7339a4cc48220a161fcc737ed26e99e5678a4d1faa3f7e2686c46b5a5d234828

Analysis

max time kernel
149s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Portable10.1.7/Auto (Run as Admin).cmd
Size 365B
Sample260724-petxtaga29
SHA256 7339a4cc48220a161fcc737ed26e99e5678a4d1faa3f7e2686c46b5a5d234828
MD5 3d9673422f0cdd485ade60ac1abb2f62
SHA1 04ac748e29caab6416d2460217c3ccade8406f39
SHA512 bdb75dd6e1f4c510f900c74a5446f70a2a8e3e40f0d4d5f21685e100011089976a30be15e17ee19387e8582692d1777bf6fcaa4b0db41ee0908fd57488f013d6
TLSH
T128E0D854C1C1F4062217FA15D612465E2956D4D29208703E7E8573BD2C6F08CAFAD95A
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe\Debugger = "C:\\Windows\\SECOH-QAD.exe"	AutoPico.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe	AutoPico.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe	AutoPico.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe\Debugger = "C:\\Windows\\SECOH-QAD.exe"	AutoPico.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe	AutoPico.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe	AutoPico.exe

Indicator Removal: Clear Persistence 1 TTPs 2 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe	AutoPico.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe	AutoPico.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SECOH-QAD.dll	AutoPico.exe
File created	C:\Windows\SECOH-QAD.exe	AutoPico.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3172	cmd.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	regedit.exe

Runs .reg file with regedit 1 IoCs

pid	Process
1000	regedit.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4284	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4580	AutoPico.exe
3376	AutoPico.exe
3376	AutoPico.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	4580	AutoPico.exe
Token: SeDebugPrivilege	4580	AutoPico.exe
Token: SeSystemtimePrivilege	3376	AutoPico.exe
Token: SeDebugPrivilege	3376	AutoPico.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3172 wrote to memory of 1000	3172	cmd.exe	90
PID 3172 wrote to memory of 4580	3172	cmd.exe	91
PID 3172 wrote to memory of 4284	3172	cmd.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Portable10.1.7\Auto (Run as Admin).cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Windows\regedit.exe
  regedit /S DisableSmartScreen.reg
  2⤵
  - Modifies Internet Explorer Phishing Filter
  - Runs .reg file with regedit
  PID:1000
- C:\Users\Admin\AppData\Local\Temp\Portable10.1.7\AutoPico.exe
  AutoPico.exe
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  - Indicator Removal: Clear Persistence
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4580
- C:\Windows\system32\schtasks.exe
  SCHTASKS /Create /TN "AutoPico Daily Restart" /TR "C:\Users\Admin\AppData\Local\Temp\Portable10.1.7\AutoPico.exe /silent" /SC DAILY /ST 23:59:59 /RU SYSTEM /RL Highest /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4284

C:\Users\Admin\AppData\Local\Temp\Portable10.1.7\AutoPico.exe
C:\Users\Admin\AppData\Local\Temp\Portable10.1.7\AutoPico.exe
1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Indicator Removal: Clear Persistence
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AutoPico.log

Path C:\Users\Admin\AppData\Local\Temp\Portable10.1.7\logs\AutoPico.log
Size 4KB
SHA256 10d673836c47bfb6fb2f5affa9c66d28ecb97c82db16e6ce98799849593b0f75
MD5 d06f6ae50f9b147b9fb03404a306e618
SHA1 f798db1fb8fc8f5300f61ec60d7d5fdf546a8625
SHA512 ecf555f2c2f1d7e8e34a6cc6821c355ff4d0476d66f4252780dec224187d45fc8e8b94c9855178e76751de90a986b04ce6a232b8c679f51c2957a2ab5d313de0
SSDEEP 96:GQojAJYtOzS5vIbI5WnOk//9ZCv6Rj0XU:7o0JIkMgO8
TLSH
T1F391F7CF7B36012F369803517FEB3D5A5C8E88094B6854F2758B540C636259A96FCD4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoPico.log

Path C:\Users\Admin\AppData\Local\Temp\Portable10.1.7\logs\AutoPico.log
Size 13KB
SHA256 9304d800d6fbdfce47f0ab9a9f8edf89d844bae1ef55bbf1cc4e5865ed799ca3
MD5 52f94a93db5a4617bbb2276068c85101
SHA1 4a629b162cff91d8982b97b6c2fb63c2165a92d7
SHA512 fa6295aefe4316269a747960343fd7f8f6c2b4c260a56f868ba99a851f87056b2b3ddecb41efa7ef4e14d92a012f8fde3a105882edecdca7fab7ea9260131e30
SSDEEP 96:GQojAJYtOzS5vIbI5WnOk//9ZCv6Rj0XFnzy+LZEsDKWuo80moZiXxe6AiDM2rOl:7o0JIkMgOX+WySiAZGl458ucbAn
TLSH
T13552CFCF7B35412F37D803426FBF399B5D8EC50946A89AF3658B590CA3621A255ECC0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoPico.log

Path C:\Users\Admin\AppData\Local\Temp\Portable10.1.7\logs\AutoPico.log
Size 4KB
SHA256 5ab338559f2746c069d73c0474fba65440c89c88e16500f2ce619aafd951c84e
MD5 5c95cd1b474f2542dcb6a2e48f7f832b
SHA1 71b826abc4f39307712db12904d45b23760f5098
SHA512 54aa33f6e6e17201ba949bbc12a41bbea5be6027aab3835f55a5121aa5dd353853a09fb951efc5822d22461f3a6760eb31535d6f7cca35239030dcdf0a4e1d63
SSDEEP 48:tpNQis/POwwchOb0i1yz9d2yvG/pbI6CpnOYm/6hrzAKbcraaUfA:1QuwjObIz9dQpbI5pnOYm/qJA
TLSH
T13D91B5CF7B35C12F369903416FBF099B5F8ECB19466866F2748B9708A36119352D8C4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SECOH-QAD.dll

Path C:\Windows\SECOH-QAD.dll
Size 3KB
SHA256 0398221231cff97e1fdc03d357ac4610afb8f3cdde4c90a9ec4d7823b405699e
MD5 6d7fdbf9ceac51a76750fd38cf801f30
SHA1 6ef8310627537b1d24409574bc3c398cd97c474c
SHA512 b48d7eb268f8b46ff6a4782070bf6f2109ccc43166b8c64beb73348533b98f69aab5630386f4b5966b6e706f906b599fec5ff885d3e4572ed24acb6c6691fec8
TLSH
T14471753A2B2009F6D4D6A77A51530F06F1ED712441524E6D0BA394661BE7FD23E35B03
MD5 SHA1 SHA512 TLSH

Submit Download

SECOH-QAD.exe

Path C:\Windows\SECOH-QAD.exe
Size 4KB
SHA256 9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f
MD5 38de5b216c33833af710e88f7f64fc98
SHA1 66c72019eafa41bbf3e708cc3824c7c4447bdab6
SHA512 99b9a9d5970eb10a903bde703c638f7dc639eb4894dfd84d8d94ce1326087c09fa415ef5bc0db7fd0248827045de24b78a680f301a59395215e50051056d1490
SSDEEP 48:iluEJs+6z2rItbQLcX5c3RQlH52gdScX5aNBUv4Hvf1T14cMbRuqS:+uES+u2wpXGmdbXUJtmx
TLSH
T16291924EC76C0AD2CC5F41718CAD8A15A798B182056F4F3D1A68CAEE2FCF2627112742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4580-31-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp

Download

memory/4580-7-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp

Download

memory/4580-20-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp

Download

memory/4580-22-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp

Download

memory/4580-23-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp

Download

memory/4580-28-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp

Download

memory/4580-30-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp

Download

memory/4580-0-0x00007FFA5146F000-0x00007FFA51470000-memory.dmp

Download

memory/4580-34-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp

Download

memory/4580-10-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp

Download

memory/4580-247-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp

Download

memory/4580-265-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp

Download

memory/4580-273-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp

Download

memory/4580-274-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp

Download

memory/4580-284-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp

Download

memory/4580-311-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp

Download

memory/4580-6-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp

Download

memory/4580-3-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp

Download

memory/4580-2-0x00007FFA512E0000-0x00007FFA51C84000-memory.dmp

Download

memory/4580-1-0x0000000000C40000-0x0000000000CFA000-memory.dmp

Download