Evasion Technique - 1244315488

[Alexandre_Jodoin]

Hi,

We are getting a few alerts for "Evasion Technique - 1244315488" - "Evasion technique using reflective loading."

While investigating I can see that a base64 encoded PE file is written in the registry by taskhosw.exe under "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\UCPD\DR\000"

-The registry key is not super well documented (UserChoices Protect Driver) 

-The PE, when reconstructed from the base64, is signed by an old Microsoft certificate from 2011.

-Looking on VT for this PE, there is only 1 detection, which does not say much because apparently the file was 1st seen by VT on Oct 27 2025...

I also see in VT that this file have various names which makes me think others found about this activity and submitted the PE to VT for analysis:cyberchef.bin, application.bin, decoded_payload.exe, decoded.exe, output.exe, download.dat, download.exe.malz, download_new.exe, reg-pe.exe.malz

Anyone else observed simillar activity?!

[micomi · Accepted solution]

Hi @Alexandre_Jodoin 

Yes we had multiple alerts with the same alert name in the last 2-3 days. I asked TAC and for our case they confirmed a false positive. According to TAC it's a known issue which will be solved within Content Update 2010.

Hope this helps

[Alexandre_Jodoin]

Yup, this help.

Thanks!

[sheriffali]

Hi all.

highky advising to continue your investigation on the matter , TAC don't deal with investigating and no lighten process wod write an exactable file on the registry , PANW has other service what you can use to verify such thing like u42 or managed hunting , not TAC.