SHA256 09d59144214919b7cb3385e789408ab2bdb77b291d052a97fb15cbe76e09b6a8
MD5 384df6e666da5ec83e88976a3ad86764
SHA1 3a3b9525e42493e75041283c76a55d30624d7b7e
SHA512 60f2ec8c27c42773ac03658965761347429b599730914efbf31b5f3971ccc4d40c3519c934a4c8d5f418184ec1de0084139b0e0b346af311095b3adcdd371f74
MD5 SHA1 SHA512

Submit Download

memory/4460-2-0x00007FF7916F0000-0x00007FF791FA2000-memory.dmp

Download

memory/4460-308-0x00007FF7916F0000-0x00007FF791FA2000-memory.dmp

Download

memory/4460-2745-0x00007FF7916F0000-0x00007FF791FA2000-memory.dmp

Download

memory/4460-3435-0x00007FF7916F0000-0x00007FF791FA2000-memory.dmp

Download

memory/5592-2909-0x00007FF7916F0000-0x00007FF791FA2000-memory.dmp

Download

memory/5592-4596-0x00007FF7916F0000-0x00007FF791FA2000-memory.dmp

Download

memory/5592-6032-0x00007FF7916F0000-0x00007FF791FA2000-memory.dmp

Download

memory/5592-8120-0x00007FF7916F0000-0x00007FF791FA2000-memory.dmp

Download

memory/5592-11125-0x00007FF7916F0000-0x00007FF791FA2000-memory.dmp

Download

memory/5592-14433-0x00007FF7916F0000-0x00007FF791FA2000-memory.dmp

Download