Analysis
- user interaction
yes - max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/10/2026, 22:27
Static task
static1
Behavioral task
behavioral1
Sample
StartAllBack_3.9.28_setup.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
StartAllBack_3.9.28_setup.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
23 signatures
150 seconds
General
- Target StartAllBack_3.9.28_setup.exe
- Size 2.0MB
- Sample261027-2datrsxsfv
- SHA256 a760f333f6e3305e7f0e4a09982da129d01003752aa2260513a583f5e5be7b29
- MD5 7ad3fd9adf57785b53b79210bd23d0f8
- SHA1 832a8bd4917815effb22efbd18fad5ca75e7394a
- SHA512 e9da9528578c51a01be39b6a98989b91e767360816be7ecfb7427cdf075bbe2761dd32cf9952dbb2c60eb246476a814038cc888596d649f81c5ce4ab356bc054
- SSDEEP 49152:FxTtsmt/gJsaC0qflpMyzwlGnCcyJX3ZnEYScrPRLTE:r2mtYCh0apwhcy5pnEYT5Lg
- TLSH T15FA523C3934AADF4F92D96304066A73C01A39EDD67D301E3928FBD120FA5B8C19F5A95
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation StartAllBack_3.9.28_setup.exe - Executes dropped EXE 1 IoCs
pid Process 1032 StartAllBackCfg.exe - Loads dropped DLL 1 IoCs
pid Process 1032 StartAllBackCfg.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe - Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "20" LogonUI.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3296 taskmgr.exe Token: SeSystemProfilePrivilege 3296 taskmgr.exe Token: SeCreateGlobalPrivilege 3296 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1032 StartAllBackCfg.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe 3296 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 864 LogonUI.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3900 wrote to memory of 1032 3900 StartAllBack_3.9.28_setup.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\StartAllBack_3.9.28_setup.exe"C:\Users\Admin\AppData\Local\Temp\StartAllBack_3.9.28_setup.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\SIBSFX.85135F3C\StartAllBackCfg.exe"C:\Users\Admin\AppData\Local\Temp\SIBSFX.85135F3C\StartAllBackCfg.exe" /install2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:1032
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3296
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa38ce055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:864
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.85135F3C\StartAllBackCfg.exe
- Size 3.4MB
- SHA256 a3a991e6d2e3da056eb4dbfcb5c560f78ae8511e4c44835ea03003f29cc64eca
- MD5 2d2e1e21a934f227171b4f9cca8aec58
- SHA1 de45445a8e736f79ce2f875f848f6213adbb2f8a
- SHA512 2432eaec2f8af2127963b789ba282477d45f6cfe1ee5d0a129d116c248c9f78af79d1bb96fb167035c9dafde3873cf77c8b0334f6b717d6c0c75da6adc76532b
- SSDEEP 24576:YNagaJo1yfyuH9h36hoyGSGmhhAUg68q54emrW7EF+oB:YcgaJRTH9hKhoyHhX8K4PxB
- TLSH T167F5B563A7F68128F1BB9B75D9B287604A33BC656FB6C1DF1280014D09B4AC48DB5B73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.85135F3C\StartAllBackX64.dll
- Size 1.0MB
- SHA256 8c26c72247204d98c2ae3a092bfbe964430d387ea56663f3760ef118f214e1b7
- MD5 ffb5079a80d62ebb5662a78e7f54d488
- SHA1 016b9aafa39b69eec2d9c881ae2f0f87b65aff13
- SHA512 5f5ff4797a70d3fe9c840aa4686a6afd75da36d23cb73b4ba9e2e2e2499a355fcf50341ea8220244abaf8463bafb1f5da9fa24905b0ead6311570f1dd61da64c
- SSDEEP 24576:bjfa2nvOvuLI5uOp5/i2mUDeFdziYUNeg/vzbe+6PKRw:bjC2vOvusAO3arUSFdu6+fxxRw
- TLSH T19E253A0673F80198F2B79675DE779A17DBB2B8862A30C60F0194865D3F33771993A722
- MD5 SHA1 SHA512 SSDEEP TLSH