faea35878f33fec6e8f1563bf439c0081d127cd82a48a1d3f23e7c13a707773f

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FACEITInstaller_64.exe
Size 140.5MB
Sample261027-e9nzyays8q
SHA256 faea35878f33fec6e8f1563bf439c0081d127cd82a48a1d3f23e7c13a707773f
MD5 6479eb70a4ec9298f5fd52314bec1d0f
SHA1 2fe5b27b18cdca3dd7d756e007afcaa274ad33a3
SHA512 d629dcc6eb48dfb2bb4c876457cb0d1e23f9386373c592628f5481c380e06f5ea511c04d6279b5494e1631a75986796eb0382cc9bc4dd64577bc54c7dc82c0fa
SSDEEP 3145728:FbllLMDEPEkjLH251MR3nBMoPM6CosBbdKXO3LWeEmu2iMnooXQt:t/0EPE0H25yWoP4osBuSqea23ol
TLSH
T195683362B6D7AA6CE6056B3DCC8D8119E730F8C90ED18BDFD7104E79AE4A58187253C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/files/0x000e00000001c50b-21.dat	disable_win_def

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4848	WScript.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsOptions\install.vbs	FACEITInstaller_64.exe
File created	C:\Program Files\WindowsOptions\__tmp_rar_sfx_access_check_240754390	FACEITInstaller_64.exe
File created	C:\Program Files\WindowsOptions\sfx.rar	FACEITInstaller_64.exe
File opened for modification	C:\Program Files\WindowsOptions\sfx.rar	FACEITInstaller_64.exe
File opened for modification	C:\Program Files\WindowsOptions\UnRAR.exe	FACEITInstaller_64.exe
File created	C:\Program Files\WindowsOptions\asd.txt	FACEITInstaller_64.exe
File opened for modification	C:\Program Files\WindowsOptions\asd.txt	FACEITInstaller_64.exe
File opened for modification	C:\Program Files\WindowsOptions	FACEITInstaller_64.exe
File created	C:\Program Files\WindowsOptions\run.ps1	FACEITInstaller_64.exe
File opened for modification	C:\Program Files\WindowsOptions\run.ps1	FACEITInstaller_64.exe
File created	C:\Program Files\WindowsOptions\UnRAR.exe	FACEITInstaller_64.exe
File created	C:\Program Files\WindowsOptions\asdhjsahjfdsafkj.txt	FACEITInstaller_64.exe
File opened for modification	C:\Program Files\WindowsOptions\asdhjsahjfdsafkj.txt	FACEITInstaller_64.exe
File created	C:\Program Files\WindowsOptions\install.vbs	FACEITInstaller_64.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5736	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings	FACEITInstaller_64.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5736	powershell.exe
5736	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5736	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 4848	2496	FACEITInstaller_64.exe	88
PID 4848 wrote to memory of 5736	4848	WScript.exe	89

C:\Users\Admin\AppData\Local\Temp\FACEITInstaller_64.exe
"C:\Users\Admin\AppData\Local\Temp\FACEITInstaller_64.exe"
1⤵
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsOptions\install.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:4848
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "run.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install.vbs

Path C:\Program Files\WindowsOptions\install.vbs
Size 100B
SHA256 b4690bd0984a489ce202a06801bd74a4e96237ff8220fd4c0f10519fa2d3c120
MD5 2369d26c499d2a617f92973b85cceb9e
SHA1 3f20723d6fbbc7a1983523c50e551faddee0aeed
SHA512 0281bffed72df334f8f7af42e284ca6011cf9a9dcc700b2f84589ed335496882af8d998fb42c6bdbf4bab04297335d1826fe5261ef00a38fb5ddd33bbe15b9d1
TLSH
T1C9B01218F904C3EC067BC4EE1575C42C8CA864A9A210875EB37092087248234D365146
MD5 SHA1 SHA512 TLSH

Submit Download

run.ps1

Path C:\Program Files\WindowsOptions\run.ps1
Size 32KB
SHA256 b0a71f0c642ebd4915ef73ca7dda600ab237ecbb01cb910f77e7f942005f4307
MD5 5c1a2c451fceea81a6b90247463e40fe
SHA1 9e700ddc363a9567457f165d86446cf973a100ac
SHA512 b4e259efd8eb21e7a9bc837d1c7d870adc8133df394ee9d3a2b21a2ec58a2f0695966a42d245c674c0bd562aebb583b7967549a60c7915e1a6f6c35f7dd98cf4
SSDEEP 384:dY4n24p9VegPHbrHrT4D3HvpNSdiTe/sJ1QDzSuQWqW44hQps5RMRrjHD51U7K24:Og24X3CUsJV5G8R07K2L6qs
TLSH
T10AE20041A7FA0148F1F76B44EA3F48650B37BD259932CA0D529C198E0BF3A1498A7F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5736-20-0x000002135AA00000-0x000002135AA22000-memory.dmp

Download