Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Update-KB6125-x86.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	3.026022558665777
Filename:	Update-KB6125-x86.exe
Filesize:	648151
MD5:	d8cbdb14f06554b20694184c4738cc30
SHA1:	2b0d31ff5e50d57af9190e6e24795fee47014a38
SHA256:	765039963bf7c037a21bda34ee18f31d1cc3cf27547dd8daaa6f213de85a58ca
SHA512:	27685f02a62fee77c3f79a5389d7c4eb337c4ca677177adb8c0f548d0d279ae73b1fabaf7deab5822065412e2d4a9c85069804545e0e0572240c2366585714f9
SSDEEP:	3072:DFZ5qVGXvEQU+dXmEUy9rfe3kUdKSh7hKNjf7CwhqjEr8IcGN8yGBYPosqkxOqop:JjqVG/pJZzfwsGX+LOODsKO
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............fr..fr..fr..n...fr..j}..fr..n/..fr.jn/..fr..fs.wfr..j-..fr..j...fr..m,..fr..j(..fr.Rich.fr.................PE..L... ?.E...

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Contains functionality to inject threads in other processes	HIPS / PFW / Operating System Protection Evasion
Detected PE file pumping (to bypass AV & sandboxing)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion Security Software Discovery
Drops executables to the windows directory (C:\Windows) and starts them	Persistence and Installation Behavior
Machine Learning detection for sample	AV Detection
Contains functionality for execution timing, often used to detect debuggers	Malware Analysis System Evasion, Anti Debugging
Contains functionality to communicate with device drivers	System Summary
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging
Contains functionality to query locales information (e.g. system language)	Language, Device and Operating System Detection	Access Token Manipulation
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging
Creates files inside the system directory	System Summary	Masquerading
Detected potential crypto function	System Summary	Access Token Manipulation Process Discovery Archive Collected Data Encrypted Channel
Drops PE files	Persistence and Installation Behavior	Access Token Manipulation
Drops PE files to the windows directory (C:\Windows)	Persistence and Installation Behavior	File and Directory Discovery
Extensive use of GetProcAddress (often used to hide API calls)	Hooking and other Techniques for Hiding and Protection
Found evasive API chain (may stop execution after checking a module file name)	Malware Analysis System Evasion	Access Token Manipulation
Found evasive API chain checking for process token information	Malware Analysis System Evasion	Native API Access Token Manipulation Process Discovery
Found large amount of non-executed APIs	Malware Analysis System Evasion	Access Token Manipulation
Found potential string decryption / allocating functions	System Summary	Deobfuscate/Decode Files or Information Obfuscated Files or Information
Uses 32bit PE files	Compliance, System Summary
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation
Contains functionality to adjust token privileges (e.g. debug / backup)	System Summary	Access Token Manipulation
Contains functionality to create a new security descriptor	HIPS / PFW / Operating System Protection Evasion	Access Token Manipulation
Contains functionality to enum processes or threads	System Summary	Access Token Manipulation Process Discovery
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion	File and Directory Discovery
Contains functionality to load and extract PE file embedded resources	System Summary
Contains functionality to modify the execution of threads in other processes		Access Token Manipulation
Contains functionality to query local / system time	Language, Device and Operating System Detection	Access Token Manipulation System Time Discovery
Contains functionality to query system information	Malware Analysis System Evasion
Contains functionality to query time zone information	Language, Device and Operating System Detection	Access Token Manipulation
Contains functionality to query windows version	Language, Device and Operating System Detection	System Information Discovery
Contains functionality to register its own exception handler	Anti Debugging
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
PE file has an executable .text section and no other executable section	System Summary	Access Token Manipulation
Program exit points	Malware Analysis System Evasion
Reads software policies	System Summary	Access Token Manipulation
Sample is known by Antivirus	System Summary	Access Token Manipulation
Sample reads its own file content	System Summary	Access Token Manipulation
Tries to load missing DLLs	System Summary	DLL Side-Loading

C:\Windows\tserv.exe

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

Details

File:	C:\Windows\tserv.exe
Category:	dropped
Dump:	tserv.exe.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Users\user\Desktop\Update-KB6125-x86.exe
Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	3.026022558665777
Encrypted:	false
Ssdeep:	3072:DFZ5qVGXvEQU+dXmEUy9rfe3kUdKSh7hKNjf7CwhqjEr8IcGN8yGBYPosqkxOqop:JjqVG/pJZzfwsGX+LOODsKO
Size:	648151
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for dropped file	AV Detection
Creates an undocumented autostart registry key	Boot Survival	Registry Run Keys / Startup Folder
Drops executables to the windows directory (C:\Windows) and starts them	Persistence and Installation Behavior	Masquerading
Machine Learning detection for dropped file	AV Detection
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Creates files inside the system directory	System Summary	Masquerading
Drops PE files	Persistence and Installation Behavior
Drops PE files to the windows directory (C:\Windows)	Persistence and Installation Behavior	Masquerading
Sample execution stops while process was sleeping (likely an evasion)	Malware Analysis System Evasion
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification	System Summary
Sigma detected: Wow6432Node Windows NT CurrentVersion Autorun Keys Modification	System Summary
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Creates an autostart registry key	Boot Survival	Registry Run Keys / Startup Folder
Creates mutexes	System Summary
Spawns processes	System Summary	Process Injection
Tries to load missing DLLs	System Summary	DLL Side-Loading

C:\Windows\tserv.exe:Zone.Identifier

ASCII text, with CRLF line terminators

modified

Details

File:	C:\Windows\tserv.exe:Zone.Identifier
Category:	modified
Dump:	tserv.exe_Zone.Identifier.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\Update-KB6125-x86.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	3.95006375643621
Encrypted:	false
Ssdeep:	3:ggPYV:rPYV
Size:	26
Whitelisted:	false
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for dropped file	AV Detection
Creates an undocumented autostart registry key	Boot Survival	Registry Run Keys / Startup Folder
Machine Learning detection for dropped file	AV Detection
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Sample execution stops while process was sleeping (likely an evasion)	Malware Analysis System Evasion
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Creates an autostart registry key	Boot Survival	Registry Run Keys / Startup Folder
Creates mutexes	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\Update-KB6125-x86.exe

"C:\Users\user\Desktop\Update-KB6125-x86.exe"

Details

Is windows:	false
Is dropped:	false
PID:	7256
Target ID:	0
Parent PID:	2580
Name:	Update-KB6125-x86.exe
Path:	C:\Users\user\Desktop\Update-KB6125-x86.exe
Commandline:	"C:\Users\user\Desktop\Update-KB6125-x86.exe"
Size:	648151
MD5:	D8CBDB14F06554B20694184C4738CC30
Time:	06:20:30
Date:	22/12/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	413696
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Detected PE file pumping (to bypass AV & sandboxing)	Malware Analysis System Evasion	Security Software Discovery Virtualization/Sandbox Evasion
Machine Learning detection for sample	AV Detection
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
Spawns processes	System Summary	Process Injection

C:\Windows\tserv.exe

C:\Windows\tserv.exe s

Details

Is windows:	false
Is dropped:	true
PID:	7312
Target ID:	1
Parent PID:	7256
Name:	tserv.exe
Path:	C:\Windows\tserv.exe
Commandline:	C:\Windows\tserv.exe s
Size:	648151
MD5:	D8CBDB14F06554B20694184C4738CC30
Time:	06:20:35
Date:	22/12/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	413696
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Drops executables to the windows directory (C:\Windows) and starts them	Persistence and Installation Behavior	Masquerading
Creates files inside the system directory	System Summary	Masquerading
Drops PE files	Persistence and Installation Behavior
Drops PE files to the windows directory (C:\Windows)	Persistence and Installation Behavior	Masquerading
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification	System Summary
Sigma detected: Wow6432Node Windows NT CurrentVersion Autorun Keys Modification	System Summary
Spawns processes	System Summary	Process Injection

C:\Windows\tserv.exe

"C:\Windows\tserv.exe" s

Details

Is windows:	false
Is dropped:	true
PID:	7700
Target ID:	5
Parent PID:	2580
Name:	tserv.exe
Path:	C:\Windows\tserv.exe
Commandline:	"C:\Windows\tserv.exe" s
Size:	648151
MD5:	D8CBDB14F06554B20694184C4738CC30
Time:	06:20:58
Date:	22/12/2024
Reason:	newprocess
Reputation:	low
Is admin:	false
Is elevated:	false
Modulebase:	0x400000
Modulesize:	413696
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Drops executables to the windows directory (C:\Windows) and starts them	Persistence and Installation Behavior	Masquerading
Creates files inside the system directory	System Summary	Masquerading
Drops PE files	Persistence and Installation Behavior
Drops PE files to the windows directory (C:\Windows)	Persistence and Installation Behavior	Masquerading
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification	System Summary
Sigma detected: Wow6432Node Windows NT CurrentVersion Autorun Keys Modification	System Summary
Spawns processes	System Summary	Process Injection

Domains

Name

Malicious

mta6.am0.yahoodns.net

67.195.204.73

alt3.gmail-smtp-in.l.google.com

142.250.141.26

alt4.gmail-smtp-in.l.google.com

192.178.128.26

mta7.am0.yahoodns.net

67.195.228.110

gmail-smtp-in.l.google.com

209.85.233.26

mta5.am0.yahoodns.net

67.195.204.72

www4.cedesunjerinkas.com

193.166.255.171

alt1.gmail-smtp-in.l.google.com

142.250.157.26

alt2.gmail-smtp-in.l.google.com

173.194.202.27

hotmail-com.olc.protection.outlook.com

52.101.73.23

hotmail.com

unknown

gmail.com

unknown

yahoo.com

unknown

There are 3 hidden domains, click here to show them.

IPs

Domain

Country

Malicious

142.250.141.26

alt3.gmail-smtp-in.l.google.com

United States

Details

IP:	142.250.141.26
TargetID:	1
Current Path:	C:\Windows\tserv.exe
Country:	United States
Countrycode:	USA
ASN number:	15169
ASN name:	GOOGLEUS
Private:	false
Domain:	alt3.gmail-smtp-in.l.google.com

Signature Hits	Behavior Group	Mitre Attack
Uses SMTP (mail sending)	Networking	Application Layer Protocol

193.166.255.171

www4.cedesunjerinkas.com

Finland

Details

IP:	193.166.255.171
TargetID:	1
Current Path:	C:\Windows\tserv.exe
Country:	Finland
Countrycode:	FIN
ASN number:	1741
ASN name:	FUNETASFI
Private:	false
Domain:	www4.cedesunjerinkas.com

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts with low severity for network traffic	Networking

142.250.157.26

alt1.gmail-smtp-in.l.google.com

United States

Details

IP:	142.250.157.26
TargetID:	1
Current Path:	C:\Windows\tserv.exe
Country:	United States
Countrycode:	USA
ASN number:	15169
ASN name:	GOOGLEUS
Private:	false
Domain:	alt1.gmail-smtp-in.l.google.com

Signature Hits	Behavior Group	Mitre Attack
Uses SMTP (mail sending)	Networking	Application Layer Protocol

173.194.202.27

alt2.gmail-smtp-in.l.google.com

United States

Details

IP:	173.194.202.27
TargetID:	1
Current Path:	C:\Windows\tserv.exe
Country:	United States
Countrycode:	USA
ASN number:	15169
ASN name:	GOOGLEUS
Private:	false
Domain:	alt2.gmail-smtp-in.l.google.com

Signature Hits	Behavior Group	Mitre Attack
Uses SMTP (mail sending)	Networking	Application Layer Protocol

67.195.204.72

mta5.am0.yahoodns.net

United States

Details

IP:	67.195.204.72
TargetID:	1
Current Path:	C:\Windows\tserv.exe
Country:	United States
Countrycode:	USA
ASN number:	26101
ASN name:	YAHOO-3US
Private:	false
Domain:	mta5.am0.yahoodns.net

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Uses SMTP (mail sending)	Networking	Application Layer Protocol

67.195.228.110

mta7.am0.yahoodns.net

United States

Details

IP:	67.195.228.110
TargetID:	1
Current Path:	C:\Windows\tserv.exe
Country:	United States
Countrycode:	USA
ASN number:	36647
ASN name:	YAHOO-GQ1US
Private:	false
Domain:	mta7.am0.yahoodns.net

Signature Hits	Behavior Group	Mitre Attack
Uses SMTP (mail sending)	Networking	Application Layer Protocol

209.85.233.26

gmail-smtp-in.l.google.com

United States

Details

IP:	209.85.233.26
TargetID:	1
Current Path:	C:\Windows\tserv.exe
Country:	United States
Countrycode:	USA
ASN number:	15169
ASN name:	GOOGLEUS
Private:	false
Domain:	gmail-smtp-in.l.google.com

Signature Hits	Behavior Group	Mitre Attack
Uses SMTP (mail sending)	Networking	Application Layer Protocol

192.178.128.26

alt4.gmail-smtp-in.l.google.com

United States

67.195.204.73

mta6.am0.yahoodns.net

United States

Details

IP:	67.195.204.73
TargetID:	1
Current Path:	C:\Windows\tserv.exe
Country:	United States
Countrycode:	USA
ASN number:	26101
ASN name:	YAHOO-3US
Private:	false
Domain:	mta6.am0.yahoodns.net

Signature Hits	Behavior Group	Mitre Attack
Uses SMTP (mail sending)	Networking	Application Layer Protocol

Registry

Path

Value

Malicious

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows

AppInit_DLLs

Details

TargetID:	1
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows
Value name:	AppInit_DLLs
Value data:	msji449c14b7.dll

Signature Hits	Behavior Group	Mitre Attack
Creates an undocumented autostart registry key	Boot Survival	Registry Run Keys / Startup Folder
Sigma detected: Wow6432Node Windows NT CurrentVersion Autorun Keys Modification	System Summary

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run

tserv

Details

TargetID:	1
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Value name:	tserv
Value data:	C:\Windows\tserv.exe s

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification	System Summary
Creates an autostart registry key	Boot Survival	Registry Run Keys / Startup Folder

Memdumps

Base Address

Regiontype

Protect

Malicious

68C000

heap

page read and write

63B000

heap

page read and write

67F000

heap

page read and write

610000

heap

page read and write

446000

unkown

page readonly

9A000

stack

page read and write

699000

heap

page read and write

400000

unkown

page readonly

3D80000

trusted library allocation

page read and write

64D000

heap

page read and write

575000

heap

page read and write

630000

heap

page read and write

1F0000

heap

page read and write

67F000

heap

page read and write

446000

unkown

page readonly

400000

unkown

page readonly

677000

heap

page read and write

67A000

heap

page read and write

66B000

heap

page read and write

42E000

unkown

page readonly

600000

heap

page read and write

434000

unkown

page readonly

1FA0000

heap

page read and write

431000

unkown

page write copy

1FA4000

heap

page read and write

1F8E000

stack

page read and write

664000

heap

page read and write

67F000

heap

page read and write

431000

unkown

page read and write

464000

unkown

page readonly

676000

heap

page read and write

677000

heap

page read and write

677000

heap

page read and write

677000

heap

page read and write

676000

heap

page read and write

42E000

unkown

page readonly

3A3F000

stack

page read and write

464000

unkown

page readonly

5BE000

stack

page read and write

20E0000

heap

page read and write

694000

heap

page read and write

68C000

heap

page read and write

676000

heap

page read and write

570000

heap

page read and write

673000

heap

page read and write

434000

unkown

page readonly

540000

heap

page read and write

19C000

stack

page read and write

401000

unkown

page execute read

66E000

heap

page read and write

550000

heap

page read and write

57A000

heap

page read and write

690000

heap

page read and write

401000

unkown

page execute read

20AF000

stack

page read and write

There are 45 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
Update-KB6125-x86.exe

Files

Processes

Domains

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportUpdate-KB6125-x86.exe

Files

Processes

Domains

IPs

Registry

Memdumps

IOC Report
Update-KB6125-x86.exe