Analysis
-
max time kernel
412s -
max time network
1174s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
25/02/2024, 14:32 UTC
General
-
Target
wwwroot/_content/Saturn.Backend/css/open-iconic/font/fonts/open-iconic.woff
-
Size
14KB
-
MD5
3cf97837524dd7445e9d1462e3c4afe2
-
SHA1
9536808d830d8a28b4ca28c6f2fa8b1bd2937a55
-
SHA256
7193ea5654497d2356d0a690e3e50f39767fbff4335e57a3443c1435d648a1f2
-
SHA512
a8374475cd54a38f087bd22cafd9b694763898d4de67e73d1d860f82ec860d72ebffbd929158e70c10022cfcdf36ebd04379b59612367b21537e4d0fa71696e3
-
SSDEEP
384:CmOo1YmRg4IsAnWEXJEFhdc4Nc2yb7+J0ZE9/xRqWN:CmOo1s4I5L5am4Vk+fZXN
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\wwwroot\_content\Saturn.Backend\css\open-iconic\font\fonts\open-iconic.woff1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
-
DNS17.160.190.20.in-addr.arpaRemote address:8.8.8.8:53Request17.160.190.20.in-addr.arpaIN PTRResponse -
DNS241.154.82.20.in-addr.arpaRemote address:8.8.8.8:53Request241.154.82.20.in-addr.arpaIN PTRResponse
-
DNS180.178.17.96.in-addr.arpaRemote address:8.8.8.8:53Request180.178.17.96.in-addr.arpaIN PTRResponse180.178.17.96.in-addr.arpaIN PTRa96-17-178-180deploystaticakamaitechnologiescom
-
DNS45.19.74.20.in-addr.arpaRemote address:8.8.8.8:53Request45.19.74.20.in-addr.arpaIN PTRResponse
-
DNS26.165.165.52.in-addr.arpaRemote address:8.8.8.8:53Request26.165.165.52.in-addr.arpaIN PTRResponse
-
DNS41.110.16.96.in-addr.arpaRemote address:8.8.8.8:53Request41.110.16.96.in-addr.arpaIN PTRResponse41.110.16.96.in-addr.arpaIN PTRa96-16-110-41deploystaticakamaitechnologiescom
-
DNS15.164.165.52.in-addr.arpaRemote address:8.8.8.8:53Request15.164.165.52.in-addr.arpaIN PTRResponse
-
DNS140.71.91.104.in-addr.arpaRemote address:8.8.8.8:53Request140.71.91.104.in-addr.arpaIN PTRResponse140.71.91.104.in-addr.arpaIN PTRa104-91-71-140deploystaticakamaitechnologiescom
-
DNS194.178.17.96.in-addr.arpaRemote address:8.8.8.8:53Request194.178.17.96.in-addr.arpaIN PTRResponse194.178.17.96.in-addr.arpaIN PTRa96-17-178-194deploystaticakamaitechnologiescom
-
DNS14.227.111.52.in-addr.arpaRemote address:8.8.8.8:53Request14.227.111.52.in-addr.arpaIN PTRResponse
-
DNS40.173.79.40.in-addr.arpaRemote address:8.8.8.8:53Request40.173.79.40.in-addr.arpaIN PTRResponse
No results found
-
8.8.8.8:5317.160.190.20.in-addr.arpadns
DNS Request
17.160.190.20.in-addr.arpa
-
8.8.8.8:53241.154.82.20.in-addr.arpadns
DNS Request
241.154.82.20.in-addr.arpa
-
8.8.8.8:53180.178.17.96.in-addr.arpadns
DNS Request
180.178.17.96.in-addr.arpa
-
8.8.8.8:5345.19.74.20.in-addr.arpadns
DNS Request
45.19.74.20.in-addr.arpa
-
8.8.8.8:5326.165.165.52.in-addr.arpadns
DNS Request
26.165.165.52.in-addr.arpa
-
8.8.8.8:5341.110.16.96.in-addr.arpadns
DNS Request
41.110.16.96.in-addr.arpa
-
8.8.8.8:5315.164.165.52.in-addr.arpadns
DNS Request
15.164.165.52.in-addr.arpa
-
8.8.8.8:53140.71.91.104.in-addr.arpadns
DNS Request
140.71.91.104.in-addr.arpa
-
8.8.8.8:53194.178.17.96.in-addr.arpadns
DNS Request
194.178.17.96.in-addr.arpa
-
8.8.8.8:5314.227.111.52.in-addr.arpadns
DNS Request
14.227.111.52.in-addr.arpa
-
8.8.8.8:5340.173.79.40.in-addr.arpadns
DNS Request
40.173.79.40.in-addr.arpa