Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
26/08/2026, 17:06
General
- Target 0a841a35192eb9e68c96bcd0ade27737fde48cfab44f5b7a16dfa91640638a62.exe
- Size 8.9MB
- Sample260826-vmv3qsgp2w
- SHA256 0a841a35192eb9e68c96bcd0ade27737fde48cfab44f5b7a16dfa91640638a62
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Public\README_TO_DECRYPT.txt
-
bqtlock
Ransom Note
- ALL YOUR FILES HAVE BEEN ENCRYPTED BY BQTLOCK! Your entire network has been penetrated, and all data is now encrypted using military-grade AES-256 and RSA-4096 algorithms. Decryption is impossible without our unique private key. ⚠️ Do NOT attempt to recover your files using third-party tools or backups. Any such action will result in the irreversible loss of your data. To begin the recovery process contact ,: $
Signatures
- Family: BQTLock
BQTLock is a cross-platform ransomware that operates under a Ransomware-as-a-Service model.
- Renames multiple (505) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application 2 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Detect suspicious telegram bot 6 IoCs
Detect suspicious telegram bot.
- Drops file in System32 directory 2 IoCs
- Sets desktop wallpaper using registry 2 TTPs 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Program Files directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Domain Trust Discovery 1 TTPs
Attempt gathering information on domain trust relationships.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 14 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Permission Groups Discovery: Domain Groups 1 TTPs
Attempt to find domain-level groups and permission settings.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 14 IoCs
- NTFS ADS 1 IoCs
- Opens file in notepad (likely ransom note) 2 IoCs
- Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
- Suspicious use of AdjustPrivilegeToken 16 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a841a35192eb9e68c96bcd0ade27737fde48cfab44f5b7a16dfa91640638a62.exe"C:\Users\Admin\AppData\Local\Temp\0a841a35192eb9e68c96bcd0ade27737fde48cfab44f5b7a16dfa91640638a62.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Suspicious use of SetThreadContext
- Modifies registry class
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\README_TO_DECRYPT.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://bqtlock.com/2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x338,0x7ffbb00bc188,0x7ffbb00bc194,0x7ffbb00bc1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1744,i,11675014312079024407,11994788246811576560,524288 --field-trial-handle=2548,i,3307319529333463506,148990202643587876,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:33⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,3874826669278382077,12448331462596560747,262144 --field-trial-handle=2548,i,3307319529333463506,148990202643587876,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,11828894156155883259,7008884973926792844,524288 --field-trial-handle=2548,i,3307319529333463506,148990202643587876,262144 --variations-seed-version --mojo-platform-channel-handle=2808 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,17758086563213286102,14120309368816463569,2097152 --field-trial-handle=2548,i,3307319529333463506,148990202643587876,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,14635176967733758857,12767646394356493407,2097152 --field-trial-handle=2548,i,3307319529333463506,148990202643587876,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,5526650626461137832,14067254329100014893,2097152 --field-trial-handle=2548,i,3307319529333463506,148990202643587876,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4164,i,5649949434430441536,8828929908610083958,2097152 --field-trial-handle=2548,i,3307319529333463506,148990202643587876,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,10763869329410235829,13875882514693706751,524288 --field-trial-handle=2548,i,3307319529333463506,148990202643587876,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,1995090573223988152,475992933681724132,524288 --field-trial-handle=2548,i,3307319529333463506,148990202643587876,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5444,i,1684842579178551286,583882015622316000,2097152 --field-trial-handle=2548,i,3307319529333463506,148990202643587876,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,3446020783647287837,1111650734442755552,524288 --field-trial-handle=2548,i,3307319529333463506,148990202643587876,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,16801025476413798424,10378895887488775315,524288 --field-trial-handle=2548,i,3307319529333463506,148990202643587876,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,1250386334248026480,13396004107235094026,524288 --field-trial-handle=2548,i,3307319529333463506,148990202643587876,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,1250386334248026480,13396004107235094026,524288 --field-trial-handle=2548,i,3307319529333463506,148990202643587876,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,5890954877670940106,8815849045436867557,524288 --field-trial-handle=2548,i,3307319529333463506,148990202643587876,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,4420627006345226028,17150165898530569872,524288 --field-trial-handle=2548,i,3307319529333463506,148990202643587876,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4784,i,1612113013407826980,1904620880246041522,524288 --field-trial-handle=2548,i,3307319529333463506,148990202643587876,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,14393804284240406946,13332023480599652034,524288 --field-trial-handle=2548,i,3307319529333463506,148990202643587876,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,13202468105627981482,7159559559870384677,524288 --field-trial-handle=2548,i,3307319529333463506,148990202643587876,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,10038387914019392960,2884262910480612997,524288 --field-trial-handle=2548,i,3307319529333463506,148990202643587876,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,12833923370961563179,7593848964767857554,524288 --field-trial-handle=2548,i,3307319529333463506,148990202643587876,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,12080177735131393696,16081517954020704525,524288 --field-trial-handle=2548,i,3307319529333463506,148990202643587876,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4736,i,4828611404444827462,10128246295345406380,524288 --field-trial-handle=2548,i,3307319529333463506,148990202643587876,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,10181438886595841724,12551460360711310830,524288 --field-trial-handle=2548,i,3307319529333463506,148990202643587876,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6856,i,6554625431670492646,334463821864317894,524288 --field-trial-handle=2548,i,3307319529333463506,148990202643587876,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,15519980442328355059,5958877367241153680,524288 --field-trial-handle=2548,i,3307319529333463506,148990202643587876,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=864,i,14364756673596977177,13211472818753104599,524288 --field-trial-handle=2548,i,3307319529333463506,148990202643587876,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5176,i,17661981146727945978,8656460241862599913,262144 --field-trial-handle=2548,i,3307319529333463506,148990202643587876,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,2985501070701504359,9791378535656387561,524288 --field-trial-handle=2548,i,3307319529333463506,148990202643587876,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:83⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net group "Domain Computers" /domain 2>&12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet group "Domain Computers" /domain3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group "Domain Computers" /domain4⤵
-
-
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{00000000-0000-0000-0000-000000000000}2⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\README_TO_DECRYPT.txt3⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://bqtlock.com/3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wevtutil sl "Microsoft-Windows-PowerShell" /e:false 2>&13⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wevtutil.exewevtutil sl "Microsoft-Windows-PowerShell" /e:false4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net group "Domain Computers" /domain 2>&13⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet group "Domain Computers" /domain4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group "Domain Computers" /domain5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c nltest /dclist: 2>&13⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\nltest.exenltest /dclist:4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wevtutil sl "Microsoft-Windows-Security-Auditing" /e:false 2>&13⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wevtutil.exewevtutil sl "Microsoft-Windows-Security-Auditing" /e:false4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wevtutil sl "Microsoft-Windows-Windows Defender" /e:false 2>&13⤵
- Executes a command shell one-liner
-
C:\Windows\system32\wevtutil.exewevtutil sl "Microsoft-Windows-Windows Defender" /e:false4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "try { (Get-ADComputer -Filter * -Properties DNSHostName | Select-Object -ExpandProperty DNSHostName) -join ',' } catch { (Get-WmiObject Win32_ComputerSystem).Domain }" 2>&13⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "try { (Get-ADComputer -Filter * -Properties DNSHostName | Select-Object -ExpandProperty DNSHostName) -join ',' } catch { (Get-WmiObject Win32_ComputerSystem).Domain }"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wevtutil sl "Microsoft-Windows-Kernel-Process" /e:false 2>&13⤵
- Executes a command shell one-liner
-
C:\Windows\system32\wevtutil.exewevtutil sl "Microsoft-Windows-Kernel-Process" /e:false4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c fltmc detach WdFilter C: 2>&13⤵
- Executes a command shell one-liner
-
C:\Windows\system32\fltMC.exefltmc detach WdFilter C:4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c fltmc detach npsvctrig C: 2>&13⤵
- Executes a command shell one-liner
-
C:\Windows\system32\fltMC.exefltmc detach npsvctrig C:4⤵
-
-
-
C:\Windows\System32\schtasks.exeschtasks /create /tn "SvcHost_Startup_4656" /tr "C:\Windows\System32\dllhost.exe" /sc ONLOGON /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c mountvol S: /S 2>&13⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol S: /S4⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wevtutil sl "Microsoft-Windows-PowerShell" /e:false 2>&12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wevtutil.exewevtutil sl "Microsoft-Windows-PowerShell" /e:false3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wevtutil sl "Microsoft-Windows-Security-Auditing" /e:false 2>&12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wevtutil.exewevtutil sl "Microsoft-Windows-Security-Auditing" /e:false3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c nltest /dclist: 2>&12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\nltest.exenltest /dclist:3⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\BackgroundTaskHost.exe"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider1⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Discovery
Browser Information Discovery
1Domain Trust Discovery
1Peripheral Device Discovery
1Permission Groups Discovery
1Domain Groups
1Query Registry
5System Information Discovery
5System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
nn.txt.tmp
tr.txt.tmp
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
8B2B9A00839EED1DFDCCC3BFC2F5DF12
B46811C17859FFB409CF0E904A4AA8F8
EAD3A783B1286FF481A991FED81C6FE7
8B2B9A00839EED1DFDCCC3BFC2F5DF12
B46811C17859FFB409CF0E904A4AA8F8
EAD3A783B1286FF481A991FED81C6FE7
blocklist
protocols.json
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
the-real-index
the-real-index~RFe590797.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
OperationConfig
OperationConfig~RFe596ecd.TMP
office_endpoints_list.json
Local State
Local State
Local State
Local State
Local State
Local State
Local State
nav_config.json
metadata.json
metadata.json
metadata.json
metadata.json
7ab46859-43a3-45e1-b939-d34ecd0f3076.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
0c11e802-de4d-4bed-9c4b-33b70348cc45.tmp
69222825-2fe2-4c8d-8fa3-6a710128f08f.tmp
__PSScriptPolicyTest_wx5e1u5g.yd2.ps1
content_new.js
b041e3fe-bb07-4fa8-aeb0-35c13586608d.tmp
README_TO_DECRYPT.txt
svc_custom_icon.ico
svc_drv.sys
svc_wallpaper.bmp
memory/2256-1072-0x00007FF7E7290000-0x00007FF7E7B77000-memory.dmp
memory/2256-1376-0x00007FF7E7290000-0x00007FF7E7B77000-memory.dmp
memory/2256-197-0x00007FF7E7290000-0x00007FF7E7B77000-memory.dmp
memory/2256-12-0x00007FF7E7290000-0x00007FF7E7B77000-memory.dmp
memory/2256-24-0x00007FF7E7290000-0x00007FF7E7B77000-memory.dmp
memory/4224-457-0x00007FF7AAE50000-0x00007FF7AB737000-memory.dmp
memory/6024-1351-0x0000025041640000-0x0000025041662000-memory.dmp
memory/6024-1374-0x0000025028740000-0x0000025029201000-memory.dmp
memory/6024-1375-0x0000025041670000-0x00000250417BE000-memory.dmp