Who Me Too'd this topic

Hi,

We are getting a few alerts for "Evasion Technique - 1244315488" - "Evasion technique using reflective loading."

While investigating I can see that a base64 encoded PE file is written in the registry by taskhosw.exe under "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\UCPD\DR\000"

-The registry key is not super well documented (UserChoices Protect Driver) 

-The PE, when reconstructed from the base64, is signed by an old Microsoft certificate from 2011.

-Looking on VT for this PE, there is only 1 detection, which does not say much because apparently the file was 1st seen by VT on Oct 27 2025...

I also see in VT that this file have various names which makes me think others found about this activity and submitted the PE to VT for analysis:cyberchef.bin, application.bin, decoded_payload.exe, decoded.exe, output.exe, download.dat, download.exe.malz, download_new.exe, reg-pe.exe.malz

Anyone else observed simillar activity?!