4a714d98ce40f5f3577c306a66cb4a6b1ff3fd01047c7f4581f8558f0bcdf5fa

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 12:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KMSpico 10.2.0 FINAL + Portable (Office and Windows 10 Activator) [TechTools.NET]/KMSpico Portable/AutoPico.exe
Size 728KB
Sample260703-pjp5esg151
SHA256 4a714d98ce40f5f3577c306a66cb4a6b1ff3fd01047c7f4581f8558f0bcdf5fa
MD5 cfe1c391464c446099a5eb33276f6d57
SHA1 9999bfcded2c953e025eabaa66b4971dab122c24
SHA512 4119a1722202bbc33339747ea02fd35b327890d55bb472cd1e2146ca446d8ba6fddb1e8cf8bbfaeb08aec8ed2a9d5c0fa71b73510d409ffacd3908fa72bb53b4
SSDEEP 6144:PBQ5SFgDZoQ4en4UgkPKPjmHzo9mfXOXD7ID3omUtu1omUt8AVSlf84mN6DDhBLA:PBq7bgkmsWT7I7omT1omoVSlK8bQF
TLSH
T195F49D3427E84517E2FF8B79D1B161255DF4F4532212EF0E68C942ED0A32B819A6EB73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion persistence

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 3 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe	AutoPico.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe\Debugger = "C:\\Windows\\SECOH-QAD.exe"	AutoPico.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe	AutoPico.exe

Executes dropped EXE 1 IoCs

pid	Process
5564	SECOH-QAD.exe

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe	AutoPico.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SECOH-QAD.dll	AutoPico.exe
File created	C:\Windows\SECOH-QAD.exe	AutoPico.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Control Panel\Desktop\PaintDesktopVersion = "0"	AutoPico.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
6008	AutoPico.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	6008	AutoPico.exe
Token: SeDebugPrivilege	6008	AutoPico.exe

C:\Users\Admin\AppData\Local\Temp\KMSpico 10.2.0 FINAL + Portable (Office and Windows 10 Activator) [TechTools.NET]\KMSpico Portable\AutoPico.exe
"C:\Users\Admin\AppData\Local\Temp\KMSpico 10.2.0 FINAL + Portable (Office and Windows 10 Activator) [TechTools.NET]\KMSpico Portable\AutoPico.exe"
1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Indicator Removal: Clear Persistence
- Drops file in Windows directory
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6008

C:\Windows\SECOH-QAD.exe
C:\Windows\SECOH-QAD.exe C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
- Executes dropped EXE
PID:5564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AutoPico.log

Path C:\Users\Admin\AppData\Local\Temp\KMSpico 10.2.0 FINAL + Portable (Office and Windows 10 Activator) [TechTools.NET]\KMSpico Portable\logs\AutoPico.log
Size 4KB
SHA256 532d8ba8dbbe79630e973a8817c3c70fadfe63379d7a94a24cbee020c81d99c3
MD5 76d31102cac4186f4099221eafcfa850
SHA1 2ebf55b6a1360fc41788182304920811998f04cb
SHA512 c956671c4c9ad7e50f5199657678fa658d7d72f373fa3f4399c5bdce7313094cfdd2c9c4096751e339030184e5360e6e6d2edfa409e10368275da864d648c6c7
SSDEEP 96:QhC9bGr4v4IzKTbI5pnO7G/nftNgBxT+t2z9QU:QhC8r4v4HM5OFT+t2zGU
TLSH
T16291B2CFFB35112F36D803516FAB095B1C8D884A4E6854F27C8B1444A3B29926FE8D4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SECOH-QAD.exe

Path C:\Windows\SECOH-QAD.exe
Size 4KB
SHA256 9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f
MD5 38de5b216c33833af710e88f7f64fc98
SHA1 66c72019eafa41bbf3e708cc3824c7c4447bdab6
SHA512 99b9a9d5970eb10a903bde703c638f7dc639eb4894dfd84d8d94ce1326087c09fa415ef5bc0db7fd0248827045de24b78a680f301a59395215e50051056d1490
SSDEEP 48:iluEJs+6z2rItbQLcX5c3RQlH52gdScX5aNBUv4Hvf1T14cMbRuqS:+uES+u2wpXGmdbXUJtmx
TLSH
T16291924EC76C0AD2CC5F41718CAD8A15A798B182056F4F3D1A68CAEE2FCF2627112742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6008-27-0x00007FFB47630000-0x00007FFB47FD4000-memory.dmp

Download

memory/6008-2-0x00007FFB47630000-0x00007FFB47FD4000-memory.dmp

Download

memory/6008-6-0x00007FFB47630000-0x00007FFB47FD4000-memory.dmp

Download

memory/6008-7-0x00007FFB47630000-0x00007FFB47FD4000-memory.dmp

Download

memory/6008-10-0x00007FFB47630000-0x00007FFB47FD4000-memory.dmp

Download

memory/6008-11-0x00007FFB47630000-0x00007FFB47FD4000-memory.dmp

Download

memory/6008-16-0x00007FFB47630000-0x00007FFB47FD4000-memory.dmp

Download

memory/6008-22-0x00007FFB47630000-0x00007FFB47FD4000-memory.dmp

Download

memory/6008-24-0x00007FFB47630000-0x00007FFB47FD4000-memory.dmp

Download

memory/6008-130-0x0000000002BA0000-0x0000000002BE8000-memory.dmp

Download

memory/6008-3-0x00007FFB47630000-0x00007FFB47FD4000-memory.dmp

Download

memory/6008-0-0x00007FFB477BF000-0x00007FFB477C0000-memory.dmp

Download

memory/6008-26-0x00007FFB47630000-0x00007FFB47FD4000-memory.dmp

Download

memory/6008-239-0x00007FFB47630000-0x00007FFB47FD4000-memory.dmp

Download

memory/6008-264-0x00007FFB47630000-0x00007FFB47FD4000-memory.dmp

Download

memory/6008-267-0x00007FFB47630000-0x00007FFB47FD4000-memory.dmp

Download

memory/6008-270-0x00007FFB47630000-0x00007FFB47FD4000-memory.dmp

Download

memory/6008-277-0x00007FFB47630000-0x00007FFB47FD4000-memory.dmp

Download

memory/6008-284-0x00007FFB47630000-0x00007FFB47FD4000-memory.dmp

Download

memory/6008-1-0x0000000000850000-0x000000000090A000-memory.dmp

Download

memory/6008-320-0x0000000002BA0000-0x0000000002BE8000-memory.dmp

Download

memory/6008-321-0x00007FFB47630000-0x00007FFB47FD4000-memory.dmp

Download