7796753a59f4a3d67e54f5430fb3bc638846f5d2f7b5c649b06201bcb3a3f46e

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
04/11/2023, 15:05

Target

StartAllBack 3.6.15.4724 Multilingual/StartAllBack_3.6.15_setup.exe
Size

1.8MB
MD5

716c79ecd8327143e1e2d89c81d29507
SHA1

267966cf5ec25fdfefb3259706a192aa0b64c273
SHA256

95a8244795efc1eb2d6b659202e8f2988a9c11d5805d68d29f608ed4b85c4324
SHA512

61f83903349d9d722d021e590997bb1d71f675ecb17880806a2d23c0dab865a044065212be660982d3c9b6e990047f199446263fb39e3c8d2d44ee41c40a47cf
SSDEEP

24576:ZaxVx4Ub0HtZ7wRjdNCy5tUDi1MvIa5mceIstvQfw9V+qVaSQ8XfQNL3XI:YxTeZUley7GFQMslswnVa2PQNTXI

Score

4^/10

Executes dropped EXE 1 IoCs

pid	Process
2584	StartAllBackCfg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\StartAllBack 3.6.15.4724 Multilingual\StartAllBack_3.6.15_setup.exe
"C:\Users\Admin\AppData\Local\Temp\StartAllBack 3.6.15.4724 Multilingual\StartAllBack_3.6.15_setup.exe"
1⤵
PID:2160
- C:\Users\Admin\AppData\Local\Temp\SIBSFX.67570870\StartAllBackCfg.exe
  "C:\Users\Admin\AppData\Local\Temp\SIBSFX.67570870\StartAllBackCfg.exe" /install
  2⤵
  - Executes dropped EXE
  PID:2584

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\SIBSFX.67570870\StartAllBackCfg.exe

Filesize
3.2MB

MD5
e5f6141a38cdfa91b8462e2b9bd0fecb

SHA1
5a4616b2136c338e1d951911b39a8a5e69afacc7

SHA256
8c5fa1084536f78abb22e4ec34e3d0aa9c5d8bc8b6e959313d9079b1b9524b6a

SHA512
3c021d5b562f017314ddbc73b8a5a666ec45a296989a976cf25888fadeebd5ff49d40c5ead99e84a4ea492e0e44f597186ed5664d8c1a28d99b8de22c8acd8ac

Download Submit
memory/2160-64-0x0000000002630000-0x0000000002631000-memory.dmp

Filesize
4KB

Download
memory/2160-127-0x0000000002630000-0x0000000002631000-memory.dmp

Filesize
4KB

Download