defendnot | f543c5e66e98cf9dc603c6ad854e4de22e0bd46e1ac78df72f717fd975795d16

General

Target
The Ultimate Windows Utility.7z
Size 2.3MB
Sample260710-dmpghsdw8v
SHA256 f543c5e66e98cf9dc603c6ad854e4de22e0bd46e1ac78df72f717fd975795d16
MD5 4b7bbe144974b130aa48013217804193
SHA1 184f3c5ea5676174a771d26baf51a4c075ef63ed
SHA512 172bb6f94f2bd6312872f9102fb7cccf6f6ae6736ae069fe77004976ed883cbf93ab141392c9ddea1ba2c7c12abb9df5d3fdaaef93fd118c6cfe8299fff0b029
SSDEEP 49152:dZvNsNrtFmZxKGhYnD6Qu5GPpFaSv/qKnbCVXhsssSgAxayl:DlsUTKGunD6f5Gxz9mPshLe
TLSH
T1EFB533638931CC7B6CED116F4A485CD88BA207FC3C35E7569633981205BA1B1F44FEAA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  The Ultimate Windows Utility.exe
- Size 2.6MB
- SHA256 8f14617135a2c49699bf6d07d2a377baef956c8356998f61772f51810ed35b7d
- MD5 3f42e63f6bd055dd666b4a2c77549171
- SHA1 bd40722954550c9374807e6c9a84e17e7a4849f7
- SHA512 18f62e6da7d5470af9ff85084725bde9eecf50544ed773491860193502a7973c4b8edca81ecada496365a0081a6ff1e107c8ad17cc6a56a92291d18eff709062
- SSDEEP 49152:P6xcx0R4nDsBrRLmdjq2Qa1/6ou5UipNfSNJtRhYg7bhss4SFAF4Y:P6I1suhq2r1/635UgKy2P4gbY
- TLSH
  T12FC5021AD7F544F9E0B7A5B8CE428922D7B37C580771D68F0378A8524F633909D2AB63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

execution defendnot hacktool upx defense_evasion discovery installer persistence privilege_escalation ransomware
- Detects Defendnot
- Family: Defendnot
  Defendnot is a tool designed to disable Microsoft Defender.
  hacktool defendnot
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2