Analysis
-
max time kernel
405s -
max time network
1140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
25/02/2024, 14:32 UTC
General
-
Target
wwwroot/_content/Saturn.Backend/favicon.ico
-
Size
179KB
-
MD5
6709d9c8b442c5e5a6494a60da2469a2
-
SHA1
aea759885626a537b46456fbacf33b8d9d860915
-
SHA256
2eab7fee596d68927f674e846867d4b0e6a5242842b93dc45a0218c582c88d62
-
SHA512
c0336c783bece112325c7ac196cfad1b375a99e0d65070984e802fc49b97d6a1e3723e1711295d5b113bf2079ee14ad9803cb0012771c8bdb0cebf2ed107a66a
-
SSDEEP
1536:aqw7JguPouxEFnssUnf7HMmMtR/25o3UB:y1EdsTMmn5iUB
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\wwwroot\_content\Saturn.Backend\favicon.ico1⤵
Network
-
DNS17.160.190.20.in-addr.arpaRemote address:8.8.8.8:53Request17.160.190.20.in-addr.arpaIN PTRResponse -
DNS180.178.17.96.in-addr.arpaRemote address:8.8.8.8:53Request180.178.17.96.in-addr.arpaIN PTRResponse180.178.17.96.in-addr.arpaIN PTRa96-17-178-180deploystaticakamaitechnologiescom
-
DNS43.58.199.20.in-addr.arpaRemote address:8.8.8.8:53Request43.58.199.20.in-addr.arpaIN PTRResponse
-
DNS157.123.68.40.in-addr.arpaRemote address:8.8.8.8:53Request157.123.68.40.in-addr.arpaIN PTRResponse
-
DNS56.126.166.20.in-addr.arpaRemote address:8.8.8.8:53Request56.126.166.20.in-addr.arpaIN PTRResponse
-
DNS140.71.91.104.in-addr.arpaRemote address:8.8.8.8:53Request140.71.91.104.in-addr.arpaIN PTRResponse140.71.91.104.in-addr.arpaIN PTRa104-91-71-140deploystaticakamaitechnologiescom
-
DNS194.178.17.96.in-addr.arpaRemote address:8.8.8.8:53Request194.178.17.96.in-addr.arpaIN PTRResponse194.178.17.96.in-addr.arpaIN PTRa96-17-178-194deploystaticakamaitechnologiescom
-
DNS48.229.111.52.in-addr.arpaRemote address:8.8.8.8:53Request48.229.111.52.in-addr.arpaIN PTRResponse
-
DNS131.72.42.20.in-addr.arpaRemote address:8.8.8.8:53Request131.72.42.20.in-addr.arpaIN PTRResponse
-
20.231.121.79:80
-
8.8.8.8:5317.160.190.20.in-addr.arpadns
DNS Request
17.160.190.20.in-addr.arpa
-
8.8.8.8:53180.178.17.96.in-addr.arpadns
DNS Request
180.178.17.96.in-addr.arpa
-
8.8.8.8:5343.58.199.20.in-addr.arpadns
DNS Request
43.58.199.20.in-addr.arpa
-
8.8.8.8:53157.123.68.40.in-addr.arpadns
DNS Request
157.123.68.40.in-addr.arpa
-
8.8.8.8:5356.126.166.20.in-addr.arpadns
DNS Request
56.126.166.20.in-addr.arpa
-
8.8.8.8:53140.71.91.104.in-addr.arpadns
DNS Request
140.71.91.104.in-addr.arpa
-
8.8.8.8:53194.178.17.96.in-addr.arpadns
DNS Request
194.178.17.96.in-addr.arpa
-
8.8.8.8:5348.229.111.52.in-addr.arpadns
DNS Request
48.229.111.52.in-addr.arpa
-
8.8.8.8:53131.72.42.20.in-addr.arpadns
DNS Request
131.72.42.20.in-addr.arpa