tt[.]vbs | Triage™

General

Target
tt.vbs
Size 52KB
Sample260504-scz8laet21
SHA256 169ee702cb99523ee2aa39476a7eb4226bcf925e37f2cc2435e55f8f23a321fc
MD5 dd7d4488d339bcc5cfc26771f7785c25
SHA1 a5519325d032671248efad837191a6f3fa5944a4
SHA512 5c0cd440c436ebe4b7e755270fedc9b9222e782581d9f5565c1c2cba6ce2035d665e0ee0f4f2d0d2e912a7f3eadbeb0773d027b73fcda55cd960603115e6613b
SSDEEP 768:L5/4+mj/o7Imy68AnnVxI6KXdYP1jESErQSi3r0exFGkx/Z884p3V:L5/4/kU68KUrcYex0V
TLSH
T1253362263D564D7AC111B9E0A4EB5A01A3A5B38B2C427FD0F3E93044F657B098B35EDE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
sample	disable_win_def

SHA256 169ee702cb99523ee2aa39476a7eb4226bcf925e37f2cc2435e55f8f23a321fc
MD5 dd7d4488d339bcc5cfc26771f7785c25
SHA1 a5519325d032671248efad837191a6f3fa5944a4
SHA512 5c0cd440c436ebe4b7e755270fedc9b9222e782581d9f5565c1c2cba6ce2035d665e0ee0f4f2d0d2e912a7f3eadbeb0773d027b73fcda55cd960603115e6613b
SSDEEP 768:L5/4+mj/o7Imy68AnnVxI6KXdYP1jESErQSi3r0exFGkx/Z884p3V:L5/4/kU68KUrcYex0V
TLSH
T1253362263D564D7AC111B9E0A4EB5A01A3A5B38B2C427FD0F3E93044F657B098B35EDE
MD5 SHA1 SHA512 SSDEEP TLSH

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.