File name:

StartIsBackPlusPlus_setup.exe

Full analysis: https://app.any.run/tasks/51229ad6-2e22-47da-bf5f-39efc2ee3f8e
Verdict: Malicious activity
Analysis date: July 06, 2024, 18:36:37
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

6E1869386AFD5769243E01C746EC7206

SHA1:

41724D13D5A4F124C5C93B468A243CEBD3BBD102

SHA256:

7EE8C845568B8787C7930152925A05682BE54FCD866C46D6EF54BD137E1C9FD2

SSDEEP:

49152:Il5ajcYw9AqB4+tKm2BflZSgfmr2NQ16KAIky7OTMtMHM4ldr+K/ibAM+qzYWa3s:S5ajE9LBtKfzSn6YkQQE+1bKbAsDQd8P

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • StartIsBackPlusPlus_setup.exe (PID: 2648)
      • StartIsBackCfg.exe (PID: 640)

    • Uses Task Scheduler to run other applications

      • StartIsBackCfg.exe (PID: 640)
      • StartIsBackCfg.exe (PID: 4104)
      • StartIsBackCfg.exe (PID: 2104)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • StartIsBackPlusPlus_setup.exe (PID: 2648)
      • StartIsBackCfg.exe (PID: 640)
      • OneDriveSetup.exe (PID: 6692)

    • Reads the date of Windows installation

      • StartIsBackPlusPlus_setup.exe (PID: 2648)
      • StartIsBackCfg.exe (PID: 1972)
      • StartScreen.exe (PID: 5048)
      • StartMenuExperienceHost.exe (PID: 6588)
      • StartScreen.exe (PID: 5020)
      • SearchApp.exe (PID: 6788)
      • StartScreen.exe (PID: 4632)

    • Reads security settings of Internet Explorer

      • StartIsBackCfg.exe (PID: 1972)
      • StartIsBackPlusPlus_setup.exe (PID: 2648)
      • StartIsBackCfg.exe (PID: 640)
      • StartIsBackCfg.exe (PID: 4104)
      • StartIsBackCfg.exe (PID: 2104)
      • StartScreen.exe (PID: 5048)
      • StartMenuExperienceHost.exe (PID: 6588)
      • StartIsBackCfg.exe (PID: 1592)
      • StartScreen.exe (PID: 4632)
      • StartScreen.exe (PID: 5020)
      • LockApp.exe (PID: 5656)

    • Application launched itself

      • StartIsBackCfg.exe (PID: 1972)
      • StartIsBackCfg.exe (PID: 1152)
      • ie4uinit.exe (PID: 7952)
      • setup.exe (PID: 8584)
      • setup.exe (PID: 8644)
      • setup.exe (PID: 8764)
      • setup.exe (PID: 10056)
      • setup.exe (PID: 10000)
      • OneDriveSetup.exe (PID: 10316)

    • Uses TASKKILL.EXE to kill process

      • StartIsBackCfg.exe (PID: 640)
      • StartIsBackCfg.exe (PID: 4104)
      • StartIsBackCfg.exe (PID: 2104)

    • Creates a software uninstall entry

      • StartIsBackCfg.exe (PID: 640)
      • StartIsBackCfg.exe (PID: 4104)
      • StartIsBackCfg.exe (PID: 2104)

    • Creates/Modifies COM task schedule object

      • StartIsBackCfg.exe (PID: 640)
      • StartIsBackCfg.exe (PID: 4104)
      • StartIsBackCfg.exe (PID: 2104)

    • Changes default file association

      • StartIsBackCfg.exe (PID: 640)
      • StartIsBackCfg.exe (PID: 4104)
      • StartIsBackCfg.exe (PID: 2104)

    • Write to the desktop.ini file (may be used to cloak folders)

      • StartScreen.exe (PID: 5048)
      • StartScreen.exe (PID: 4632)
      • StartScreen.exe (PID: 5020)

    • Checks Windows Trust Settings

      • StartIsBackCfg.exe (PID: 1592)

    • The process executes via Task Scheduler

      • PLUGScheduler.exe (PID: 7708)
      • StartScreen.exe (PID: 7712)

    • Uses RUNDLL32.EXE to load library

      • ie4uinit.exe (PID: 7256)

    • Process drops legitimate windows executable

      • OneDriveSetup.exe (PID: 6692)

    • The process drops C-runtime libraries

      • OneDriveSetup.exe (PID: 6692)

  • INFO

    • Reads the computer name

      • StartIsBackPlusPlus_setup.exe (PID: 2648)
      • StartIsBackCfg.exe (PID: 1972)
      • StartIsBackCfg.exe (PID: 2104)
      • StartIsBackCfg.exe (PID: 640)
      • StartIsBackCfg.exe (PID: 4104)
      • StartScreen.exe (PID: 5048)
      • StartMenuExperienceHost.exe (PID: 6588)
      • TextInputHost.exe (PID: 5624)
      • SearchApp.exe (PID: 6788)
      • UpdateCheck.exe (PID: 5300)
      • StartIsBackCfg.exe (PID: 1152)
      • StartIsBackCfg.exe (PID: 1592)
      • StartScreen.exe (PID: 4632)
      • StartScreen.exe (PID: 5020)
      • LockApp.exe (PID: 5656)

    • Checks supported languages

      • StartIsBackPlusPlus_setup.exe (PID: 2648)
      • StartIsBackCfg.exe (PID: 1972)
      • StartIsBackCfg.exe (PID: 2104)
      • StartIsBackCfg.exe (PID: 4104)
      • StartIsBackCfg.exe (PID: 640)
      • startscreen.exe (PID: 6792)
      • startscreen.exe (PID: 5692)
      • startscreen.exe (PID: 6284)
      • StartScreen.exe (PID: 5048)
      • TextInputHost.exe (PID: 5624)
      • StartMenuExperienceHost.exe (PID: 6588)
      • SearchApp.exe (PID: 6788)
      • UpdateCheck.exe (PID: 5300)
      • StartIsBackCfg.exe (PID: 1592)
      • StartIsBackCfg.exe (PID: 1152)
      • StartScreen.exe (PID: 4632)
      • StartScreen.exe (PID: 5020)
      • LockApp.exe (PID: 5656)

    • Create files in a temporary directory

      • StartIsBackPlusPlus_setup.exe (PID: 2648)
      • StartIsBackCfg.exe (PID: 640)
      • StartIsBackCfg.exe (PID: 4104)
      • StartIsBackCfg.exe (PID: 2104)
      • StartScreen.exe (PID: 5048)
      • StartScreen.exe (PID: 4632)
      • StartScreen.exe (PID: 5020)

    • Process checks computer location settings

      • StartIsBackPlusPlus_setup.exe (PID: 2648)
      • StartIsBackCfg.exe (PID: 1972)
      • StartMenuExperienceHost.exe (PID: 6588)
      • SearchApp.exe (PID: 6788)

    • Creates files in the program directory

      • StartIsBackCfg.exe (PID: 640)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 4540)

    • Reads Microsoft Office registry keys

      • explorer.exe (PID: 4540)

    • Creates files or folders in the user directory

      • explorer.exe (PID: 4540)
      • StartIsBackCfg.exe (PID: 1592)

    • Checks proxy server information

      • SearchApp.exe (PID: 6788)
      • explorer.exe (PID: 4540)
      • StartIsBackCfg.exe (PID: 1592)

    • Reads the software policy settings

      • UpdateCheck.exe (PID: 5300)
      • SearchApp.exe (PID: 6788)
      • StartIsBackCfg.exe (PID: 1592)

    • Reads the machine GUID from the registry

      • SearchApp.exe (PID: 6788)
      • StartIsBackCfg.exe (PID: 1592)

    • Reads Environment values

      • SearchApp.exe (PID: 6788)

    • Process checks Internet Explorer phishing filters

      • SearchApp.exe (PID: 6788)

    • Manual execution by a user

      • FirstLogonAnim.exe (PID: 7988)
      • unregmp2.exe (PID: 7732)
      • ie4uinit.exe (PID: 7952)
      • chrmstp.exe (PID: 8428)
      • unregmp2.exe (PID: 8400)
      • setup.exe (PID: 8584)
      • StartScreen.exe (PID: 10012)
      • StartIsBackCfg.exe (PID: 9344)
      • OneDriveSetup.exe (PID: 10316)
      • msedge.exe (PID: 10332)
      • wab.exe (PID: 6908)
      • UpdateCheck.exe (PID: 9340)
      • fsquirt.exe (PID: 11104)

    • Application launched itself

      • chrmstp.exe (PID: 8428)
      • chrmstp.exe (PID: 8488)
      • msedge.exe (PID: 8828)

    • Drops the executable file immediately after the start

      • OneDriveSetup.exe (PID: 6692)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:05:08 19:27:11+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 32256
InitializedDataSize: 55808
UninitializedDataSize: -
EntryPoint: 0x1741
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.1000
ProductVersionNumber: 1.0.0.1000
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: www.startisback.com
FileDescription: StartIsBack++ setup SFX
FileVersion: 1.0.0
LegalCopyright: Copyright (C) 2012-2017, Tihiy
OriginalFileName: 7-zip SfxSetup.exe
ProductName: StartIsBack
ProductVersion: 1.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
350
Monitored processes
136
Malicious processes
8
Suspicious processes
4

Behavior graph

Click at the process to see the details
start startisbackplusplus_setup.exe startisbackcfg.exe no specs startisbackcfg.exe startisbackcfg.exe startisbackcfg.exe startscreen.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs sppextcomobj.exe no specs slui.exe no specs startscreen.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs startscreen.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs explorer.exe startscreen.exe no specs textinputhost.exe no specs startmenuexperiencehost.exe no specs tiworker.exe no specs searchapp.exe updatecheck.exe startisbackcfg.exe no specs mobsync.exe no specs startisbackcfg.exe startscreen.exe no specs startscreen.exe no specs lockapp.exe no specs plugscheduler.exe no specs slui.exe no specs slui.exe no specs firstlogonanim.exe no specs unregmp2.exe no specs ie4uinit.exe no specs ie4uinit.exe no specs startscreen.exe no specs rundll32.exe no specs rundll32.exe no specs unregmp2.exe no specs chrmstp.exe no specs chrmstp.exe no specs chrmstp.exe no specs chrmstp.exe no specs setup.exe no specs setup.exe no specs setup.exe no specs setup.exe no specs setup.exe no specs setup.exe no specs msedge.exe no specs User OOBE Create Elevated Object Server no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs setup.exe no specs setup.exe no specs setup.exe no specs setup.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs startscreen.exe no specs textinputhost.exe no specs updatecheck.exe no specs startisbackcfg.exe no specs startmenuexperiencehost.exe no specs searchapp.exe no specs wwahost.exe no specs msedge.exe no specs User OOBE Create Elevated Object Server no specs fsquirt.exe no specs onedrivesetup.exe no specs msedge.exe no specs wab.exe no specs mobsync.exe no specs onedrivesetup.exe

Process information

PID
CMD
Path
Indicators
Parent process
444\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
640"C:\Users\admin\AppData\Local\Temp\SIBSFX.CF94FA58\StartIsBackCfg.exe" /install /elevatedC:\Users\admin\AppData\Local\Temp\SIBSFX.CF94FA58\StartIsBackCfg.exe
StartIsBackCfg.exe
User:
admin
Integrity Level:
HIGH
Description:
StartIsBack configuration
Exit code:
0
Version:
5.9.20.3594
Modules
Images
c:\users\admin\appdata\local\temp\sibsfx.cf94fa58\startisbackcfg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
740schtasks.exe /Create /TN "\StartIsBack health check" /XML "C:\Users\admin\AppData\Local\Temp\sibtask.xml"C:\Windows\SysWOW64\schtasks.exe—StartIsBackCfg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
776taskkill.exe /F /IM explorer*C:\Windows\SysWOW64\taskkill.exe—StartIsBackCfg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
900\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
900"C:\WINDOWS\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mcaC:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe—svchost.exe
User:
Administrator
Integrity Level:
HIGH
1076taskkill.exe /F /IM explorer*C:\Windows\SysWOW64\taskkill.exe—StartIsBackCfg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1152"C:\Program Files (x86)\StartIsBack\StartIsBackCfg.exe" /welcomeC:\Program Files (x86)\StartIsBack\StartIsBackCfg.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
StartIsBack configuration
Exit code:
0
Version:
5.9.20.3594
Modules
Images
c:\program files (x86)\startisback\startisbackcfg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\oleaut32.dll
c:\windows\syswow64\msvcp_win.dll
1324\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1384\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
85 784
Read events
85 074
Write events
627
Delete events
83

Modification events

(PID) Process:(1972) StartIsBackCfg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1972) StartIsBackCfg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1972) StartIsBackCfg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1972) StartIsBackCfg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(640) StartIsBackCfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\StartIsBack
Operation:writeName:InstallLocation
Value:
C:\Program Files (x86)\StartIsBack\
(PID) Process:(640) StartIsBackCfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\StartIsBack
Operation:writeName:Publisher
Value:
startisback.com
(PID) Process:(640) StartIsBackCfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\StartIsBack
Operation:writeName:NoModify
Value:
1
(PID) Process:(640) StartIsBackCfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\StartIsBack
Operation:writeName:NoRepair
Value:
1
(PID) Process:(640) StartIsBackCfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\StartIsBack
Operation:writeName:DisplayName
Value:
StartIsBack++
(PID) Process:(640) StartIsBackCfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\StartIsBack
Operation:writeName:DisplayIcon
Value:
C:\Program Files (x86)\StartIsBack\StartIsBackCfg.exe,0
Executable files
139
Suspicious files
350
Text files
338
Unknown types
81

Dropped files

PID
Process
Filename
Type
2648StartIsBackPlusPlus_setup.exeC:\Users\admin\AppData\Local\Temp\SIBSFX.CF94FA58\StartIsBack32.dllexecutable
MD5:075826B376A9D9EC86DA0D7A8FC812AB
SHA256:8C2A79ECCE2FB5780ED6A4726B338707864E55B4223FD9920AF45262A6C602B1
640StartIsBackCfg.exeC:\Program Files (x86)\StartIsBack\StartIsBack32.dllexecutable
MD5:075826B376A9D9EC86DA0D7A8FC812AB
SHA256:8C2A79ECCE2FB5780ED6A4726B338707864E55B4223FD9920AF45262A6C602B1
2648StartIsBackPlusPlus_setup.exeC:\Users\admin\AppData\Local\Temp\SIBSFX.CF94FA58\Orbs\Windows 7.orbexecutable
MD5:85328E698E8A74852B4061A683915DC8
SHA256:E5B74E9E7BD6758A0154B11462AE3328EDD143190865198104D8BD53B9AF7275
2648StartIsBackPlusPlus_setup.exeC:\Users\admin\AppData\Local\Temp\SIBSFX.CF94FA58\StartIsBack64.dllexecutable
MD5:1A8A24F517784EA606F42CD104EA55F8
SHA256:458BFA42D621A2F28CF61241637503D970D3D9B7AF9E592D9930A1B6636B3F3A
2648StartIsBackPlusPlus_setup.exeC:\Users\admin\AppData\Local\Temp\SIBSFX.CF94FA58\StartIsBackCfg.exeexecutable
MD5:D7A319AD8F2493C97B09B3F8C878A76B
SHA256:5F69D9E29CDFDFFA73C9B24BB401C4284BEE06BD715B70CFDC124530E6650701
640StartIsBackCfg.exeC:\Program Files (x86)\StartIsBack\StartIsBack64.dllexecutable
MD5:1A8A24F517784EA606F42CD104EA55F8
SHA256:458BFA42D621A2F28CF61241637503D970D3D9B7AF9E592D9930A1B6636B3F3A
2648StartIsBackPlusPlus_setup.exeC:\Users\admin\AppData\Local\Temp\SIBSFX.CF94FA58\Orbs\StartIsBack_Ei8htOrb_v2_by_PainteR.bmpimage
MD5:641328C75E6B117545211DB22DAFCAA0
SHA256:76A72C9AD77843B58223DD588483AC1265A31C15AAEB47EE66D1925DE787644B
2648StartIsBackPlusPlus_setup.exeC:\Users\admin\AppData\Local\Temp\SIBSFX.CF94FA58\UpdateCheck.exeexecutable
MD5:4C6EBCDDB218E4C62CD12B930A5894C9
SHA256:1A28AC87C0F2AFF7BA63B38F43B05AEA45D03C31096E6525DF9E880D44F6AD96
640StartIsBackCfg.exeC:\Program Files (x86)\StartIsBack\StartIsBackCfg.exeexecutable
MD5:D7A319AD8F2493C97B09B3F8C878A76B
SHA256:5F69D9E29CDFDFFA73C9B24BB401C4284BEE06BD715B70CFDC124530E6650701
2648StartIsBackPlusPlus_setup.exeC:\Users\admin\AppData\Local\Temp\SIBSFX.CF94FA58\Styles\Plain10.msstylesexecutable
MD5:A69385279536210958FB9C86CAB229D6
SHA256:3955FC60D3B7C4A1BADD831FDE82269261407CF9D459C65B429E8ABC769ADEED
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
91
DNS requests
51
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3760
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
2492
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
2208
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
4264
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
2492
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
1592
StartIsBackCfg.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/rootr3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT1nGh%2FJBjWKnkPdZIzB1bqhelHBwQUj%2FBLf6guRSSuTVD6Y5qL3uLdG7wCEHgDGEJFcIpBz28BuO60qVQ%3D
unknown
—
—
unknown
1592
StartIsBackCfg.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/codesigningrootr45/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQVFZP5vqhCrtRN5SWf40Rn6NM1IAQUHwC%2FRoAK%2FHg5t6W0Q9lWULvOljsCEHe9DgOhtwj4VKsGchDZBEc%3D
unknown
—
—
unknown
1592
StartIsBackCfg.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/gsgccr45codesignca2020/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBTLuA3ygnKW%2F7xuSx%2F09F%2BhHVuEUQQU2rONwCSQo2t30wygWd0hZ2R2C3gCDCDBiIDOtWEZZFv2fw%3D%3D
unknown
—
—
unknown
—
—
GET
200
23.53.42.131:80
http://assets.msn.com/staticsb/statics/latest/fre/version.json
unknown
—
—
unknown
—
—
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1776
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2868
RUXIMICS.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6004
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4656
SearchApp.exe
104.126.37.128:443
www.bing.com
Akamai International B.V.
DE
unknown
3760
svchost.exe
40.126.32.72:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
3760
svchost.exe
192.229.221.95:80
—
EDGECAST
US
whitelisted
1060
svchost.exe
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
unknown
3040
OfficeClickToRun.exe
52.111.227.11:443
nexusrules.officeapps.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
  • 40.127.240.158
whitelisted
www.bing.com
  • 104.126.37.128
  • 104.126.37.123
  • 104.126.37.178
  • 104.126.37.136
  • 104.126.37.139
  • 104.126.37.153
  • 104.126.37.171
  • 104.126.37.144
  • 104.126.37.177
  • 104.126.37.130
  • 104.126.37.170
  • 104.126.37.160
  • 104.126.37.131
  • 104.126.37.155
  • 104.126.37.163
  • 104.126.37.145
  • 104.126.37.154
whitelisted
login.live.com
  • 40.126.32.72
  • 40.126.32.136
  • 40.126.32.68
  • 40.126.32.134
  • 20.190.160.20
  • 20.190.160.14
  • 40.126.32.133
  • 40.126.32.76
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.11
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
arc.msn.com
  • 20.223.36.55
  • 20.103.156.88
  • 20.74.47.205
whitelisted
fd.api.iris.microsoft.com
  • 20.223.36.55
whitelisted
r.bing.com
  • 104.126.37.171
  • 104.126.37.139
  • 104.126.37.178
  • 104.126.37.136
  • 104.126.37.170
  • 104.126.37.130
  • 104.126.37.186
  • 104.126.37.131
  • 104.126.37.144
  • 2.23.209.148
  • 2.23.209.130
  • 2.23.209.185
  • 2.23.209.149
  • 2.23.209.133
  • 2.23.209.187
  • 2.23.209.193
  • 2.23.209.140
  • 2.23.209.189
whitelisted
www.startisback.com
  • 141.8.194.242
unknown

Threats

No threats detected
Process
Message
explorer.exe
Purging StartIsBack cache directory
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
StartIsBackPlusPlus_setup.exe