Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

StartAllBa....7.exe

windows10-1703-x64

8

Resubmissions

01/05/2024, 22:25

240501-2b3f1ahc9s 8

01/05/2024, 22:23

240501-2atsgahc7v 8

Analysis

  • max time kernel
    38s
  • max time network
    44s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    01/05/2024, 22:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    StartAllBack.v3.7.7.exe

  • Size

    3.4MB

  • MD5

    5f6757917139289b8cf4566a61c45173

  • SHA1

    1dd8ef1a6365a30896bfb339caafd298a0d146f0

  • SHA256

    2fac2937abb8ae4abb53d414a3494a1841bdc97a2928628ad4e01368e5158a42

  • SHA512

    ccf629d6215b789cd6c3b33b33165e0edf60670a0a2d809a00fe90c1eba3931374c3b55ff1f99c4649924e327110a23828662e16be45a10f456d89514160eac0

  • SSDEEP

    98304:6BOc/4Ib9mLM0kHQ+kk63RyWATDoTs6qIhMOZ5U:sOc/J4M0sW53YrhgmOZ5U

Score
8/10
discoverypersistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Registers COM server for autorun 1 TTPs 23 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 10 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Kills process with taskkill 8 IoCs
    evasion
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 14 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\StartAllBack.v3.7.7.exe
    "C:\Users\Admin\AppData\Local\Temp\StartAllBack.v3.7.7.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1012
    • C:\Users\Admin\AppData\Local\Temp\STARTISBACK\StartIsBackCfg.exe
      "C:\Users\Admin\AppData\Local\Temp\STARTISBACK\StartIsBackCfg.exe" /install /elevated /silent
      2⤵
      • Executes dropped EXE
      • Registers COM server for autorun
      • Drops file in Program Files directory
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:5092
      • C:\Users\Admin\AppData\Local\Temp\STARTISBACK\startscreen.exe
        startscreen.exe /stop
        3⤵
        • Executes dropped EXE
        PID:1168
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /F /IM startscreen*
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4796
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /F /IM explorer*
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4812
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /F /IM explorer*
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4828
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /F /IM explorer*
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:204
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /F /IM explorer*
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3816
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /F /IM explorer*
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4844
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /F /IM explorer*
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4788
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /F /IM explorer*
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3140
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /Create /TN "\StartIsBack health check" /XML "C:\Users\Admin\AppData\Local\Temp\sibtask.xml"
        3⤵
        • Creates scheduled task(s)
        PID:4640
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe
      2⤵
      • Modifies Installed Components in the registry
      • Loads dropped DLL
      • Enumerates connected drives
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4784
      • C:\Program Files (x86)\StartIsBack\StartScreen.exe
        "C:\Program Files (x86)\StartIsBack\StartScreen.exe" /unpin
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops desktop.ini file(s)
        • Suspicious use of FindShellTrayWindow
        PID:1076
      • C:\Windows\system32\taskmgr.exe
        "C:\Windows\system32\taskmgr.exe" /4
        3⤵
          PID:3212
    • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
      1⤵
      • Drops file in Windows directory
      • Enumerates system info in registry
      • Suspicious use of SetWindowsHookEx
      PID:5072

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\STARTISBACK\Orbs\Shamrock.orb
      Filesize

      295KB

      MD5

      ef55e07e1a2e47bb2bb749046cd150b2

      SHA1

      68362a1b38f03b8f25fc1f2cfcbd73d90b2ea0fa

      SHA256

      1a8dac51758c66a1bb03fbc227b5edb52ef7379fa3603b62eb3307005d06c9b5

      SHA512

      9c04a8c14dddf42b1ce6d07a5e562f008922595a9024cfcedb46529ab97804535fee8d1577ba9ee7438602aaac8613237869d5dc658bf7b68d44c250128b7b0e

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\STARTISBACK\Orbs\StartIsBack_Ei8htOrb_v2_by_PainteR.bmp
      Filesize

      34KB

      MD5

      641328c75e6b117545211db22dafcaa0

      SHA1

      df4061f2b30b8cce58c2446cd6e8b86968ab46d0

      SHA256

      76a72c9ad77843b58223dd588483ac1265a31c15aaeb47ee66d1925de787644b

      SHA512

      54f265edd24cb26b4a550f65f8c3a70acc4fe2a95e03a43c14919d2b67f817162cdbd06aa9ccef86942f04a7e115b70b44164e83001f965cd7a627a06186d6b9

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\STARTISBACK\Orbs\Windows 7.orb
      Filesize

      295KB

      MD5

      85328e698e8a74852b4061a683915dc8

      SHA1

      b898267f8574a34e6d605e541e5234c27dd53f5d

      SHA256

      e5b74e9e7bd6758a0154b11462ae3328edd143190865198104d8bd53b9af7275

      SHA512

      03945c487c6e697f7b352374a989bfe41d1de7d00624461d2b97fb2027b26d36b35035d5e78ea622c31372087dae647c5d3591c7f9a27941c009993e719ee28f

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\STARTISBACK\StartIsBack32.dll
      Filesize

      563KB

      MD5

      e4b19c388cf6d649053e7f018388b9a4

      SHA1

      9114450f106c4e274c335f4e5d41fe40380a9607

      SHA256

      6405b9ad8b1557381de5a3d51502f408891283ba22ad45166343261e703bee07

      SHA512

      f990a6765a3bc8c3d36d8617e68237d83cd2cca4e05a71389f4381e6ef8b2c96cc9f04a6f9db74a9af95f30bfd36c72394acff8718e8ab6d16581eafd68ab51e

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\STARTISBACK\StartIsBack64.dll
      Filesize

      667KB

      MD5

      7ca847e6522f074352eadc0b62eb3399

      SHA1

      84fadc794964373f4098a474c3829d5d1953e07a

      SHA256

      584d631fa9f62873409cc51777fbbe8df673887a8af0a092d4b0523da512e577

      SHA512

      6c0e8a38a394309fcbb66d9da372cd35114b5a0aea397324f629fbb18866eaa934119483d5048dcb487377cd2d47d85ee23611aae84947a025b494a53bfcd20a

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\STARTISBACK\StartIsBackCfg.exe
      Filesize

      2.3MB

      MD5

      54873041460fa7a27cfb5008239e11f9

      SHA1

      c4fd1fa77a5e079f19cfaed945a83b65bc55431a

      SHA256

      3b946870b669af9837a27204e72ebe8e42a3503a6ee4da3822672ff54bdad0c5

      SHA512

      78fc2b84dc42e86bec9e802f6a96a3507802a033b54429ac0d2c65b726edfb0dc3ee1cf5c57dde455a5ffa36b49ebf9c1ff4335b5b7fab70b9609d903e59ca8a

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\STARTISBACK\Styles\Plain10.msstyles
      Filesize

      48KB

      MD5

      a69385279536210958fb9c86cab229d6

      SHA1

      6ecb118cfb9b8ef42c79aa0d795c3d8b51f0341d

      SHA256

      3955fc60d3b7c4a1badd831fde82269261407cf9d459c65b429e8abc769adeed

      SHA512

      f1cf5b1ec22416e645c0dfc128c25166585e300a8db2de6ec51e0689e26e54831dcf2b26a03115423b9b71f1b109389a3e14173fe0a8bbebc2547f9ca33cd412

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\STARTISBACK\Styles\Plain8.msstyles
      Filesize

      118KB

      MD5

      509fd060516d1971da8d0c2173748358

      SHA1

      67ccd63914312b1f491467bec42232916df109c7

      SHA256

      43c7016d950248f52f9512c9e7393c38d61a3ba2235e5fb6deed83564d8e9442

      SHA512

      de3d87b7e0a518ffbb10ccd400dbf5f9596177b75dd7aa4785855d36f007ef0417b88b2eb3aa6af7e52fb3670c021f714bcf87a33551ffc4536444d5204aa7e6

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\STARTISBACK\Styles\Windows 7.msstyles
      Filesize

      405KB

      MD5

      b6a2892c151ccd59d0b4c4c1777daac5

      SHA1

      b34791b4db3956620dffb2e11e1fa160e2d20889

      SHA256

      0c6e681a8091ba888e58473cceeae590c88a405bb30dcb344f940acf27290ce8

      SHA512

      e8fc5c96d155bf9657c07d861e2597d681a23ce1d46ec3e779251126e989be41c883e0545e80b5291c96a3ead4eb6c2affe8b419abb506bc5e5376fe2fa212ae

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\STARTISBACK\UpdateCheck.exe
      Filesize

      3KB

      MD5

      f9756c261aa978c787302debff8f142a

      SHA1

      81b5b130741d5df2feccd67bb6edb1a9d08d48aa

      SHA256

      a8d52a2653709d93d0d2c05d653dcf8f0cb06f11422d183eb6871528c95df319

      SHA512

      20ae445ab28d98ce6c1c8b066b7133541d9f944df7dbfccbc35df724165624c82d76c260c6041e5033e965e4dc0a2a57a67b594057cbc88f8ccc6ac9490c08b3

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\STARTISBACK\startscreen.exe
      Filesize

      71KB

      MD5

      a2d6e2201be02973328038457aa64bba

      SHA1

      684338bd758a92449d43c49a0aa539f323760215

      SHA256

      f4e76abf0df055fae97863708412773b51197bae0ddd9692a9509e824d847df0

      SHA512

      21002b3b3cd01beb923692addaef4e5d0fcbee972154e25bea2c4ece591185bf8e6221959fbcc772fc7e7f73dce18747909dcd9c04423a0ade70f6cfba72f135

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\sibtask.xml
      Filesize

      3KB

      MD5

      331691375e3eb33ed12214c26797c23f

      SHA1

      3719bd8407dcc0a40f5d9eedc927eea80d0ef9e4

      SHA256

      2ffd12fcc5e8c87af2f14605602e8602dcfa2d5638ad6bd690e0a1014fe2c772

      SHA512

      e002ce601db8cb4a3ad3ce02812752f5c547739df2aa2501de248899775a939a7a6652a3695a0a56b6cc3b2d599230f3278f1d8fad19066be30ee0ddedc2d7ff

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\startscreen\desktop.ini
      Filesize

      80B

      MD5

      8011052ff701a0c4439ee18450e8e51d

      SHA1

      a4893c2482522ccc3dee1c95ce644d8e1090d6ae

      SHA256

      b901f0d5c24c25f334690f540b2a62d3e9c76226bdc183d45422e3237cc36051

      SHA512

      c1712b4ea2fb42f38e76adaed613890f5e707a1ca495c87da506d423b3141a463fff034b1ae80824f6f8db776a9181f27d5f3f5a6cb94a1ab87ac0babe10d2c9

      Download Submit

    • \Users\Admin\AppData\Local\Temp\nsjDC87.tmp\LangDLL.dll
      Filesize

      5KB

      MD5

      109b201717ab5ef9b5628a9f3efef36f

      SHA1

      98db1f0cc5f110438a02015b722778af84d50ea7

      SHA256

      20e642707ef82852bcf153254cb94b629b93ee89a8e8a03f838eef6cbb493319

      SHA512

      174e241863294c12d0705c9d2de92f177eb8f3d91125b183d8d4899c89b9a202a4c7a81e0a541029a4e52513eee98029196a4c3b8663b479e69116347e5de5b4

      Download Submit

    • \Users\Admin\AppData\Local\Temp\nsjDC87.tmp\System.dll
      Filesize

      12KB

      MD5

      8cf2ac271d7679b1d68eefc1ae0c5618

      SHA1

      7cc1caaa747ee16dc894a600a4256f64fa65a9b8

      SHA256

      6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba

      SHA512

      ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3

      Download Submit

    • \Users\Admin\AppData\Local\Temp\nsjDC87.tmp\nsDialogs.dll
      Filesize

      9KB

      MD5

      ec9640b70e07141febbe2cd4cc42510f

      SHA1

      64a5e4b90e5fe62aa40e7ac9e16342ed066f0306

      SHA256

      c5ba017732597a82f695b084d1aa7fe3b356168cc66105b9392a9c5b06be5188

      SHA512

      47605b217313c7fe6ce3e9a65da156a2fba8d91e4ed23731d3c5e432dd048ff5c8f9ae8bb85a6a39e1eac4e1b6a22862aa72d3b1b1c8255858997cdd4db5d1fe

      Download Submit

    • \Users\Admin\AppData\Local\Temp\nsjDC87.tmp\registry.dll
      Filesize

      24KB

      MD5

      2b7007ed0262ca02ef69d8990815cbeb

      SHA1

      2eabe4f755213666dbbbde024a5235ddde02b47f

      SHA256

      0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d

      SHA512

      aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca

      Download Submit

    • memory/4784-97-0x0000000000E10000-0x0000000000E11000-memory.dmp

      Filesize

      4KB

      Download

    • memory/5072-100-0x000001D791800000-0x000001D791900000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/5072-101-0x000001D791800000-0x000001D791900000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/5072-99-0x000001D791800000-0x000001D791900000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/5072-104-0x000001D791DE0000-0x000001D791E00000-memory.dmp

      Filesize

      128KB

      Download

    • memory/5072-125-0x000001D791F60000-0x000001D791F80000-memory.dmp

      Filesize

      128KB

      Download

    • memory/5092-65-0x0000000000400000-0x0000000000653000-memory.dmp

      Filesize

      2.3MB

      Download

    • memory/5092-63-0x0000000000400000-0x0000000000653000-memory.dmp

      Filesize

      2.3MB

      Download

    • memory/5092-31-0x0000000002350000-0x0000000002351000-memory.dmp

      Filesize

      4KB

      Download