c6603d416dfc48894eda35d9a9a8523bdf9823e215ab926783ce6848aa8a62c4

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Portable10.1.7/AutoPico.exe
Size 722KB
Sample260724-petxtaga29
SHA256 c6603d416dfc48894eda35d9a9a8523bdf9823e215ab926783ce6848aa8a62c4
MD5 ebf9ee1fd3caf93596208a4ef1a5b942
SHA1 c1288579168f0ad44b361cba8ec1e5ac290d617f
SHA512 070ba2b5e5ee7af04d4e4718b1f80baaa4d1870cf1a6d4e87549a5aaa2eacc0b95e1a80e3355a3428f7a282ec3beb1a63180e7c97dcdb1ae11494736866c9b19
SSDEEP 12288:RBYB/73itKurl69bPpSuRxVi9e8iDsQomT1omoVSlK8brD:zGFAUToYlKQrD
TLSH
T13FF48D3423E84517E3FF9B7980B512219DB8F5431216CF4F648642BC1E72B82DA6AB77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 3 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe	AutoPico.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe\Debugger = "C:\\Windows\\SECOH-QAD.exe"	AutoPico.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe	AutoPico.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe	AutoPico.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SECOH-QAD.exe	AutoPico.exe
File created	C:\Windows\SECOH-QAD.dll	AutoPico.exe

Launches sc.exe 7 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4232	sc.exe
4564	sc.exe
4608	sc.exe
1164	sc.exe
1748	sc.exe
4296	sc.exe
3020	sc.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	4892	AutoPico.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 4232	4892	AutoPico.exe	94
PID 4892 wrote to memory of 4564	4892	AutoPico.exe	97
PID 4892 wrote to memory of 4608	4892	AutoPico.exe	100
PID 4892 wrote to memory of 1164	4892	AutoPico.exe	102
PID 4892 wrote to memory of 1748	4892	AutoPico.exe	104
PID 4892 wrote to memory of 4296	4892	AutoPico.exe	106
PID 4892 wrote to memory of 1252	4892	AutoPico.exe	108
PID 4892 wrote to memory of 3020	4892	AutoPico.exe	110

C:\Users\Admin\AppData\Local\Temp\Portable10.1.7\AutoPico.exe
"C:\Users\Admin\AppData\Local\Temp\Portable10.1.7\AutoPico.exe"
1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Indicator Removal: Clear Persistence
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" create "WinDivert1.1" type= kernel DisplayName= "WinDivert1.1" binPath= "C:\Users\Admin\AppData\Local\Temp\Portable10.1.7\WinDivert.sys"
  2⤵
  - Launches sc.exe
  PID:4232
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" create "WinDivert1.1" type= kernel DisplayName= "WinDivert1.1" binPath= "C:\Users\Admin\AppData\Local\Temp\Portable10.1.7\WinDivert.sys"
  2⤵
  - Launches sc.exe
  PID:4564
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" create "WinDivert1.1" type= kernel DisplayName= "WinDivert1.1" binPath= "C:\Users\Admin\AppData\Local\Temp\Portable10.1.7\WinDivert.sys"
  2⤵
  - Launches sc.exe
  PID:4608
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" create "WinDivert1.1" type= kernel DisplayName= "WinDivert1.1" binPath= "C:\Users\Admin\AppData\Local\Temp\Portable10.1.7\WinDivert.sys"
  2⤵
  - Launches sc.exe
  PID:1164
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" create "WinDivert1.1" type= kernel DisplayName= "WinDivert1.1" binPath= "C:\Users\Admin\AppData\Local\Temp\Portable10.1.7\WinDivert.sys"
  2⤵
  - Launches sc.exe
  PID:1748
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" create "WinDivert1.1" type= kernel DisplayName= "WinDivert1.1" binPath= "C:\Users\Admin\AppData\Local\Temp\Portable10.1.7\WinDivert.sys"
  2⤵
  - Launches sc.exe
  PID:4296
- C:\Windows\System32\route.exe
  "C:\Windows\System32\route.exe" delete -4 10.191.82.168 0.0.0.0 IF 1
  2⤵
  PID:1252
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" delete "WinDivert1.1"
  2⤵
  - Launches sc.exe
  PID:3020

C:\Users\Admin\AppData\Local\Temp\Portable10.1.7\WinDivert.sys
C:\Users\Admin\AppData\Local\Temp\Portable10.1.7\WinDivert.sys
1⤵
PID:4708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Impair Defenses

T1562

Indicator Removal

T1070

Clear Persistence

T1070.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

AutoPico.log

Path C:\Users\Admin\AppData\Local\Temp\Portable10.1.7\logs\AutoPico.log
Size 4KB
SHA256 c1ea1fa1477d8e3256907a2fa4d73be6eebb8c08da26f0681075eb865b4aae60
MD5 90df486df9d34d21bc9f98365b7ca5a0
SHA1 d0b1cf8ae7c12521916a42778244beba53e4e1d5
SHA512 301f0a34185fef04a3271b2086aef9372d75278f0224e2756187b6ef86d8da629328f9e443d97efa1764cb4fc8e0c8876aa70e90a463bb28b8e2d52669cc32f0
SSDEEP 96:OQq71U4ckorz0dusBILC0Vm7CNbJdjVFUn+T/d5kYY:D01U4do0uI
TLSH
T1FC91C2CF7B36512F36980352AFAB395A5C8E880847ED55F3798B241CA3A169751ECC0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SECOH-QAD.dll

Path C:\Windows\SECOH-QAD.dll
Size 3KB
SHA256 0398221231cff97e1fdc03d357ac4610afb8f3cdde4c90a9ec4d7823b405699e
MD5 6d7fdbf9ceac51a76750fd38cf801f30
SHA1 6ef8310627537b1d24409574bc3c398cd97c474c
SHA512 b48d7eb268f8b46ff6a4782070bf6f2109ccc43166b8c64beb73348533b98f69aab5630386f4b5966b6e706f906b599fec5ff885d3e4572ed24acb6c6691fec8
TLSH
T14471753A2B2009F6D4D6A77A51530F06F1ED712441524E6D0BA394661BE7FD23E35B03
MD5 SHA1 SHA512 TLSH

Submit Download

SECOH-QAD.exe

Path C:\Windows\SECOH-QAD.exe
Size 4KB
SHA256 9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f
MD5 38de5b216c33833af710e88f7f64fc98
SHA1 66c72019eafa41bbf3e708cc3824c7c4447bdab6
SHA512 99b9a9d5970eb10a903bde703c638f7dc639eb4894dfd84d8d94ce1326087c09fa415ef5bc0db7fd0248827045de24b78a680f301a59395215e50051056d1490
SSDEEP 48:iluEJs+6z2rItbQLcX5c3RQlH52gdScX5aNBUv4Hvf1T14cMbRuqS:+uES+u2wpXGmdbXUJtmx
TLSH
T16291924EC76C0AD2CC5F41718CAD8A15A798B182056F4F3D1A68CAEE2FCF2627112742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4708-409-0x0000000000010000-0x000000000001D000-memory.dmp

Download

memory/4892-40-0x000000001C0B0000-0x000000001C0C0000-memory.dmp

Download

memory/4892-38-0x00007FFCE7CF0000-0x00007FFCE7DF7000-memory.dmp

Download

memory/4892-13-0x00007FFCE7CF0000-0x00007FFCE7DF7000-memory.dmp

Download

memory/4892-10-0x000000001C0B0000-0x000000001C0C0000-memory.dmp

Download

memory/4892-9-0x000000001C0B0000-0x000000001C0C0000-memory.dmp

Download

memory/4892-43-0x000000001C0B0000-0x000000001C0C0000-memory.dmp

Download

memory/4892-14-0x000000001C0B0000-0x000000001C0C0000-memory.dmp

Download

memory/4892-20-0x00007FFCE7CF0000-0x00007FFCE7DF7000-memory.dmp

Download

memory/4892-24-0x000000001C0B0000-0x000000001C0C0000-memory.dmp

Download

memory/4892-25-0x00007FFCE7CF0000-0x00007FFCE7DF7000-memory.dmp

Download

memory/4892-30-0x00007FFCE7CF0000-0x00007FFCE7DF7000-memory.dmp

Download

memory/4892-29-0x000000001C0B0000-0x000000001C0C0000-memory.dmp

Download

memory/4892-28-0x000000001C0B0000-0x000000001C0C0000-memory.dmp

Download

memory/4892-27-0x000000001C0B0000-0x000000001C0C0000-memory.dmp

Download

memory/4892-26-0x000000001C0B0000-0x000000001C0C0000-memory.dmp

Download

memory/4892-37-0x000000001C0B0000-0x000000001C0C0000-memory.dmp

Download

memory/4892-0-0x0000000000F10000-0x0000000000FCA000-memory.dmp

Download

memory/4892-41-0x00007FFCE7CF0000-0x00007FFCE7DF7000-memory.dmp

Download

memory/4892-12-0x00007FFCE7D92000-0x00007FFCE7D93000-memory.dmp

Download

memory/4892-39-0x000000001C0B0000-0x000000001C0C0000-memory.dmp

Download

memory/4892-7-0x000000001C0B0000-0x000000001C0C0000-memory.dmp

Download

memory/4892-42-0x000000001C0B0000-0x000000001C0C0000-memory.dmp

Download

memory/4892-44-0x00007FFCE7CF0000-0x00007FFCE7DF7000-memory.dmp

Download

memory/4892-50-0x000000001C0F0000-0x000000001C100000-memory.dmp

Download

memory/4892-51-0x000000001C0B0000-0x000000001C0C0000-memory.dmp

Download

memory/4892-49-0x000000001C0B0000-0x000000001C0C0000-memory.dmp

Download

memory/4892-54-0x00007FFCE7CF0000-0x00007FFCE7DF7000-memory.dmp

Download

memory/4892-55-0x000000001C0B0000-0x000000001C0C0000-memory.dmp

Download

memory/4892-48-0x000000001C0B0000-0x000000001C0C0000-memory.dmp

Download

memory/4892-47-0x000000001C0B0000-0x000000001C0C0000-memory.dmp

Download

memory/4892-46-0x000000001C0B0000-0x000000001C0C0000-memory.dmp

Download

memory/4892-45-0x000000001C0B0000-0x000000001C0C0000-memory.dmp

Download

memory/4892-11-0x000000001C0B0000-0x000000001C0C0000-memory.dmp

Download

memory/4892-320-0x000000001C6F0000-0x000000001C81D000-memory.dmp

Download

memory/4892-8-0x000000001C0C0000-0x000000001C0D0000-memory.dmp

Download

memory/4892-6-0x000000001C0B0000-0x000000001C0C0000-memory.dmp

Download

memory/4892-1-0x000000001C0F0000-0x000000001C100000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads