Analysis date (UTC): 4 March 2025, 09:32Analysis environment: Windows 10 Pro, build 19045, x64

Ordine.img.exe

MD5:5568FBA0015088163EBBA7D6786528C6

SHA1:3B2A3B58CEC7A28E06FA6BF240D6A806D2F58D47

SHA256:1293C9760CF2D71C53B4F29A9FA3BC94E7FC0D8ACF4CF068C5942FFD8E2A7ED7

Analysis result

Threat level:Malicious activity

Tags:

purecrypterpurelogs

Full analysis:Analysis Ordine.img.exe (MD5: 5568FBA0015088163EBBA7D6786528C6) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

PURECRYPTER has been detected (SURICATA)

InstallUtil.exe (PID: 5204)

SUSPICIOUS

Starts POWERSHELL.EXE for commands execution

Ordine.img.exe (PID: 7152)
InstallUtil.exe (PID: 5204)

Reads security settings of Internet Explorer

Ordine.img.exe (PID: 7152)

Starts process via Powershell

powershell.exe (PID: 1164)

Connects to unusual port

InstallUtil.exe (PID: 5204)

Removes files via Powershell

powershell.exe (PID: 7552)

PowerShell delay command usage (probably sleep evasion)

powershell.exe (PID: 7552)

INFO

Reads the computer name

Ordine.img.exe (PID: 7152)
InstallUtil.exe (PID: 5204)

Disables trace logs

Ordine.img.exe (PID: 7152)

Checks proxy server information

Ordine.img.exe (PID: 7152)

Checks supported languages

Ordine.img.exe (PID: 7152)
InstallUtil.exe (PID: 5204)

Reads the software policy settings

Ordine.img.exe (PID: 7152)

Reads the machine GUID from the registry

Ordine.img.exe (PID: 7152)
InstallUtil.exe (PID: 5204)

Process checks computer location settings

Ordine.img.exe (PID: 7152)

Manual execution by a user

InstallUtil.exe (PID: 5204)

Application launched itself

msedge.exe (PID: 7496)
msedge.exe (PID: 8440)

Script raised an exception (POWERSHELL)

powershell.exe (PID: 7552)

Threats

PID	Process	Class	Message
5204	InstallUtil.exe	A Network Trojan was detected	LOADER [ANY.RUN] PureLogs Download Attempt (LOAD)
7752	msedge.exe	Misc activity	INFO [ANY.RUN] Possible short link service (t .co)
7752	msedge.exe	Misc activity	INFO [ANY.RUN] Possible short link service (t .co)