7339a4cc48220a161fcc737ed26e99e5678a4d1faa3f7e2686c46b5a5d234828

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Portable10.1.7/Auto (Run as Admin).cmd
Size 365B
Sample260724-petxtaga29
SHA256 7339a4cc48220a161fcc737ed26e99e5678a4d1faa3f7e2686c46b5a5d234828
MD5 3d9673422f0cdd485ade60ac1abb2f62
SHA1 04ac748e29caab6416d2460217c3ccade8406f39
SHA512 bdb75dd6e1f4c510f900c74a5446f70a2a8e3e40f0d4d5f21685e100011089976a30be15e17ee19387e8582692d1777bf6fcaa4b0db41ee0908fd57488f013d6
TLSH
T128E0D854C1C1F4062217FA15D612465E2956D4D29208703E7E8573BD2C6F08CAFAD95A
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 3 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe	AutoPico.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe\Debugger = "C:\\Windows\\SECOH-QAD.exe"	AutoPico.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe	AutoPico.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe	AutoPico.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SECOH-QAD.dll	AutoPico.exe
File created	C:\Windows\SECOH-QAD.exe	AutoPico.exe

Launches sc.exe 7 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1732	sc.exe
2424	sc.exe
4160	sc.exe
3288	sc.exe
4208	sc.exe
4524	sc.exe
3944	sc.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2568	cmd.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	regedit.exe

Runs .reg file with regedit 1 IoCs

pid	Process
2996	regedit.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	5100	AutoPico.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 2996	2568	cmd.exe	86
PID 2568 wrote to memory of 5100	2568	cmd.exe	87
PID 5100 wrote to memory of 4524	5100	AutoPico.exe	100
PID 5100 wrote to memory of 3944	5100	AutoPico.exe	102
PID 5100 wrote to memory of 1732	5100	AutoPico.exe	106
PID 5100 wrote to memory of 2424	5100	AutoPico.exe	108
PID 5100 wrote to memory of 4160	5100	AutoPico.exe	110
PID 5100 wrote to memory of 3288	5100	AutoPico.exe	112
PID 5100 wrote to memory of 2288	5100	AutoPico.exe	114
PID 5100 wrote to memory of 4208	5100	AutoPico.exe	116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Portable10.1.7\Auto (Run as Admin).cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\regedit.exe
  regedit /S DisableSmartScreen.reg
  2⤵
  - Modifies Internet Explorer Phishing Filter
  - Runs .reg file with regedit
  PID:2996
- C:\Users\Admin\AppData\Local\Temp\Portable10.1.7\AutoPico.exe
  AutoPico.exe
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  - Indicator Removal: Clear Persistence
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" create "WinDivert1.1" type= kernel DisplayName= "WinDivert1.1" binPath= "C:\Users\Admin\AppData\Local\Temp\Portable10.1.7\WinDivert.sys"
    3⤵
    - Launches sc.exe
    PID:4524
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" create "WinDivert1.1" type= kernel DisplayName= "WinDivert1.1" binPath= "C:\Users\Admin\AppData\Local\Temp\Portable10.1.7\WinDivert.sys"
    3⤵
    - Launches sc.exe
    PID:3944
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" create "WinDivert1.1" type= kernel DisplayName= "WinDivert1.1" binPath= "C:\Users\Admin\AppData\Local\Temp\Portable10.1.7\WinDivert.sys"
    3⤵
    - Launches sc.exe
    PID:1732
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" create "WinDivert1.1" type= kernel DisplayName= "WinDivert1.1" binPath= "C:\Users\Admin\AppData\Local\Temp\Portable10.1.7\WinDivert.sys"
    3⤵
    - Launches sc.exe
    PID:2424
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" create "WinDivert1.1" type= kernel DisplayName= "WinDivert1.1" binPath= "C:\Users\Admin\AppData\Local\Temp\Portable10.1.7\WinDivert.sys"
    3⤵
    - Launches sc.exe
    PID:4160
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" create "WinDivert1.1" type= kernel DisplayName= "WinDivert1.1" binPath= "C:\Users\Admin\AppData\Local\Temp\Portable10.1.7\WinDivert.sys"
    3⤵
    - Launches sc.exe
    PID:3288
- - C:\Windows\System32\route.exe
    "C:\Windows\System32\route.exe" delete -4 10.128.52.240 0.0.0.0 IF 1
    3⤵
    PID:2288
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" delete "WinDivert1.1"
    3⤵
    - Launches sc.exe
    PID:4208

C:\Users\Admin\AppData\Local\Temp\Portable10.1.7\WinDivert.sys
C:\Users\Admin\AppData\Local\Temp\Portable10.1.7\WinDivert.sys
1⤵
PID:3672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Impair Defenses

T1562

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

AutoPico.log

Path C:\Users\Admin\AppData\Local\Temp\Portable10.1.7\logs\AutoPico.log
Size 4KB
SHA256 2785038150252dbcee1810d1b2ee4898cb5580b1235f26ba16dc14e5c710b774
MD5 5b72ed326b1a2bc6f7d459b24c15ad6b
SHA1 2beaf02219d97ff64a06933699620d7226da70b1
SHA512 d496a88c22fad242c94a388660743dbed93a555eae005921b49e6d8440dc2d39db315a5aed6f5734c60c796a12fedd19ca4ccce89012306b90eb0fe23be64a58
SSDEEP 48:TpNQismaOe+EkchimDJvzZz/Y2pAILCfssH9ryaPe9FtqfX:fQSe+oimDJvzJYUAILCEsJyqePtqfX
TLSH
T17391E6CF7B36022F3AD803526FAB3D6A5C8EC809476854F3759F540CA36269656ECC4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SECOH-QAD.dll

Path C:\Windows\SECOH-QAD.dll
Size 3KB
SHA256 0398221231cff97e1fdc03d357ac4610afb8f3cdde4c90a9ec4d7823b405699e
MD5 6d7fdbf9ceac51a76750fd38cf801f30
SHA1 6ef8310627537b1d24409574bc3c398cd97c474c
SHA512 b48d7eb268f8b46ff6a4782070bf6f2109ccc43166b8c64beb73348533b98f69aab5630386f4b5966b6e706f906b599fec5ff885d3e4572ed24acb6c6691fec8
TLSH
T14471753A2B2009F6D4D6A77A51530F06F1ED712441524E6D0BA394661BE7FD23E35B03
MD5 SHA1 SHA512 TLSH

Submit Download

SECOH-QAD.exe

Path C:\Windows\SECOH-QAD.exe
Size 4KB
SHA256 9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f
MD5 38de5b216c33833af710e88f7f64fc98
SHA1 66c72019eafa41bbf3e708cc3824c7c4447bdab6
SHA512 99b9a9d5970eb10a903bde703c638f7dc639eb4894dfd84d8d94ce1326087c09fa415ef5bc0db7fd0248827045de24b78a680f301a59395215e50051056d1490
SSDEEP 48:iluEJs+6z2rItbQLcX5c3RQlH52gdScX5aNBUv4Hvf1T14cMbRuqS:+uES+u2wpXGmdbXUJtmx
TLSH
T16291924EC76C0AD2CC5F41718CAD8A15A798B182056F4F3D1A68CAEE2FCF2627112742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3672-412-0x0000000000010000-0x000000000001D000-memory.dmp

Download

memory/5100-41-0x00000000030C0000-0x00000000030D0000-memory.dmp

Download

memory/5100-26-0x00000000030C0000-0x00000000030D0000-memory.dmp

Download

memory/5100-10-0x00007FFF78FE2000-0x00007FFF78FE3000-memory.dmp

Download

memory/5100-12-0x00000000030C0000-0x00000000030D0000-memory.dmp

Download

memory/5100-13-0x00007FFF78F40000-0x00007FFF79047000-memory.dmp

Download

memory/5100-11-0x00000000030C0000-0x00000000030D0000-memory.dmp

Download

memory/5100-14-0x00000000030C0000-0x00000000030D0000-memory.dmp

Download

memory/5100-15-0x00007FFF78F40000-0x00007FFF79047000-memory.dmp

Download

memory/5100-24-0x00000000030C0000-0x00000000030D0000-memory.dmp

Download

memory/5100-25-0x00007FFF78F40000-0x00007FFF79047000-memory.dmp

Download

memory/5100-29-0x00007FFF78F40000-0x00007FFF79047000-memory.dmp

Download

memory/5100-30-0x00000000030C0000-0x00000000030D0000-memory.dmp

Download

memory/5100-31-0x00007FFF78F40000-0x00007FFF79047000-memory.dmp

Download

memory/5100-28-0x00000000030C0000-0x00000000030D0000-memory.dmp

Download

memory/5100-40-0x00000000030C0000-0x00000000030D0000-memory.dmp

Download

memory/5100-27-0x00000000030C0000-0x00000000030D0000-memory.dmp

Download

memory/5100-38-0x00000000030C0000-0x00000000030D0000-memory.dmp

Download

memory/5100-39-0x00007FFF78F40000-0x00007FFF79047000-memory.dmp

Download

memory/5100-9-0x00000000030C0000-0x00000000030D0000-memory.dmp

Download

memory/5100-0-0x0000000000D50000-0x0000000000E0A000-memory.dmp

Download

memory/5100-42-0x00007FFF78F40000-0x00007FFF79047000-memory.dmp

Download

memory/5100-46-0x00000000030C0000-0x00000000030D0000-memory.dmp

Download

memory/5100-45-0x00000000030C0000-0x00000000030D0000-memory.dmp

Download

memory/5100-44-0x00000000030C0000-0x00000000030D0000-memory.dmp

Download

memory/5100-43-0x00000000030C0000-0x00000000030D0000-memory.dmp

Download

memory/5100-47-0x00007FFF78F40000-0x00007FFF79047000-memory.dmp

Download

memory/5100-52-0x00000000030C0000-0x00000000030D0000-memory.dmp

Download

memory/5100-54-0x00000000030C0000-0x00000000030D0000-memory.dmp

Download

memory/5100-53-0x00007FFF78F40000-0x00007FFF79047000-memory.dmp

Download

memory/5100-56-0x00007FFF78F40000-0x00007FFF79047000-memory.dmp

Download

memory/5100-51-0x00000000030C0000-0x00000000030D0000-memory.dmp

Download

memory/5100-50-0x00000000030C0000-0x00000000030D0000-memory.dmp

Download

memory/5100-49-0x00000000030C0000-0x00000000030D0000-memory.dmp

Download

memory/5100-48-0x00000000030C0000-0x00000000030D0000-memory.dmp

Download

memory/5100-63-0x0000000001710000-0x0000000001720000-memory.dmp

Download

memory/5100-81-0x00000000030C0000-0x00000000030D0000-memory.dmp

Download

memory/5100-7-0x00000000030C0000-0x00000000030D0000-memory.dmp

Download

memory/5100-8-0x000000001BAB0000-0x000000001BAC0000-memory.dmp

Download

memory/5100-6-0x00000000030C0000-0x00000000030D0000-memory.dmp

Download

memory/5100-1-0x0000000001710000-0x0000000001720000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads