Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
23/05/2026, 12:33
General
- Target Client-built.exe
- Size 3.0MB
- Sample260523-prb8jacv61
- SHA256 7c31bb2aca2609330bf22897b1bce0ccab7e41d9596ffa5abff419ac2cad3c37
Malware Config
Signatures
- Family: Defendnot
Defendnot is a tool designed to disable Microsoft Defender.
- Detects Defendnot 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 3 IoCs
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Checks for VirtualBox DLLs, possible anti-VM trick
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -c Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\tssaqvwf.5kk2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Security Health Service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\system32\Windows Security Health Service.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\system32\Windows Security Health Service.exe"C:\Users\Admin\AppData\Roaming\system32\Windows Security Health Service.exe"2⤵
- Executes dropped EXE
- Checks for VirtualBox DLLs, possible anti-VM trick
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -c Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\gmacr32f.pn33⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Security Health Service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\system32\Windows Security Health Service.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -c Add-MpPreference -ExclusionProcess defendnot-loader.exe3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\gmacr32f.pn3\defendnot-loader.exe"C:\Users\Admin\AppData\Local\Temp\gmacr32f.pn3\defendnot-loader.exe" --silent --name "Windows Security"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c pause4⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -c Add-MpPreference -ExclusionProcess defendnot-loader.exe2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\tssaqvwf.5kk\defendnot-loader.exe"C:\Users\Admin\AppData\Local\Temp\tssaqvwf.5kk\defendnot-loader.exe" --silent --name "Windows Security"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c pause3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_ye5imdmb.3ik.ps1
defendnot-loader.exe
Windows Security Health Service.exe
memory/1572-41-0x0000024272250000-0x000002427229A000-memory.dmp
memory/1572-49-0x00000242724C0000-0x000002427250A000-memory.dmp
memory/1572-48-0x0000024272470000-0x00000242724BC000-memory.dmp
memory/1572-50-0x0000024272510000-0x000002427253A000-memory.dmp
memory/1572-46-0x0000024272370000-0x00000242723A4000-memory.dmp
memory/1572-38-0x0000024272210000-0x000002427224A000-memory.dmp
memory/1572-39-0x00000242722A0000-0x00000242722F0000-memory.dmp
memory/1572-42-0x00000242722F0000-0x000002427233E000-memory.dmp
memory/1572-43-0x0000024272340000-0x0000024272366000-memory.dmp
memory/1572-37-0x0000024271260000-0x0000024271272000-memory.dmp
memory/1572-40-0x00000242723B0000-0x0000024272462000-memory.dmp
memory/3440-53-0x000001ABF0D80000-0x000001ABF0D90000-memory.dmp
memory/3440-0-0x000001ABEE5D0000-0x000001ABEE8D6000-memory.dmp
memory/3440-1-0x000001ABF0D80000-0x000001ABF0D90000-memory.dmp
memory/3440-87-0x000001ABF1F30000-0x000001ABF1F42000-memory.dmp
memory/3440-86-0x000001ABF1F00000-0x000001ABF1F0A000-memory.dmp
memory/3440-2-0x000001ABEED10000-0x000001ABEED2E000-memory.dmp
memory/3440-74-0x000001ABF1E90000-0x000001ABF1E91000-memory.dmp
memory/3440-3-0x000001ABF1E90000-0x000001ABF1E91000-memory.dmp
memory/3440-4-0x000001ABF1E90000-0x000001ABF1E91000-memory.dmp
memory/4824-44-0x000001CB7E4A0000-0x000001CB7E4A8000-memory.dmp
memory/4824-7-0x000001CB7D5F0000-0x000001CB7D600000-memory.dmp
memory/4824-8-0x000001CB7E2F0000-0x000001CB7E312000-memory.dmp
memory/4824-6-0x000001CB7D5F0000-0x000001CB7D600000-memory.dmp
memory/4824-45-0x000001CB7E930000-0x000001CB7E936000-memory.dmp
memory/4824-26-0x000001CB7E3C0000-0x000001CB7E473000-memory.dmp
memory/4824-47-0x000001CB7E940000-0x000001CB7E94A000-memory.dmp
memory/4824-25-0x000001CB7E3A0000-0x000001CB7E3BC000-memory.dmp
memory/4824-30-0x000001CB7E950000-0x000001CB7E96A000-memory.dmp
memory/4824-27-0x000001CB7E480000-0x000001CB7E48A000-memory.dmp
memory/4824-28-0x000001CB7E4B0000-0x000001CB7E4CC000-memory.dmp
memory/4824-29-0x000001CB7E490000-0x000001CB7E49A000-memory.dmp