Overview
overview
7Static
static
3Saturn.zip
windows10-2004-x64
1wwwroot/_c...pp.css
windows10-2004-x64
7wwwroot/_c...in.css
windows10-2004-x64
7wwwroot/_c...ss.map
windows10-2004-x64
3wwwroot/_c...ICENSE
windows10-2004-x64
1wwwroot/_c...ICENSE
windows10-2004-x64
1wwwroot/_c...DME.md
windows10-2004-x64
3wwwroot/_c...in.css
windows10-2004-x64
7wwwroot/_c...ic.eot
windows10-2004-x64
3wwwroot/_c...ic.otf
windows10-2004-x64
7wwwroot/_c...ic.xml
windows10-2004-x64
1wwwroot/_c...ic.ttf
windows10-2004-x64
7wwwroot/_c...c.woff
windows10-2004-x64
3wwwroot/_c...pp.css
windows10-2004-x64
7wwwroot/_c...se.css
windows10-2004-x64
7wwwroot/_c...er.css
windows10-2004-x64
7wwwroot/_c...be.css
windows10-2004-x64
7wwwroot/_c...ns.css
windows10-2004-x64
7wwwroot/_c...et.css
windows10-2004-x64
7wwwroot/_c...on.ico
windows10-2004-x64
3wwwroot/_c...ar.ttf
windows10-2004-x64
7wwwroot/_c...n0.png
windows10-2004-x64
3wwwroot/_c...n1.png
windows10-2004-x64
3wwwroot/_c...n2.png
windows10-2004-x64
3wwwroot/_c...n3.png
windows10-2004-x64
3wwwroot/_c...ims.js
windows10-2004-x64
1wwwroot/index.html
windows10-2004-x64
1wwwroot/js/anims.js
windows10-2004-x64
1wwwroot/js...ger.js
windows10-2004-x64
1wwwroot/js...ger.js
windows10-2004-x64
1wwwroot/js/utils.js
windows10-2004-x64
1wwwroot/li...min.js
windows10-2004-x64
1Analysis
-
max time kernel
445s -
max time network
1172s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
25/02/2024, 14:32
Static task
static1
Behavioral task
behavioral1
Sample
Saturn.zip
Resource
win10v2004-20240221-en
Behavioral task
behavioral2
Sample
wwwroot/_content/Saturn.Backend/css/app.css
Resource
win10v2004-20240221-en
Behavioral task
behavioral3
Sample
wwwroot/_content/Saturn.Backend/css/bootstrap/bootstrap.min.css
Resource
win10v2004-20240221-en
Behavioral task
behavioral4
Sample
wwwroot/_content/Saturn.Backend/css/bootstrap/bootstrap.min.css.map
Resource
win10v2004-20240221-en
Behavioral task
behavioral5
Sample
wwwroot/_content/Saturn.Backend/css/open-iconic/FONT-LICENSE
Resource
win10v2004-20240221-en
Behavioral task
behavioral6
Sample
wwwroot/_content/Saturn.Backend/css/open-iconic/ICON-LICENSE
Resource
win10v2004-20240221-en
Behavioral task
behavioral7
Sample
wwwroot/_content/Saturn.Backend/css/open-iconic/README.md
Resource
win10v2004-20240221-en
Behavioral task
behavioral8
Sample
wwwroot/_content/Saturn.Backend/css/open-iconic/font/css/open-iconic-bootstrap.min.css
Resource
win10v2004-20240221-en
Behavioral task
behavioral9
Sample
wwwroot/_content/Saturn.Backend/css/open-iconic/font/fonts/open-iconic.eot
Resource
win10v2004-20240221-en
Behavioral task
behavioral10
Sample
wwwroot/_content/Saturn.Backend/css/open-iconic/font/fonts/open-iconic.otf
Resource
win10v2004-20240221-en
Behavioral task
behavioral11
Sample
wwwroot/_content/Saturn.Backend/css/open-iconic/font/fonts/open-iconic.xml
Resource
win10v2004-20240221-en
Behavioral task
behavioral12
Sample
wwwroot/_content/Saturn.Backend/css/open-iconic/font/fonts/open-iconic.ttf
Resource
win10v2004-20240221-en
Behavioral task
behavioral13
Sample
wwwroot/_content/Saturn.Backend/css/open-iconic/font/fonts/open-iconic.woff
Resource
win10v2004-20240221-en
Behavioral task
behavioral14
Sample
wwwroot/_content/Saturn.Backend/css/swapper/app.css
Resource
win10v2004-20240221-en
Behavioral task
behavioral15
Sample
wwwroot/_content/Saturn.Backend/css/swapper/base.css
Resource
win10v2004-20240221-en
Behavioral task
behavioral16
Sample
wwwroot/_content/Saturn.Backend/css/swapper/installer.css
Resource
win10v2004-20240221-en
Behavioral task
behavioral17
Sample
wwwroot/_content/Saturn.Backend/css/swapper/oobe.css
Resource
win10v2004-20240221-en
Behavioral task
behavioral18
Sample
wwwroot/_content/Saturn.Backend/css/swapper/plugins.css
Resource
win10v2004-20240221-en
Behavioral task
behavioral19
Sample
wwwroot/_content/Saturn.Backend/css/swapper/reset.css
Resource
win10v2004-20240221-en
Behavioral task
behavioral20
Sample
wwwroot/_content/Saturn.Backend/favicon.ico
Resource
win10v2004-20240221-en
Behavioral task
behavioral21
Sample
wwwroot/_content/Saturn.Backend/fonts/Nunito-Regular.ttf
Resource
win10v2004-20240221-en
Behavioral task
behavioral22
Sample
wwwroot/_content/Saturn.Backend/img/Anims/Saturn0.png
Resource
win10v2004-20240221-en
Behavioral task
behavioral23
Sample
wwwroot/_content/Saturn.Backend/img/Anims/Saturn1.png
Resource
win10v2004-20240221-en
Behavioral task
behavioral24
Sample
wwwroot/_content/Saturn.Backend/img/Anims/Saturn2.png
Resource
win10v2004-20240221-en
Behavioral task
behavioral25
Sample
wwwroot/_content/Saturn.Backend/img/Anims/Saturn3.png
Resource
win10v2004-20240221-en
Behavioral task
behavioral26
Sample
wwwroot/_content/Saturn.Backend/js/anims.js
Resource
win10v2004-20240221-en
Behavioral task
behavioral27
Sample
wwwroot/index.html
Resource
win10v2004-20240221-en
Behavioral task
behavioral28
Sample
wwwroot/js/anims.js
Resource
win10v2004-20240221-en
Behavioral task
behavioral29
Sample
wwwroot/js/modalManager.js
Resource
win10v2004-20240221-en
Behavioral task
behavioral30
Sample
wwwroot/js/tabManager.js
Resource
win10v2004-20240221-en
Behavioral task
behavioral31
Sample
wwwroot/js/utils.js
Resource
win10v2004-20240221-en
Behavioral task
behavioral32
Sample
wwwroot/lib/anime.min.js
Resource
win10v2004-20240221-en
General
-
Target
wwwroot/_content/Saturn.Backend/css/swapper/oobe.css
-
Size
701B
-
MD5
800280823650756d75c23b2d8f5110c3
-
SHA1
64ca285d0a9d4534c2133336cbdf79680a7acee3
-
SHA256
ad24030402327f8509a44f45cc5886155489ef7734f4301a5e57792cc226cf3f
-
SHA512
c8766c355a91eb81a471ae0e9748d8b23666492e45db6b975a3b12e6bce16c7c0bde727ee3a08cc535b80a549fd45f80d5a0d202abf4339120bb5b0a942a10d0
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2132103209-3755304320-2959162027-1000\Control Panel\International\Geo\Nation cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2132103209-3755304320-2959162027-1000_Classes\Local Settings cmd.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 412 NOTEPAD.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2008 wrote to memory of 412 2008 cmd.exe 17 PID 2008 wrote to memory of 412 2008 cmd.exe 17
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\wwwroot\_content\Saturn.Backend\css\swapper\oobe.css1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\wwwroot\_content\Saturn.Backend\css\swapper\oobe.css2⤵
- Opens file in notepad (likely ransom note)
PID:412
-