Overview

overview

8

Static

static

3

StartAllBa....7.exe

windows10-1703-x64

8

Resubmissions

01-05-2024 22:25

240501-2b3f1ahc9s 8

01-05-2024 22:23

240501-2atsgahc7v 8

Analysis

  • max time kernel
    42s
  • max time network
    39s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    01-05-2024 22:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    StartAllBack.v3.7.7.exe

  • Size

    3.4MB

  • MD5

    5f6757917139289b8cf4566a61c45173

  • SHA1

    1dd8ef1a6365a30896bfb339caafd298a0d146f0

  • SHA256

    2fac2937abb8ae4abb53d414a3494a1841bdc97a2928628ad4e01368e5158a42

  • SHA512

    ccf629d6215b789cd6c3b33b33165e0edf60670a0a2d809a00fe90c1eba3931374c3b55ff1f99c4649924e327110a23828662e16be45a10f456d89514160eac0

  • SSDEEP

    98304:6BOc/4Ib9mLM0kHQ+kk63RyWATDoTs6qIhMOZ5U:sOc/J4M0sW53YrhgmOZ5U

Score
8/10
discoverypersistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 9 IoCs
  • Registers COM server for autorun 1 TTPs 23 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 3 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 26 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Kills process with taskkill 8 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 52 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\StartAllBack.v3.7.7.exe
    "C:\Users\Admin\AppData\Local\Temp\StartAllBack.v3.7.7.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1916
    • C:\Users\Admin\AppData\Local\Temp\STARTISBACK\StartIsBackCfg.exe
      "C:\Users\Admin\AppData\Local\Temp\STARTISBACK\StartIsBackCfg.exe" /install /elevated /silent
      2⤵
      • Executes dropped EXE
      • Registers COM server for autorun
      • Drops file in Program Files directory
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4564
      • C:\Users\Admin\AppData\Local\Temp\STARTISBACK\startscreen.exe
        startscreen.exe /stop
        3⤵
        • Executes dropped EXE
        PID:504
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /F /IM startscreen*
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3052
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /F /IM explorer*
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1380
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /F /IM explorer*
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1572
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /F /IM explorer*
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1336
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /F /IM explorer*
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1348
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /F /IM explorer*
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4428
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /F /IM explorer*
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1560
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /F /IM explorer*
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4480
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /Create /TN "\StartIsBack health check" /XML "C:\Users\Admin\AppData\Local\Temp\sibtask.xml"
        3⤵
        • Creates scheduled task(s)
        PID:4672
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe
      2⤵
      • Modifies Installed Components in the registry
      • Loads dropped DLL
      • Enumerates connected drives
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2472
      • C:\Program Files (x86)\StartIsBack\StartScreen.exe
        "C:\Program Files (x86)\StartIsBack\StartScreen.exe" /unpin
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops desktop.ini file(s)
        • Suspicious use of FindShellTrayWindow
        PID:2704
      • C:\Program Files (x86)\StartIsBack\StartIsBackCfg.exe
        "C:\Program Files (x86)\StartIsBack\StartIsBackCfg.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:788
      • C:\Program Files (x86)\StartIsBack\StartScreen.exe
        "C:\Program Files (x86)\StartIsBack\StartScreen.exe" /unpin
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops desktop.ini file(s)
        PID:60
      • C:\Program Files (x86)\StartIsBack\StartScreen.exe
        "C:\Program Files (x86)\StartIsBack\StartScreen.exe" /unpin
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops desktop.ini file(s)
        PID:4508
  • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2636

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
    Filesize

    14KB

    MD5

    3380b54e3424a51ad98bd19884a6eb69

    SHA1

    9e5c9010f9e6c48b61f3ed8b638ed11658ed7b4b

    SHA256

    d62d93bcba5ee7c1669261f8319602061a5928eddebd669c49c2cd5bfa24c7f4

    SHA512

    fb1241644f878453b983eea240e694ac5d067fba0ba316c57e7b709a2196657f7cb548b5656daed0c5f1715a977ce77b302c10471c4619a418df2d06c1ac0450

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\STARTISBACK\Orbs\Shamrock.orb
    Filesize

    295KB

    MD5

    ef55e07e1a2e47bb2bb749046cd150b2

    SHA1

    68362a1b38f03b8f25fc1f2cfcbd73d90b2ea0fa

    SHA256

    1a8dac51758c66a1bb03fbc227b5edb52ef7379fa3603b62eb3307005d06c9b5

    SHA512

    9c04a8c14dddf42b1ce6d07a5e562f008922595a9024cfcedb46529ab97804535fee8d1577ba9ee7438602aaac8613237869d5dc658bf7b68d44c250128b7b0e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\STARTISBACK\Orbs\StartIsBack_Ei8htOrb_v2_by_PainteR.bmp
    Filesize

    34KB

    MD5

    641328c75e6b117545211db22dafcaa0

    SHA1

    df4061f2b30b8cce58c2446cd6e8b86968ab46d0

    SHA256

    76a72c9ad77843b58223dd588483ac1265a31c15aaeb47ee66d1925de787644b

    SHA512

    54f265edd24cb26b4a550f65f8c3a70acc4fe2a95e03a43c14919d2b67f817162cdbd06aa9ccef86942f04a7e115b70b44164e83001f965cd7a627a06186d6b9

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\STARTISBACK\Orbs\Windows 7.orb
    Filesize

    295KB

    MD5

    85328e698e8a74852b4061a683915dc8

    SHA1

    b898267f8574a34e6d605e541e5234c27dd53f5d

    SHA256

    e5b74e9e7bd6758a0154b11462ae3328edd143190865198104d8bd53b9af7275

    SHA512

    03945c487c6e697f7b352374a989bfe41d1de7d00624461d2b97fb2027b26d36b35035d5e78ea622c31372087dae647c5d3591c7f9a27941c009993e719ee28f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\STARTISBACK\StartIsBack32.dll
    Filesize

    563KB

    MD5

    e4b19c388cf6d649053e7f018388b9a4

    SHA1

    9114450f106c4e274c335f4e5d41fe40380a9607

    SHA256

    6405b9ad8b1557381de5a3d51502f408891283ba22ad45166343261e703bee07

    SHA512

    f990a6765a3bc8c3d36d8617e68237d83cd2cca4e05a71389f4381e6ef8b2c96cc9f04a6f9db74a9af95f30bfd36c72394acff8718e8ab6d16581eafd68ab51e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\STARTISBACK\StartIsBack64.dll
    Filesize

    667KB

    MD5

    7ca847e6522f074352eadc0b62eb3399

    SHA1

    84fadc794964373f4098a474c3829d5d1953e07a

    SHA256

    584d631fa9f62873409cc51777fbbe8df673887a8af0a092d4b0523da512e577

    SHA512

    6c0e8a38a394309fcbb66d9da372cd35114b5a0aea397324f629fbb18866eaa934119483d5048dcb487377cd2d47d85ee23611aae84947a025b494a53bfcd20a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\STARTISBACK\StartIsBackCfg.exe
    Filesize

    2.3MB

    MD5

    54873041460fa7a27cfb5008239e11f9

    SHA1

    c4fd1fa77a5e079f19cfaed945a83b65bc55431a

    SHA256

    3b946870b669af9837a27204e72ebe8e42a3503a6ee4da3822672ff54bdad0c5

    SHA512

    78fc2b84dc42e86bec9e802f6a96a3507802a033b54429ac0d2c65b726edfb0dc3ee1cf5c57dde455a5ffa36b49ebf9c1ff4335b5b7fab70b9609d903e59ca8a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\STARTISBACK\Styles\Plain10.msstyles
    Filesize

    48KB

    MD5

    a69385279536210958fb9c86cab229d6

    SHA1

    6ecb118cfb9b8ef42c79aa0d795c3d8b51f0341d

    SHA256

    3955fc60d3b7c4a1badd831fde82269261407cf9d459c65b429e8abc769adeed

    SHA512

    f1cf5b1ec22416e645c0dfc128c25166585e300a8db2de6ec51e0689e26e54831dcf2b26a03115423b9b71f1b109389a3e14173fe0a8bbebc2547f9ca33cd412

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\STARTISBACK\Styles\Plain8.msstyles
    Filesize

    118KB

    MD5

    509fd060516d1971da8d0c2173748358

    SHA1

    67ccd63914312b1f491467bec42232916df109c7

    SHA256

    43c7016d950248f52f9512c9e7393c38d61a3ba2235e5fb6deed83564d8e9442

    SHA512

    de3d87b7e0a518ffbb10ccd400dbf5f9596177b75dd7aa4785855d36f007ef0417b88b2eb3aa6af7e52fb3670c021f714bcf87a33551ffc4536444d5204aa7e6

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\STARTISBACK\Styles\Windows 7.msstyles
    Filesize

    405KB

    MD5

    b6a2892c151ccd59d0b4c4c1777daac5

    SHA1

    b34791b4db3956620dffb2e11e1fa160e2d20889

    SHA256

    0c6e681a8091ba888e58473cceeae590c88a405bb30dcb344f940acf27290ce8

    SHA512

    e8fc5c96d155bf9657c07d861e2597d681a23ce1d46ec3e779251126e989be41c883e0545e80b5291c96a3ead4eb6c2affe8b419abb506bc5e5376fe2fa212ae

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\STARTISBACK\UpdateCheck.exe
    Filesize

    3KB

    MD5

    f9756c261aa978c787302debff8f142a

    SHA1

    81b5b130741d5df2feccd67bb6edb1a9d08d48aa

    SHA256

    a8d52a2653709d93d0d2c05d653dcf8f0cb06f11422d183eb6871528c95df319

    SHA512

    20ae445ab28d98ce6c1c8b066b7133541d9f944df7dbfccbc35df724165624c82d76c260c6041e5033e965e4dc0a2a57a67b594057cbc88f8ccc6ac9490c08b3

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\STARTISBACK\startscreen.exe
    Filesize

    71KB

    MD5

    a2d6e2201be02973328038457aa64bba

    SHA1

    684338bd758a92449d43c49a0aa539f323760215

    SHA256

    f4e76abf0df055fae97863708412773b51197bae0ddd9692a9509e824d847df0

    SHA512

    21002b3b3cd01beb923692addaef4e5d0fcbee972154e25bea2c4ece591185bf8e6221959fbcc772fc7e7f73dce18747909dcd9c04423a0ade70f6cfba72f135

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\sibtask.xml
    Filesize

    3KB

    MD5

    331691375e3eb33ed12214c26797c23f

    SHA1

    3719bd8407dcc0a40f5d9eedc927eea80d0ef9e4

    SHA256

    2ffd12fcc5e8c87af2f14605602e8602dcfa2d5638ad6bd690e0a1014fe2c772

    SHA512

    e002ce601db8cb4a3ad3ce02812752f5c547739df2aa2501de248899775a939a7a6652a3695a0a56b6cc3b2d599230f3278f1d8fad19066be30ee0ddedc2d7ff

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\startscreen\desktop.ini
    Filesize

    80B

    MD5

    8011052ff701a0c4439ee18450e8e51d

    SHA1

    a4893c2482522ccc3dee1c95ce644d8e1090d6ae

    SHA256

    b901f0d5c24c25f334690f540b2a62d3e9c76226bdc183d45422e3237cc36051

    SHA512

    c1712b4ea2fb42f38e76adaed613890f5e707a1ca495c87da506d423b3141a463fff034b1ae80824f6f8db776a9181f27d5f3f5a6cb94a1ab87ac0babe10d2c9

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\startscreen\startscreen.lnk
    Filesize

    1KB

    MD5

    c43abe08aeb3d8f3e32aba10586905cc

    SHA1

    e0e59a53b17200bfa2aa9f9a393ef433bd8f0c43

    SHA256

    a5f5855449e32e8f5951e840175b1682a76e40af9e0109e81b33b8d289c66a83

    SHA512

    61a7abf9c0af6b7f6fc0f77d472ed010e342018c5079826419b21eabba88f1d8aa93d30372b9b2d9c16eecc5f4f16ffd83f3db144b206746684cae9320bc8937

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsh5863.tmp\LangDLL.dll
    Filesize

    5KB

    MD5

    109b201717ab5ef9b5628a9f3efef36f

    SHA1

    98db1f0cc5f110438a02015b722778af84d50ea7

    SHA256

    20e642707ef82852bcf153254cb94b629b93ee89a8e8a03f838eef6cbb493319

    SHA512

    174e241863294c12d0705c9d2de92f177eb8f3d91125b183d8d4899c89b9a202a4c7a81e0a541029a4e52513eee98029196a4c3b8663b479e69116347e5de5b4

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsh5863.tmp\System.dll
    Filesize

    12KB

    MD5

    8cf2ac271d7679b1d68eefc1ae0c5618

    SHA1

    7cc1caaa747ee16dc894a600a4256f64fa65a9b8

    SHA256

    6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba

    SHA512

    ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsh5863.tmp\nsDialogs.dll
    Filesize

    9KB

    MD5

    ec9640b70e07141febbe2cd4cc42510f

    SHA1

    64a5e4b90e5fe62aa40e7ac9e16342ed066f0306

    SHA256

    c5ba017732597a82f695b084d1aa7fe3b356168cc66105b9392a9c5b06be5188

    SHA512

    47605b217313c7fe6ce3e9a65da156a2fba8d91e4ed23731d3c5e432dd048ff5c8f9ae8bb85a6a39e1eac4e1b6a22862aa72d3b1b1c8255858997cdd4db5d1fe

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsh5863.tmp\registry.dll
    Filesize

    24KB

    MD5

    2b7007ed0262ca02ef69d8990815cbeb

    SHA1

    2eabe4f755213666dbbbde024a5235ddde02b47f

    SHA256

    0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d

    SHA512

    aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca

    Download Submit

  • memory/788-192-0x0000000000400000-0x0000000000653000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/2472-97-0x00000000022D0000-0x00000000022D1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2636-102-0x00000203B9200000-0x00000203B9300000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/2636-106-0x00000203B9940000-0x00000203B9960000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2636-127-0x00000203B9AC0000-0x00000203B9AE0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/4564-64-0x0000000000400000-0x0000000000653000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/4564-31-0x00000000007C0000-0x00000000007C1000-memory.dmp

    Filesize

    4KB

    Download