defendnot | 38cf534396d6d98c06a6b85e26a1132b32094ef83478692ba33ea004f883c05a

Analysis

user interaction
yes
max time kernel
20s
max time network
21s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
23/05/2026, 12:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Windows Security Health Service.exe
Size 3.0MB
Sample260523-pnlb2acv41
SHA256 38cf534396d6d98c06a6b85e26a1132b32094ef83478692ba33ea004f883c05a
MD5 16d5f64aec5889c7bd64c3578c7f3b8d
SHA1 6d05da489b33f5463b16d775a58ea88e2ef89c15
SHA512 3270c029f2bb92b41270c9fd1317ef89bf43daa8e53c07a179983671981efcdc63e53224c12d5219ce2f7f1ac9a107c44b19a2c0739d80cd04cdcb39e414a2fd
SSDEEP 49152:qyiNgLmnc/N+ZZXZQOLH27YRnirm2NnPlKKSb7L3wip6MaRrDkw:ENgScVIxpLlwZNnAKSb7L3w0Xe
TLSH
T194E5D02039EA401AF1B7AF75DBD0B4DA9A6EF263370AA65D145103464F23B41EDC723E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution defendnot hacktool persistence

Malware Config

Signatures

Family: Defendnot
Defendnot is a tool designed to disable Microsoft Defender.
hacktool defendnot

Detects Defendnot 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000028616-59.dat	family_defendnot

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5728	powershell.exe
4568	powershell.exe
4840	powershell.exe
520	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\Control Panel\International\Geo\Nation	Windows Security Health Service.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\Control Panel\International\Geo\Nation	Windows Security Health Service.exe

Executes dropped EXE 3 IoCs

pid	Process
2496	Windows Security Health Service.exe
1580	defendnot-loader.exe
2804	defendnot-loader.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	Windows Security Health Service.exe
File opened (read-only)	\??\VBoxMiniRdrDN	Windows Security Health Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4732	schtasks.exe
384	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2496	Windows Security Health Service.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4988	Windows Security Health Service.exe
4568	powershell.exe
4568	powershell.exe
2496	Windows Security Health Service.exe
4840	powershell.exe
4840	powershell.exe
520	powershell.exe
520	powershell.exe
5728	powershell.exe
5728	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4988	Windows Security Health Service.exe
Token: SeDebugPrivilege	4568	powershell.exe
Token: SeDebugPrivilege	2496	Windows Security Health Service.exe
Token: SeIncreaseQuotaPrivilege	4568	powershell.exe
Token: SeSecurityPrivilege	4568	powershell.exe
Token: SeTakeOwnershipPrivilege	4568	powershell.exe
Token: SeLoadDriverPrivilege	4568	powershell.exe
Token: SeSystemProfilePrivilege	4568	powershell.exe
Token: SeSystemtimePrivilege	4568	powershell.exe
Token: SeProfSingleProcessPrivilege	4568	powershell.exe
Token: SeIncBasePriorityPrivilege	4568	powershell.exe
Token: SeCreatePagefilePrivilege	4568	powershell.exe
Token: SeBackupPrivilege	4568	powershell.exe
Token: SeRestorePrivilege	4568	powershell.exe
Token: SeShutdownPrivilege	4568	powershell.exe
Token: SeDebugPrivilege	4568	powershell.exe
Token: SeSystemEnvironmentPrivilege	4568	powershell.exe
Token: SeRemoteShutdownPrivilege	4568	powershell.exe
Token: SeUndockPrivilege	4568	powershell.exe
Token: SeManageVolumePrivilege	4568	powershell.exe
Token: 33	4568	powershell.exe
Token: 34	4568	powershell.exe
Token: 35	4568	powershell.exe
Token: 36	4568	powershell.exe
Token: SeDebugPrivilege	4840	powershell.exe
Token: SeDebugPrivilege	520	powershell.exe
Token: SeIncreaseQuotaPrivilege	4840	powershell.exe
Token: SeSecurityPrivilege	4840	powershell.exe
Token: SeTakeOwnershipPrivilege	4840	powershell.exe
Token: SeLoadDriverPrivilege	4840	powershell.exe
Token: SeSystemProfilePrivilege	4840	powershell.exe
Token: SeSystemtimePrivilege	4840	powershell.exe
Token: SeProfSingleProcessPrivilege	4840	powershell.exe
Token: SeIncBasePriorityPrivilege	4840	powershell.exe
Token: SeCreatePagefilePrivilege	4840	powershell.exe
Token: SeBackupPrivilege	4840	powershell.exe
Token: SeRestorePrivilege	4840	powershell.exe
Token: SeShutdownPrivilege	4840	powershell.exe
Token: SeDebugPrivilege	4840	powershell.exe
Token: SeSystemEnvironmentPrivilege	4840	powershell.exe
Token: SeRemoteShutdownPrivilege	4840	powershell.exe
Token: SeUndockPrivilege	4840	powershell.exe
Token: SeManageVolumePrivilege	4840	powershell.exe
Token: 33	4840	powershell.exe
Token: 34	4840	powershell.exe
Token: 35	4840	powershell.exe
Token: 36	4840	powershell.exe
Token: SeIncreaseQuotaPrivilege	520	powershell.exe
Token: SeSecurityPrivilege	520	powershell.exe
Token: SeTakeOwnershipPrivilege	520	powershell.exe
Token: SeLoadDriverPrivilege	520	powershell.exe
Token: SeSystemProfilePrivilege	520	powershell.exe
Token: SeSystemtimePrivilege	520	powershell.exe
Token: SeProfSingleProcessPrivilege	520	powershell.exe
Token: SeIncBasePriorityPrivilege	520	powershell.exe
Token: SeCreatePagefilePrivilege	520	powershell.exe
Token: SeBackupPrivilege	520	powershell.exe
Token: SeRestorePrivilege	520	powershell.exe
Token: SeShutdownPrivilege	520	powershell.exe
Token: SeDebugPrivilege	520	powershell.exe
Token: SeSystemEnvironmentPrivilege	520	powershell.exe
Token: SeRemoteShutdownPrivilege	520	powershell.exe
Token: SeUndockPrivilege	520	powershell.exe
Token: SeManageVolumePrivilege	520	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2496	Windows Security Health Service.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 4568	4988	Windows Security Health Service.exe	84
PID 4988 wrote to memory of 4732	4988	Windows Security Health Service.exe	86
PID 4988 wrote to memory of 2496	4988	Windows Security Health Service.exe	88
PID 4988 wrote to memory of 4840	4988	Windows Security Health Service.exe	91
PID 2496 wrote to memory of 520	2496	Windows Security Health Service.exe	93
PID 2496 wrote to memory of 384	2496	Windows Security Health Service.exe	94
PID 4988 wrote to memory of 1580	4988	Windows Security Health Service.exe	97
PID 2496 wrote to memory of 5728	2496	Windows Security Health Service.exe	99
PID 1580 wrote to memory of 3920	1580	defendnot-loader.exe	101
PID 2496 wrote to memory of 2804	2496	Windows Security Health Service.exe	102
PID 2804 wrote to memory of 5408	2804	defendnot-loader.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Windows Security Health Service.exe
"C:\Users\Admin\AppData\Local\Temp\Windows Security Health Service.exe"
1⤵
- Checks computer location settings
- Checks for VirtualBox DLLs, possible anti-VM trick
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -c Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\cjevhgjn.bbg
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4568
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Windows Security Health Service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\system32\Windows Security Health Service.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4732
- C:\Users\Admin\AppData\Roaming\system32\Windows Security Health Service.exe
  "C:\Users\Admin\AppData\Roaming\system32\Windows Security Health Service.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2496
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -c Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\vrhgax1k.ovu
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:520
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Windows Security Health Service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\system32\Windows Security Health Service.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:384
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -c Add-MpPreference -ExclusionProcess defendnot-loader.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5728
- - C:\Users\Admin\AppData\Local\Temp\vrhgax1k.ovu\defendnot-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\vrhgax1k.ovu\defendnot-loader.exe" --silent --name "Windows Security"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c pause
      4⤵
      PID:5408
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -c Add-MpPreference -ExclusionProcess defendnot-loader.exe
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4840
- C:\Users\Admin\AppData\Local\Temp\cjevhgjn.bbg\defendnot-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\cjevhgjn.bbg\defendnot-loader.exe" --silent --name "Windows Security"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c pause
    3⤵
    PID:3920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485
MD5 3eb3833f769dd890afc295b977eab4b4
SHA1 e857649b037939602c72ad003e5d3698695f436f
SHA512 c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72
TLSH
T13A51EE313375B0D4C95A7F07193819C063BF8386E698AF58B65C521ED92751B9B222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6be068959888462bda3477d6d72b7b7236fa427309f56add55b67c53c9c20dfa
MD5 fdae3b25ab823a391782b3852f4042bb
SHA1 cf0a2765dd07e2334563844c6bc092a07b5c3b9b
SHA512 f2b703a521c490ade29a1b536ac59c0f38b174b0edceb879e6a313c29ebcdadb5fe63231d25622cc04e7ebadc92f9c609266e6d66db129124a53226c7fdb4be2
TLSH
T173219323B3DDC850DC99023A609C9CA076B6D7C780DEDF9B3EC4C212A07FA89CB101A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 998a8c155009a2ce0a68d39747d665d7489fe02dc095796c4afad46957edc60f
MD5 214a202dda1c0251b232c3996b4a7dce
SHA1 9059f740a079e7d2165f5daff69c7be8df48f5f4
SHA512 114518c031f03eb931be55ac30c27d432e4f3beb2a42b519071ce636f6df666c8596f503c95fd548912537768e6a08fa14a4c6dad8c9c187dad605e7661a26b0
TLSH
T1DA215723B3DDC850DC99423A649C9D9075B6D7C780DEDF9B2EC4C216A17FA99CB111A0
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ibwgalrn.fir.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ibwgalrn.fir.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

defendnot-loader.exe

Path C:\Users\Admin\AppData\Local\Temp\cjevhgjn.bbg\defendnot-loader.exe
Size 581KB
SHA256 4776620d4a617ce96d83a3a2ae0999a9dc6ee79bd9dcefe296cd877a62aa2224
MD5 734d301654affee77396b554ccb04e0e
SHA1 7a4129e6a9180d4eb326e0c3a1f138539816cbc6
SHA512 48762065698d08366bc7413f65cc9f9577dc6099ecd8441bc48fb9a16e65d03fa6815b1000839fd4a34a5d11cebbc5a3a0505dc2d085e3e5ca424b6189490184
SSDEEP 12288:wDddddddddoCh8ahw7TLZ0yph0lhSMXliMsBk:wDddddddddoChjhw7CYh0lhSMXlns
TLSH
T18BC49D26B7E940F9D1ABC27889530A16EB737C4643616ACF03E44A675F236E05F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows Security Health Service.exe

Path C:\Users\Admin\AppData\Roaming\system32\Windows Security Health Service.exe
Size 3.0MB
SHA256 38cf534396d6d98c06a6b85e26a1132b32094ef83478692ba33ea004f883c05a
MD5 16d5f64aec5889c7bd64c3578c7f3b8d
SHA1 6d05da489b33f5463b16d775a58ea88e2ef89c15
SHA512 3270c029f2bb92b41270c9fd1317ef89bf43daa8e53c07a179983671981efcdc63e53224c12d5219ce2f7f1ac9a107c44b19a2c0739d80cd04cdcb39e414a2fd
SSDEEP 49152:qyiNgLmnc/N+ZZXZQOLH27YRnirm2NnPlKKSb7L3wip6MaRrDkw:ENgScVIxpLlwZNnAKSb7L3w0Xe
TLSH
T194E5D02039EA401AF1B7AF75DBD0B4DA9A6EF263370AA65D145103464F23B41EDC723E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2496-36-0x000001EC63B20000-0x000001EC63B70000-memory.dmp

Download

memory/2496-41-0x000001EC63BC0000-0x000001EC63BF4000-memory.dmp

Download

memory/2496-38-0x000001EC63AD0000-0x000001EC63B1A000-memory.dmp

Download

memory/2496-42-0x000001EC63CF0000-0x000001EC63D3C000-memory.dmp

Download

memory/2496-43-0x000001EC63D40000-0x000001EC63D8A000-memory.dmp

Download

memory/2496-44-0x000001EC63C00000-0x000001EC63C2A000-memory.dmp

Download

memory/2496-35-0x000001EC63A90000-0x000001EC63ACA000-memory.dmp

Download

memory/2496-34-0x000001EC49EF0000-0x000001EC49F02000-memory.dmp

Download

memory/2496-39-0x000001EC63B70000-0x000001EC63BBE000-memory.dmp

Download

memory/2496-37-0x000001EC63C30000-0x000001EC63CE2000-memory.dmp

Download

memory/2496-40-0x000001EC49EC0000-0x000001EC49EE6000-memory.dmp

Download

memory/4568-7-0x00000191883D0000-0x00000191883F2000-memory.dmp

Download

memory/4568-5-0x00000191A0A30000-0x00000191A0A40000-memory.dmp

Download

memory/4568-14-0x00000191A0A30000-0x00000191A0A40000-memory.dmp

Download

memory/4988-0-0x000001EEE6AF0000-0x000001EEE6DF6000-memory.dmp

Download

memory/4988-3-0x000001EEE8BD0000-0x000001EEE8BD1000-memory.dmp

Download

memory/4988-4-0x000001EEE8BD0000-0x000001EEE8BD1000-memory.dmp

Download

memory/4988-45-0x000001EEE9520000-0x000001EEE9530000-memory.dmp

Download

memory/4988-49-0x000001EEE9340000-0x000001EEE9352000-memory.dmp

Download

memory/4988-48-0x000001EEE9310000-0x000001EEE931A000-memory.dmp

Download

memory/4988-2-0x000001EEE71A0000-0x000001EEE71BE000-memory.dmp

Download

memory/4988-1-0x000001EEE9520000-0x000001EEE9530000-memory.dmp

Download

memory/4988-75-0x000001EEE8BD0000-0x000001EEE8BD1000-memory.dmp

Download