Defender Control.rar
- SHA256 1adba6890ae289b6aefcba3d00bd8d19b265693ccee0e7d9236d7f60324102b3
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Defender Control.rar
Resource
win11-20260911-en
windows11-21h2-x64
21 signatures
900 seconds
General
- Target Defender Control.rar
- Size 233KB
- Sample261015-vbkgvsdc96
- SHA256 1adba6890ae289b6aefcba3d00bd8d19b265693ccee0e7d9236d7f60324102b3
- MD5 f33c0719b824dd66052c9f719c2c492f
- SHA1 a58ace9490a2c2af9785aaf3ac5de11e8722f376
- SHA512 bf2502b52ee4ab8c765d42b370d68db5c2500df75a8ea11aae659b76f7ec72a26ef01653183d6c4ed04c01aa0db93e501149ef2b5e5fb1c4186b4d9945833243
- SSDEEP 6144:jCqtXHTzmN9bOXNIXiRRzgQx4JHv+iIb9zAZd26Ka+i:jHXXAZZSRuQqJHLdH26Kat
- TLSH T15A341245E2BC689CD2496E262D06DBEFF00D94C541E6850ED0A9C432819B1B4ABB73EF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/disable-defender.exe unpack001/enable-defender.exe
File Explorer
-
Defender Control.rar.rar 233KB
-
disable-defender.exe.exe 280KB
-
enable-defender.exe.exe 286KB
disable-defender.exe
- IMPHASH 2f4e0ab481e054a71bee97d564b03eee
- SHA256 897307c0487c3f7376eedf6b3f999559e0aa16855571f30aef4621583f7ff46e
- MD5 0497ba3a1c59ea1962f614e9acc8d57f
- SHA1 1e418cedaddfb827e4d04423aa64aefa0967f0e8
- SHA512 b09364147122589435e0c2e780f49aa16ab1991682ecb6270ca5b052fb4ebbff45cc1761b8a509080c1136c0d2b0eb014cb7ecf5df8de268b56665f9fd62a275
- SSDEEP 6144:lWRbN0Tc76mRE84jtv5Ewsg8jKM74mLvezQjjOQ7:lWRbNkcHQBEPg0KMFGQjN7
- TLSH T165544B25A7E805F9F67BC67CCDA25901EE72BC064B60E9DF039049561E33AD09E3D722
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
54096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
SetEndOfFile
Process32Next
CreateToolhelp32Snapshot
Process32First
GetModuleFileNameA
GlobalFree
GlobalAlloc
LocalFree
GetCurrentProcess
GetExitCodeProcess
CreateProcessW
MoveFileExW
CloseHandle
GetLastError
Sleep
OpenProcess
GetFileAttributesW
WaitForSingleObject
FindClose
TerminateProcess
ExpandEnvironmentStringsW
FindNextFileW
CreateDirectoryW
WriteConsoleW
HeapReAlloc
HeapSize
CreateFileW
GetProcessHeap
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
RtlLookupFunctionEntry
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EncodePointer
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
FreeLibrary
GetModuleHandleExW
GetProcAddress
GetCommandLineA
GetCommandLineW
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapFree
HeapAlloc
GetFileType
VirtualProtect
LoadLibraryExW
CompareStringW
LCMapStringW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetFileAttributesExW
GetFileSizeEx
SetFilePointerEx
ReadFile
ReadConsoleW
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
advapi32
OpenSCManagerA
LookupPrivilegeValueA
CreateProcessWithTokenW
ImpersonateLoggedOnUser
SetThreadToken
StartServiceW
ConvertSidToStringSidW
DuplicateTokenEx
LookupAccountSidW
QueryServiceStatusEx
GetTokenInformation
LookupPrivilegeValueW
AdjustTokenPrivileges
RegDeleteKeyW
SetEntriesInAclW
CreateWellKnownSid
RegCreateKeyExW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
ConvertStringSidToSidW
RegSetValueExW
OpenServiceA
RegOpenKeyExW
ControlService
ChangeServiceConfigA
RegDeleteValueW
CloseServiceHandle
RegCloseKey
RegQueryValueExW
OpenProcessToken
ole32
CoCreateInstance
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CoUninitialize
oleaut32
SysFreeString
SysAllocString
SysStringLen
VariantClear
VariantInit
Name
.text
Size
177KB
Virtual Size
177KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
86KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=165, id=261, version=33145,
count=8, id=259, version=33145,
count=1, id=262, version=33145,
count=10, id=259, version=35721,
count=17, id=260, version=35721,
count=13, id=260, version=33145,
count=52, id=261, version=35721,
count=9, id=257, version=33145,
count=156, id=1, productName=Unmarked objects,
count=6, id=265, version=36246,
count=1, id=255, version=36246,
count=1, id=258, version=36246,
enable-defender.exe
- IMPHASH f452f649ef7b23efb00cde4bad7cd29b
- SHA256 123866f5752a876a562fe8fca3b61846aecf3881477d31aedf735e3357184224
- MD5 863303f5468199f1f5f6dddf3474fb04
- SHA1 9dae787d2df5248f12d70e89f6826bd160f12d2f
- SHA512 46b26a67591751ff71b920acbb3161ba06856ddcb9aeb73c798027fbcaaaaf69ea2cd68889d427ae79ad47e620923996ebdcdf5db128e4ddc85a50d6e8ea9f25
- SSDEEP 6144:Il5Tfpl/BNnW9sOoVckItv3PvmbT91we+:Il9L1fI13yTI
- TLSH T13F545C15E7E550FAF6BBC67DC9A28901EE727C464760DACF036049562E33AD08E3D722
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
58560
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
SetEndOfFile
Process32Next
CreateToolhelp32Snapshot
Process32First
GetModuleFileNameA
GlobalFree
GlobalAlloc
LocalFree
GetCurrentProcess
GetExitCodeProcess
CreateProcessW
MoveFileExW
CloseHandle
DeleteFileW
GetLastError
Sleep
OpenProcess
GetFileAttributesW
WaitForSingleObject
FindClose
TerminateProcess
ExpandEnvironmentStringsW
FindNextFileW
FindFirstFileW
CreateDirectoryW
WriteConsoleW
HeapReAlloc
HeapSize
CreateFileW
GetProcessHeap
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
RtlLookupFunctionEntry
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EncodePointer
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
FreeLibrary
GetModuleHandleExW
GetProcAddress
GetCommandLineA
GetCommandLineW
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapFree
HeapAlloc
GetFileType
VirtualProtect
LoadLibraryExW
CompareStringW
LCMapStringW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetFileAttributesExW
GetFileSizeEx
SetFilePointerEx
ReadFile
ReadConsoleW
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
advapi32
OpenSCManagerA
LookupPrivilegeValueA
CreateProcessWithTokenW
ImpersonateLoggedOnUser
SetThreadToken
StartServiceW
ConvertSidToStringSidW
DuplicateTokenEx
LookupAccountSidW
QueryServiceStatusEx
GetTokenInformation
LookupPrivilegeValueW
AdjustTokenPrivileges
RegDeleteKeyW
SetEntriesInAclW
CreateWellKnownSid
RegCreateKeyExW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
ConvertStringSidToSidW
RegSetValueExW
OpenServiceA
RegOpenKeyExW
StartServiceA
ControlService
ChangeServiceConfigA
RegDeleteValueW
CloseServiceHandle
RegCloseKey
RegQueryValueExW
OpenProcessToken
ole32
CoCreateInstance
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CoUninitialize
oleaut32
SysFreeString
SysAllocString
SysStringLen
VariantClear
VariantInit
Name
.text
Size
184KB
Virtual Size
183KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
86KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=165, id=261, version=33145,
count=8, id=259, version=33145,
count=1, id=262, version=33145,
count=10, id=259, version=35721,
count=17, id=260, version=35721,
count=13, id=260, version=33145,
count=52, id=261, version=35721,
count=9, id=257, version=33145,
count=156, id=1, productName=Unmarked objects,
count=6, id=265, version=36246,
count=1, id=255, version=36246,
count=1, id=258, version=36246,