analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

SATURN_RANSOM.exe

Full analysis: https://app.any.run/tasks/dfce0b2e-05c4-44d1-90de-c0be1856de2e
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: October 05, 2022, 02:07:43
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
saturn
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

BBD4C2D2C72648C8F871B36261BE23FD

SHA1:

77C525E6B8A5760823AD6036E60B3FA244DB8E42

SHA256:

9E87F069DE22CEAC029A4AC56E6305D2DF54227E6B0F0B3ECAD52A01FBADE021

SSDEEP:

6144:zUrigyvF8Q9fLglQ8t0qabFDfOdQ/LDA8H+wwaMZUUAOq+mwNf8fsS+:zUrigY8QBLg9t0qabFDGdQ/TlYiUQ+Vz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Writes to a start menu file

      • SATURN_RANSOM.exe (PID: 3120)

    • Deletes shadow copies

      • cmd.exe (PID: 3376)

    • Starts BCDEDIT.EXE to disable recovery

      • cmd.exe (PID: 3376)

    • Saturn ransom note found

      • SATURN_RANSOM.exe (PID: 3120)

    • Runs PING.EXE for delay simulation

      • cmd.exe (PID: 3020)

    • Actions looks like stealing of personal data

      • SATURN_RANSOM.exe (PID: 3120)

    • Steals credentials from Web Browsers

      • SATURN_RANSOM.exe (PID: 3120)

  • SUSPICIOUS

    • Checks supported languages

      • SATURN_RANSOM.exe (PID: 3120)
      • cmd.exe (PID: 3376)
      • SATURN_RANSOM.exe (PID: 328)
      • SATURN_RANSOM.exe (PID: 2676)
      • SATURN_RANSOM.exe (PID: 2432)
      • SATURN_RANSOM.exe (PID: 2760)
      • WScript.exe (PID: 2056)
      • cmd.exe (PID: 3020)

    • Reads the computer name

      • SATURN_RANSOM.exe (PID: 3120)
      • SATURN_RANSOM.exe (PID: 328)
      • SATURN_RANSOM.exe (PID: 2676)
      • SATURN_RANSOM.exe (PID: 2432)
      • SATURN_RANSOM.exe (PID: 2760)
      • WScript.exe (PID: 2056)

    • Reads the date of Windows installation

      • SATURN_RANSOM.exe (PID: 3120)
      • SATURN_RANSOM.exe (PID: 328)
      • SATURN_RANSOM.exe (PID: 2676)
      • SATURN_RANSOM.exe (PID: 2432)
      • SATURN_RANSOM.exe (PID: 2760)

    • Reads Windows Product ID

      • SATURN_RANSOM.exe (PID: 3120)
      • SATURN_RANSOM.exe (PID: 328)
      • SATURN_RANSOM.exe (PID: 2676)
      • SATURN_RANSOM.exe (PID: 2432)
      • SATURN_RANSOM.exe (PID: 2760)

    • Starts CMD.EXE for commands execution

      • SATURN_RANSOM.exe (PID: 3120)

    • Creates files in the user directory

      • SATURN_RANSOM.exe (PID: 3120)
      • WScript.exe (PID: 2056)

    • Creates files in the program directory

      • SATURN_RANSOM.exe (PID: 3120)

    • Reads the cookies of Mozilla Firefox

      • SATURN_RANSOM.exe (PID: 3120)

    • Executes scripts

      • SATURN_RANSOM.exe (PID: 3120)

    • Starts Internet Explorer

      • SATURN_RANSOM.exe (PID: 3120)

    • Creates files like Ransomware instruction

      • SATURN_RANSOM.exe (PID: 3120)

    • Starts CMD.EXE for self-deleting

      • SATURN_RANSOM.exe (PID: 3120)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 1232)
      • iexplore.exe (PID: 4056)

  • INFO

    • Checks supported languages

      • vssadmin.exe (PID: 3576)
      • WMIC.exe (PID: 3408)
      • bcdedit.exe (PID: 2308)
      • wbadmin.exe (PID: 3536)
      • bcdedit.exe (PID: 2256)
      • NOTEPAD.EXE (PID: 3144)
      • PING.EXE (PID: 1716)
      • iexplore.exe (PID: 1232)
      • iexplore.exe (PID: 4056)
      • iexplore.exe (PID: 2820)

    • Reads the computer name

      • WMIC.exe (PID: 3408)
      • vssadmin.exe (PID: 3576)
      • wbadmin.exe (PID: 3536)
      • iexplore.exe (PID: 2820)
      • iexplore.exe (PID: 1232)
      • PING.EXE (PID: 1716)
      • iexplore.exe (PID: 4056)

    • Manual execution by user

      • SATURN_RANSOM.exe (PID: 328)
      • SATURN_RANSOM.exe (PID: 2676)
      • SATURN_RANSOM.exe (PID: 2432)
      • SATURN_RANSOM.exe (PID: 2760)

    • Dropped object may contain TOR URL's

      • SATURN_RANSOM.exe (PID: 3120)

    • Checks Windows Trust Settings

      • WScript.exe (PID: 2056)
      • iexplore.exe (PID: 2820)
      • iexplore.exe (PID: 4056)

    • Application launched itself

      • iexplore.exe (PID: 2820)
      • iexplore.exe (PID: 1232)

    • Changes internet zones settings

      • iexplore.exe (PID: 2820)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2820)
      • iexplore.exe (PID: 4056)

    • Reads internet explorer settings

      • iexplore.exe (PID: 1232)
      • iexplore.exe (PID: 4056)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2018-Feb-14 19:19:14
Detected languages:
  • English - United States

DOS Header

e_magic: MZ
e_cblp: 144
e_cp: 3
e_crlc: -
e_cparhdr: 4
e_minalloc: -
e_maxalloc: 65535
e_ss: -
e_sp: 184
e_csum: -
e_ip: -
e_cs: -
e_ovno: -
e_oemid: -
e_oeminfo: -
e_lfanew: 264

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 5
TimeDateStamp: 2018-Feb-14 19:19:14
PointerToSymbolTable: -
NumberOfSymbols: -
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
4096
211962
211968
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.60183
.rdata
217088
72394
72704
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.5994
.data
290816
51332
47616
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.03793
.rsrc
344064
736
1024
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.272
.reloc
348160
11860
12288
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.52577

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.07176
640
UNKNOWN
English - United States
RT_MANIFEST

Imports

ADVAPI32.dll
CRYPT32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
61
Monitored processes
18
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start #SATURN saturn_ransom.exe cmd.exe no specs vssadmin.exe no specs wmic.exe no specs bcdedit.exe no specs bcdedit.exe no specs wbadmin.exe no specs saturn_ransom.exe no specs saturn_ransom.exe no specs saturn_ransom.exe no specs saturn_ransom.exe no specs notepad.exe no specs wscript.exe no specs iexplore.exe cmd.exe no specs ping.exe no specs iexplore.exe no specs iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
3120"C:\Users\admin\Desktop\SATURN_RANSOM.exe" C:\Users\admin\Desktop\SATURN_RANSOM.exe
Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\users\admin\desktop\saturn_ransom.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3376"C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet & wmic.exe shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietC:\Windows\System32\cmd.exe—SATURN_RANSOM.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
4294967294
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3576vssadmin.exe delete shadows /all /quiet C:\Windows\system32\vssadmin.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\vssadmin.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
3408wmic.exe shadowcopy delete C:\Windows\System32\Wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
2147749908
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2256bcdedit /set {default} bootstatuspolicy ignoreallfailures C:\Windows\system32\bcdedit.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Boot Configuration Data Editor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\bcdedit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2308bcdedit /set {default} recoveryenabled no C:\Windows\system32\bcdedit.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Boot Configuration Data Editor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\bcdedit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3536wbadmin delete catalog -quietC:\Windows\system32\wbadmin.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Command Line Interface for Microsoft® BLB Backup
Exit code:
4294967294
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbadmin.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
328"C:\Users\admin\Desktop\SATURN_RANSOM.exe" C:\Users\admin\Desktop\SATURN_RANSOM.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\saturn_ransom.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
2676"C:\Users\admin\Desktop\SATURN_RANSOM.exe" C:\Users\admin\Desktop\SATURN_RANSOM.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\saturn_ransom.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2432"C:\Users\admin\Desktop\SATURN_RANSOM.exe" C:\Users\admin\Desktop\SATURN_RANSOM.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\saturn_ransom.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
30 306
Read events
30 105
Write events
201
Delete events
0

Modification events

(PID) Process:(3120) SATURN_RANSOM.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3120) SATURN_RANSOM.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3120) SATURN_RANSOM.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3120) SATURN_RANSOM.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2820) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(2820) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(2820) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30988383
(PID) Process:(2820) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(2820) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30988383
(PID) Process:(2056) WScript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Speech\CurrentUserLexicon
Operation:writeName:CLSID
Value:
{C9E37C15-DF92-4727-85D6-72E5EEB6995A}
Executable files
0
Suspicious files
1 704
Text files
472
Unknown types
14

Dropped files

PID
Process
Filename
Type
3120SATURN_RANSOM.exeC:\MSOCache\All Users\{90140000-0015-040C-0000-0000000FF1CE}-C\AccessMUI.xml.A0Ytbinary
MD5:48BFE7097DABF52CC2013EC183107B7B
SHA256:B7C6F37E875321A471B2C705BF0FB5EE31C12506D1B9D0E2A922A336CE9C8DF2
3120SATURN_RANSOM.exeC:\MSOCache\All Users\{90140000-0015-0407-0000-0000000FF1CE}-C\Setup.xml.A0Ytbinary
MD5:4E63E36B269E460D8199A527446FF7D0
SHA256:363941B24D730A130790ED5C1E144DDC57E7E0FCD45C40EE8F0CA5F2561012AE
3120SATURN_RANSOM.exeC:\MSOCache\All Users\{90140000-0015-0407-0000-0000000FF1CE}-C\branding.xml.saturnbinary
MD5:2587D6E8E203CB8B036B00245BA53C8B
SHA256:B58A29D37C406C8769324AF8AC84E1EBC4D3BFC32F4344060EC87A2097EA161D
3120SATURN_RANSOM.exeC:\MSOCache\All Users\{90140000-0015-0407-0000-0000000FF1CE}-C\AccessMUI.xmlbinary
MD5:DD9DE416A57345A97AE08AD4DF248163
SHA256:BA47C0E30DFF82F7387495D4DC44378D9678591B1D54D2E932C764E70DE497DE
3120SATURN_RANSOM.exeC:\MSOCache\All Users\{90140000-0015-0407-0000-0000000FF1CE}-C\Setup.xml.saturnbinary
MD5:31A5EDED13B6AC834357E58331D5D415
SHA256:4C7BE41A8D34C196CDBCC5D90184AF75AECA7645F502ADF8EE5543C50EF4558E
3120SATURN_RANSOM.exeC:\MSOCache\All Users\{90140000-0015-040C-0000-0000000FF1CE}-C\AccessMUI.xml.saturnbinary
MD5:8F35E35667183B888DEF5CA5A124B4E1
SHA256:90116E74A68F95A48CB2A75357ED347D90027DF4C56DA1C9B6668C48BA0F86BA
3120SATURN_RANSOM.exeC:\MSOCache\All Users\{90140000-0015-0407-0000-0000000FF1CE}-C\AccessMUI.xml.saturnbinary
MD5:DD9DE416A57345A97AE08AD4DF248163
SHA256:BA47C0E30DFF82F7387495D4DC44378D9678591B1D54D2E932C764E70DE497DE
3120SATURN_RANSOM.exeC:\MSOCache\All Users\{90140000-0015-040C-0000-0000000FF1CE}-C\branding.xml.A0Ytbinary
MD5:69530573B35ACA4FE66A78064AB9BD0F
SHA256:9B3B2C59D6DF66676B69BCE43077C5165685CD8F1C106F4C7BA097A6B3E73F8C
3120SATURN_RANSOM.exeC:\MSOCache\All Users\{90140000-0015-0407-0000-0000000FF1CE}-C\AccessMUI.xml.A0Ytbinary
MD5:8D753A7AC85AB808B087836F3405C93B
SHA256:1A6F122446E296865E6854D8E3DD2737AB845A7E36C744DFBF18023834D2501B
3120SATURN_RANSOM.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5zy4hsui.lnklnk
MD5:FD58F8579C8C549254C985C5DA5777F6
SHA256:1E48059BDCF63738BC188B0520C90449C3CBFC7E6702B1336B45E8D8BD0CF373
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
16
DNS requests
11
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4056
iexplore.exe
GET
200
23.216.77.69:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?b9a753adc5112849
US
compressed
60.9 Kb
whitelisted
2820
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
4056
iexplore.exe
GET
200
23.216.77.69:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?1ba6644874f6e0c1
US
compressed
60.9 Kb
whitelisted
4056
iexplore.exe
GET
200
96.16.145.230:80
http://x1.c.lencr.org/
US
der
717 b
whitelisted
2820
iexplore.exe
GET
200
23.216.77.69:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?6e6a9d7397179ef7
US
compressed
4.70 Kb
whitelisted
2820
iexplore.exe
GET
200
23.216.77.69:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?bf3066f6ad58b0a7
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2820
iexplore.exe
204.79.197.200:443
www.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2820
iexplore.exe
23.216.77.69:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
suspicious
4056
iexplore.exe
23.216.77.69:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
suspicious
2820
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
4056
iexplore.exe
96.16.145.230:80
x1.c.lencr.org
AKAMAI-AS
DE
suspicious
—
—
116.202.120.165:443
www.torproject.org
Hetzner Online GmbH
DE
suspicious
4056
iexplore.exe
116.202.120.165:443
www.torproject.org
Hetzner Online GmbH
DE
suspicious

DNS requests

Domain
IP
Reputation
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ctldl.windowsupdate.com
  • 23.216.77.69
  • 23.216.77.80
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
www.torproject.org
  • 116.202.120.165
  • 158.69.113.215
  • 158.69.113.194
  • 95.216.163.36
  • 116.202.120.166
shared
x1.c.lencr.org
  • 96.16.145.230
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
SATURN_RANSOM.exe