defendnot | 86b6b1be6bac42da6c1b74bf514876b849671a7fa82ab0c8251735c43d813644

General

Target
Unconfirmed 190078.crdownload
Size 4.3MB
Sample260623-mcqq9scs2z
SHA256 86b6b1be6bac42da6c1b74bf514876b849671a7fa82ab0c8251735c43d813644
MD5 77c6b9d2a2db97e1a5fcd5c4fae7df9f
SHA1 7af97baf4a6ebc86e8e9d817b7ac507e96122e04
SHA512 ea059f1bc8c6b2260249eccbabf01d028623abe18446ad833ded002d9f8db1965d9586781452edc59d5d66f59bf17a62f6482a935faf177a3f0e550026aef134
SSDEEP 98304:/iiNgScVIxpLfNuSZTKA0t9FFPEiEXZNnAKSb7L3w0i:/XWV+p9bk9fciEZNnCLA
TLSH
T13526D0303AEA4019F1B7AFB5DBD475DA9A6EF2233706955E148203870F23A41EDC713A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Unconfirmed 190078.crdownload
- Size 4.3MB
- SHA256 86b6b1be6bac42da6c1b74bf514876b849671a7fa82ab0c8251735c43d813644
- MD5 77c6b9d2a2db97e1a5fcd5c4fae7df9f
- SHA1 7af97baf4a6ebc86e8e9d817b7ac507e96122e04
- SHA512 ea059f1bc8c6b2260249eccbabf01d028623abe18446ad833ded002d9f8db1965d9586781452edc59d5d66f59bf17a62f6482a935faf177a3f0e550026aef134
- SSDEEP 98304:/iiNgScVIxpLfNuSZTKA0t9FFPEiEXZNnAKSb7L3w0i:/XWV+p9bk9fciEZNnCLA
- TLSH
  T13526D0303AEA4019F1B7AFB5DBD475DA9A6EF2233706955E148203870F23A41EDC713A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit defense_evasion discovery execution defendnot hacktool persistence
- Detects Defendnot
- Family: Defendnot
  Defendnot is a tool designed to disable Microsoft Defender.
  hacktool defendnot
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2