Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Detect Xworm Payload

Ramnit

Ramnit is a versatile family that holds viruses, worms, and Trojans.

Suspicious use of NtCreateProcessExOtherParentProcess

Suspicious use of NtCreateUserProcessOtherParentProcess

UAC bypass

Xworm

Xworm is a remote access trojan written in C#.

Command and Scripting Interpreter: PowerShell

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

Creates new service(s)

Disables Task Manager via registry modification

Drops file in Drivers directory

Stops running service(s)