Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3Saturn.zip
windows10-2004-x64
1wwwroot/_c...pp.css
windows10-2004-x64
7wwwroot/_c...in.css
windows10-2004-x64
7wwwroot/_c...ss.map
windows10-2004-x64
3wwwroot/_c...ICENSE
windows10-2004-x64
1wwwroot/_c...ICENSE
windows10-2004-x64
1wwwroot/_c...DME.md
windows10-2004-x64
3wwwroot/_c...in.css
windows10-2004-x64
7wwwroot/_c...ic.eot
windows10-2004-x64
3wwwroot/_c...ic.otf
windows10-2004-x64
7wwwroot/_c...ic.xml
windows10-2004-x64
1wwwroot/_c...ic.ttf
windows10-2004-x64
7wwwroot/_c...c.woff
windows10-2004-x64
3wwwroot/_c...pp.css
windows10-2004-x64
7wwwroot/_c...se.css
windows10-2004-x64
7wwwroot/_c...er.css
windows10-2004-x64
7wwwroot/_c...be.css
windows10-2004-x64
7wwwroot/_c...ns.css
windows10-2004-x64
7wwwroot/_c...et.css
windows10-2004-x64
7wwwroot/_c...on.ico
windows10-2004-x64
3wwwroot/_c...ar.ttf
windows10-2004-x64
7wwwroot/_c...n0.png
windows10-2004-x64
3wwwroot/_c...n1.png
windows10-2004-x64
3wwwroot/_c...n2.png
windows10-2004-x64
3wwwroot/_c...n3.png
windows10-2004-x64
3wwwroot/_c...ims.js
windows10-2004-x64
1wwwroot/index.html
windows10-2004-x64
1wwwroot/js/anims.js
windows10-2004-x64
1wwwroot/js...ger.js
windows10-2004-x64
1wwwroot/js...ger.js
windows10-2004-x64
1wwwroot/js/utils.js
windows10-2004-x64
1wwwroot/li...min.js
windows10-2004-x64
1Analysis
-
max time kernel
141s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
13/11/2023, 03:20
Static task
static1
Behavioral task
behavioral1
Sample
Saturn.zip
Resource
win10v2004-20231023-en
Behavioral task
behavioral2
Sample
wwwroot/_content/Saturn.Backend/css/app.css
Resource
win10v2004-20231025-en
Behavioral task
behavioral3
Sample
wwwroot/_content/Saturn.Backend/css/bootstrap/bootstrap.min.css
Resource
win10v2004-20231020-en
Behavioral task
behavioral4
Sample
wwwroot/_content/Saturn.Backend/css/bootstrap/bootstrap.min.css.map
Resource
win10v2004-20231023-en
Behavioral task
behavioral5
Sample
wwwroot/_content/Saturn.Backend/css/open-iconic/FONT-LICENSE
Resource
win10v2004-20231025-en
Behavioral task
behavioral6
Sample
wwwroot/_content/Saturn.Backend/css/open-iconic/ICON-LICENSE
Resource
win10v2004-20231020-en
Behavioral task
behavioral7
Sample
wwwroot/_content/Saturn.Backend/css/open-iconic/README.md
Resource
win10v2004-20231023-en
Behavioral task
behavioral8
Sample
wwwroot/_content/Saturn.Backend/css/open-iconic/font/css/open-iconic-bootstrap.min.css
Resource
win10v2004-20231023-en
Behavioral task
behavioral9
Sample
wwwroot/_content/Saturn.Backend/css/open-iconic/font/fonts/open-iconic.eot
Resource
win10v2004-20231020-en
Behavioral task
behavioral10
Sample
wwwroot/_content/Saturn.Backend/css/open-iconic/font/fonts/open-iconic.otf
Resource
win10v2004-20231020-en
Behavioral task
behavioral11
Sample
wwwroot/_content/Saturn.Backend/css/open-iconic/font/fonts/open-iconic.xml
Resource
win10v2004-20231023-en
Behavioral task
behavioral12
Sample
wwwroot/_content/Saturn.Backend/css/open-iconic/font/fonts/open-iconic.ttf
Resource
win10v2004-20231020-en
Behavioral task
behavioral13
Sample
wwwroot/_content/Saturn.Backend/css/open-iconic/font/fonts/open-iconic.woff
Resource
win10v2004-20231023-en
Behavioral task
behavioral14
Sample
wwwroot/_content/Saturn.Backend/css/swapper/app.css
Resource
win10v2004-20231020-en
Behavioral task
behavioral15
Sample
wwwroot/_content/Saturn.Backend/css/swapper/base.css
Resource
win10v2004-20231023-en
Behavioral task
behavioral16
Sample
wwwroot/_content/Saturn.Backend/css/swapper/installer.css
Resource
win10v2004-20231020-en
Behavioral task
behavioral17
Sample
wwwroot/_content/Saturn.Backend/css/swapper/oobe.css
Resource
win10v2004-20231025-en
Behavioral task
behavioral18
Sample
wwwroot/_content/Saturn.Backend/css/swapper/plugins.css
Resource
win10v2004-20231023-en
Behavioral task
behavioral19
Sample
wwwroot/_content/Saturn.Backend/css/swapper/reset.css
Resource
win10v2004-20231025-en
Behavioral task
behavioral20
Sample
wwwroot/_content/Saturn.Backend/favicon.ico
Resource
win10v2004-20231020-en
Behavioral task
behavioral21
Sample
wwwroot/_content/Saturn.Backend/fonts/Nunito-Regular.ttf
Resource
win10v2004-20231020-en
Behavioral task
behavioral22
Sample
wwwroot/_content/Saturn.Backend/img/Anims/Saturn0.png
Resource
win10v2004-20231023-en
Behavioral task
behavioral23
Sample
wwwroot/_content/Saturn.Backend/img/Anims/Saturn1.png
Resource
win10v2004-20231020-en
Behavioral task
behavioral24
Sample
wwwroot/_content/Saturn.Backend/img/Anims/Saturn2.png
Resource
win10v2004-20231023-en
Behavioral task
behavioral25
Sample
wwwroot/_content/Saturn.Backend/img/Anims/Saturn3.png
Resource
win10v2004-20231023-en
Behavioral task
behavioral26
Sample
wwwroot/_content/Saturn.Backend/js/anims.js
Resource
win10v2004-20231023-en
Behavioral task
behavioral27
Sample
wwwroot/index.html
Resource
win10v2004-20231020-en
Behavioral task
behavioral28
Sample
wwwroot/js/anims.js
Resource
win10v2004-20231020-en
Behavioral task
behavioral29
Sample
wwwroot/js/modalManager.js
Resource
win10v2004-20231023-en
Behavioral task
behavioral30
Sample
wwwroot/js/tabManager.js
Resource
win10v2004-20231023-en
Behavioral task
behavioral31
Sample
wwwroot/js/utils.js
Resource
win10v2004-20231023-en
Behavioral task
behavioral32
Sample
wwwroot/lib/anime.min.js
Resource
win10v2004-20231023-en
General
-
Target
wwwroot/_content/Saturn.Backend/css/swapper/installer.css
-
Size
795B
-
MD5
edbf76107cc618389671f5f0676fe148
-
SHA1
b24b56d93f21e59cca7897233785130478f74214
-
SHA256
538f378dc7e03d572fbba09323a88b2d6698756887fad7b10012aab09619ce81
-
SHA512
2338397058df9ae484629f0a1e7fc35b24bf262dd30fd4f111d4c00f0c79ba72f3308c39e35c21b4abfd2ad968920ee247398bad7f16b2776ee86bf59b5b8ae1
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Control Panel\International\Geo\Nation cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings cmd.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 3628 NOTEPAD.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2476 wrote to memory of 3628 2476 cmd.exe 91 PID 2476 wrote to memory of 3628 2476 cmd.exe 91
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\wwwroot\_content\Saturn.Backend\css\swapper\installer.css1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\wwwroot\_content\Saturn.Backend\css\swapper\installer.css2⤵
- Opens file in notepad (likely ransom note)
PID:3628
-