b991f07494e570a55efa8f93108a277ff110a38a8e4bc9bd47e894e872063ec1

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Portable10.1.7/RemoveWaterMark.cmd
Size 96B
Sample260724-petxtaga29
SHA256 b991f07494e570a55efa8f93108a277ff110a38a8e4bc9bd47e894e872063ec1
MD5 cacde0b1f51c3861bcbff95cfc2bcfe2
SHA1 e437734197af2a0f1c6e70de4418aa81f88abdbc
SHA512 83bed81f20f5896e9400b19db64cf288a64f91b6b530212f2335b59a7ac1c34c960f393694f18dac14d70d5ad8176d4b48e660348b136a98cd001143300cc3dc
TLSH
T127B01244E2175447125630081139480D380B5086E402681639135334384648CB39C94D
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 3 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe	AutoPico.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe\Debugger = "C:\\Windows\\SECOH-QAD.exe"	AutoPico.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe	AutoPico.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe	AutoPico.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SECOH-QAD.dll	AutoPico.exe
File created	C:\Windows\SECOH-QAD.exe	AutoPico.exe

Launches sc.exe 7 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2988	sc.exe
2592	sc.exe
2364	sc.exe
1100	sc.exe
616	sc.exe
5004	sc.exe
884	sc.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3892	cmd.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	4360	AutoPico.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 4360	3892	cmd.exe	85
PID 4360 wrote to memory of 5004	4360	AutoPico.exe	99
PID 4360 wrote to memory of 884	4360	AutoPico.exe	103
PID 4360 wrote to memory of 2988	4360	AutoPico.exe	105
PID 4360 wrote to memory of 2592	4360	AutoPico.exe	107
PID 4360 wrote to memory of 2364	4360	AutoPico.exe	109
PID 4360 wrote to memory of 1100	4360	AutoPico.exe	111
PID 4360 wrote to memory of 4344	4360	AutoPico.exe	113
PID 4360 wrote to memory of 616	4360	AutoPico.exe	115

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Portable10.1.7\RemoveWaterMark.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Users\Admin\AppData\Local\Temp\Portable10.1.7\AutoPico.exe
  AutoPico.exe /removewatermark
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  - Indicator Removal: Clear Persistence
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4360
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" create "WinDivert1.1" type= kernel DisplayName= "WinDivert1.1" binPath= "C:\Users\Admin\AppData\Local\Temp\Portable10.1.7\WinDivert.sys"
    3⤵
    - Launches sc.exe
    PID:5004
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" create "WinDivert1.1" type= kernel DisplayName= "WinDivert1.1" binPath= "C:\Users\Admin\AppData\Local\Temp\Portable10.1.7\WinDivert.sys"
    3⤵
    - Launches sc.exe
    PID:884
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" create "WinDivert1.1" type= kernel DisplayName= "WinDivert1.1" binPath= "C:\Users\Admin\AppData\Local\Temp\Portable10.1.7\WinDivert.sys"
    3⤵
    - Launches sc.exe
    PID:2988
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" create "WinDivert1.1" type= kernel DisplayName= "WinDivert1.1" binPath= "C:\Users\Admin\AppData\Local\Temp\Portable10.1.7\WinDivert.sys"
    3⤵
    - Launches sc.exe
    PID:2592
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" create "WinDivert1.1" type= kernel DisplayName= "WinDivert1.1" binPath= "C:\Users\Admin\AppData\Local\Temp\Portable10.1.7\WinDivert.sys"
    3⤵
    - Launches sc.exe
    PID:2364
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" create "WinDivert1.1" type= kernel DisplayName= "WinDivert1.1" binPath= "C:\Users\Admin\AppData\Local\Temp\Portable10.1.7\WinDivert.sys"
    3⤵
    - Launches sc.exe
    PID:1100
- - C:\Windows\System32\route.exe
    "C:\Windows\System32\route.exe" delete -4 10.120.72.43 0.0.0.0 IF 1
    3⤵
    PID:4344
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" delete "WinDivert1.1"
    3⤵
    - Launches sc.exe
    PID:616

C:\Users\Admin\AppData\Local\Temp\Portable10.1.7\WinDivert.sys
C:\Users\Admin\AppData\Local\Temp\Portable10.1.7\WinDivert.sys
1⤵
PID:1032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Impair Defenses

T1562

Indicator Removal

T1070

Clear Persistence

T1070.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

AutoPico.log

Path C:\Users\Admin\AppData\Local\Temp\Portable10.1.7\logs\AutoPico.log
Size 4KB
SHA256 4f83919d7808e8e49f7062a0dd96c9b3e2fa16ca54490e99702412df07c55813
MD5 b593f3627f3da240340f2c955ca45ede
SHA1 e0ff2fd21c35d1f7c3cfe73eecea20c82b4e2d25
SHA512 051752740e7b89bb43d08f46aa90c03449a5c662b5e2191615c6577318b67d25646aeb4af6ada3f2ec67b6a55ebb1e8a2a03cf6fa7bf05267812ef35279c10d3
SSDEEP 48:4pNQis4oOBHpchnbxJzaC26EVILCCYDEJ8TUAxFiI:sQqBHCnbTzaCFiILCCp8TUAxFiI
TLSH
T15991D3CF7B36C12F37D4C3126FBB095A1E8E880D47A958F3759B1604A3A15D292DAC4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SECOH-QAD.dll

Path C:\Windows\SECOH-QAD.dll
Size 3KB
SHA256 0398221231cff97e1fdc03d357ac4610afb8f3cdde4c90a9ec4d7823b405699e
MD5 6d7fdbf9ceac51a76750fd38cf801f30
SHA1 6ef8310627537b1d24409574bc3c398cd97c474c
SHA512 b48d7eb268f8b46ff6a4782070bf6f2109ccc43166b8c64beb73348533b98f69aab5630386f4b5966b6e706f906b599fec5ff885d3e4572ed24acb6c6691fec8
TLSH
T14471753A2B2009F6D4D6A77A51530F06F1ED712441524E6D0BA394661BE7FD23E35B03
MD5 SHA1 SHA512 TLSH

Submit Download

SECOH-QAD.exe

Path C:\Windows\SECOH-QAD.exe
Size 4KB
SHA256 9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f
MD5 38de5b216c33833af710e88f7f64fc98
SHA1 66c72019eafa41bbf3e708cc3824c7c4447bdab6
SHA512 99b9a9d5970eb10a903bde703c638f7dc639eb4894dfd84d8d94ce1326087c09fa415ef5bc0db7fd0248827045de24b78a680f301a59395215e50051056d1490
SSDEEP 48:iluEJs+6z2rItbQLcX5c3RQlH52gdScX5aNBUv4Hvf1T14cMbRuqS:+uES+u2wpXGmdbXUJtmx
TLSH
T16291924EC76C0AD2CC5F41718CAD8A15A798B182056F4F3D1A68CAEE2FCF2627112742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1032-417-0x0000000000010000-0x000000000001D000-memory.dmp

Download

memory/4360-44-0x000000001C890000-0x000000001C8A0000-memory.dmp

Download

memory/4360-38-0x000000001C890000-0x000000001C8A0000-memory.dmp

Download

memory/4360-10-0x000000001C890000-0x000000001C8A0000-memory.dmp

Download

memory/4360-12-0x000000001C890000-0x000000001C8A0000-memory.dmp

Download

memory/4360-13-0x00007FFAACB20000-0x00007FFAACC27000-memory.dmp

Download

memory/4360-11-0x000000001C890000-0x000000001C8A0000-memory.dmp

Download

memory/4360-15-0x000000001C890000-0x000000001C8A0000-memory.dmp

Download

memory/4360-16-0x00007FFAACB20000-0x00007FFAACC27000-memory.dmp

Download

memory/4360-24-0x000000001C890000-0x000000001C8A0000-memory.dmp

Download

memory/4360-28-0x000000001C890000-0x000000001C8A0000-memory.dmp

Download

memory/4360-27-0x000000001C890000-0x000000001C8A0000-memory.dmp

Download

memory/4360-26-0x000000001C890000-0x000000001C8A0000-memory.dmp

Download

memory/4360-25-0x00007FFAACB20000-0x00007FFAACC27000-memory.dmp

Download

memory/4360-41-0x000000001C890000-0x000000001C8A0000-memory.dmp

Download

memory/4360-29-0x000000001C890000-0x000000001C8A0000-memory.dmp

Download

memory/4360-42-0x000000001C890000-0x000000001C8A0000-memory.dmp

Download

memory/4360-39-0x000000001C890000-0x000000001C8A0000-memory.dmp

Download

memory/4360-40-0x00007FFAACB20000-0x00007FFAACC27000-memory.dmp

Download

memory/4360-37-0x000000001CA20000-0x000000001CA30000-memory.dmp

Download

memory/4360-36-0x000000001C890000-0x000000001C8A0000-memory.dmp

Download

memory/4360-0-0x0000000000590000-0x000000000064A000-memory.dmp

Download

memory/4360-43-0x000000001C890000-0x000000001C8A0000-memory.dmp

Download

memory/4360-9-0x00007FFAACBC2000-0x00007FFAACBC3000-memory.dmp

Download

memory/4360-45-0x00007FFAACB20000-0x00007FFAACC27000-memory.dmp

Download

memory/4360-30-0x00007FFAACB20000-0x00007FFAACC27000-memory.dmp

Download

memory/4360-48-0x000000001C890000-0x000000001C8A0000-memory.dmp

Download

memory/4360-51-0x00007FFAACB20000-0x00007FFAACC27000-memory.dmp

Download

memory/4360-52-0x00007FFAACB20000-0x00007FFAACC27000-memory.dmp

Download

memory/4360-50-0x000000001C890000-0x000000001C8A0000-memory.dmp

Download

memory/4360-49-0x000000001C890000-0x000000001C8A0000-memory.dmp

Download

memory/4360-47-0x000000001C890000-0x000000001C8A0000-memory.dmp

Download

memory/4360-46-0x000000001C890000-0x000000001C8A0000-memory.dmp

Download

memory/4360-57-0x000000001C890000-0x000000001C8A0000-memory.dmp

Download

memory/4360-59-0x00007FFAACB20000-0x00007FFAACC27000-memory.dmp

Download

memory/4360-60-0x00007FFAACB20000-0x00007FFAACC27000-memory.dmp

Download

memory/4360-58-0x000000001C890000-0x000000001C8A0000-memory.dmp

Download

memory/4360-56-0x000000001C890000-0x000000001C8A0000-memory.dmp

Download

memory/4360-55-0x000000001C890000-0x000000001C8A0000-memory.dmp

Download

memory/4360-64-0x000000001C890000-0x000000001C8A0000-memory.dmp

Download

memory/4360-54-0x000000001C890000-0x000000001C8A0000-memory.dmp

Download

memory/4360-53-0x000000001C890000-0x000000001C8A0000-memory.dmp

Download

memory/4360-7-0x000000001C890000-0x000000001C8A0000-memory.dmp

Download

memory/4360-8-0x000000001C880000-0x000000001C890000-memory.dmp

Download

memory/4360-6-0x000000001C890000-0x000000001C8A0000-memory.dmp

Download

memory/4360-1-0x000000001CA20000-0x000000001CA30000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads