Edit tour

Windows Analysis Report
Update-KB3406-x86.exe

Overview

General Information

Sample name:	Update-KB3406-x86.exe
Analysis ID:	1581287
MD5:	f058419e57f81ee86bea5ac52b04179f
SHA1:	b1ac327b20ea332ee1f6b4d35eccf5ccec07f81c
SHA256:	3524573e4a81825a59e6614b2a8d47408dbade0caa358a2ec8b7ec471f374aa9
Tags:	exeuser-TeamDreier
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Contains functionality to inject threads in other processes

Creates an undocumented autostart registry key

Detected PE file pumping (to bypass AV & sandboxing)

Drops executables to the windows directory (C:\Windows) and starts them

Machine Learning detection for dropped file

Machine Learning detection for sample

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Extensive use of GetProcAddress (often used to hide API calls)

Found evasive API chain (may stop execution after checking a module file name)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Sigma detected: Wow6432Node Windows NT CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Update-KB3406-x86.exe (PID: 7632 cmdline: "C:\Users\user\Desktop\Update-KB3406-x86.exe" MD5: F058419E57F81EE86BEA5AC52B04179F)

tserv.exe (PID: 7776 cmdline: C:\Windows\tserv.exe s MD5: F058419E57F81EE86BEA5AC52B04179F)

tserv.exe (PID: 8096 cmdline: "C:\Windows\tserv.exe" s MD5: F058419E57F81EE86BEA5AC52B04179F)

cleanup

Sigma Signatures

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 67.195.204.73, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Windows\tserv.exe, Initiated: true, ProcessId: 7776, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49718

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Windows\tserv.exe s, EventID: 13, EventType: SetValue, Image: C:\Windows\tserv.exe, ProcessId: 7776, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tserv

Sigma detected: Wow6432Node Windows NT CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: msji449c14b7.dll, EventID: 13, EventType: SetValue, Image: C:\Windows\tserv.exe, ProcessId: 7776, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs

Suricata Signatures

ET MALWARE Connection to Fitsec Sinkhole IP (Possible Infected Host)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T10:34:53.990598+0100	2016998	1	A Network Trojan was detected	192.168.2.7	49717	193.166.255.171	80	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T10:35:16.023753+0100	2019714	2	Potentially Bad Traffic	192.168.2.7	49717	193.166.255.171	80	TCP
2024-12-27T10:35:35.565273+0100	2019714	2	Potentially Bad Traffic	192.168.2.7	49762	193.166.255.171	80	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T10:35:16.023753+0100	2803305	3	Unknown Traffic	192.168.2.7	49717	193.166.255.171	80	TCP
2024-12-27T10:35:35.565273+0100	2803305	3	Unknown Traffic	192.168.2.7	49762	193.166.255.171	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Update-KB3406-x86.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Windows\tserv.exe

Avira: detection malicious, Label: WORM/Stration.C

Multi AV Scanner detection for dropped file

Source: C:\Windows\tserv.exe	ReversingLabs: Detection: 94%
Source: C:\Windows\tserv.exe	Virustotal: Detection: 80%			Perma Link

Multi AV Scanner detection for submitted file

Source: Update-KB3406-x86.exe	ReversingLabs: Detection: 94%
Source: Update-KB3406-x86.exe	Virustotal: Detection: 80%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 94.8% probability

Machine Learning detection for dropped file

Source: C:\Windows\tserv.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Update-KB3406-x86.exe

Joe Sandbox ML: detected

Source: Update-KB3406-x86.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\Update-KB3406-x86.exe

Code function: 2_2_00406360 GetFileAttributesA,lstrcpyA,lstrcatA,lstrcatA,FindFirstFileA,GetLastError,lstrcmpA,lstrcmpA,lstrcmpA,lstrcpyA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,FindNextFileA,FindClose,

2_2_00406360

Source: global traffic	HTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com
Source: global traffic	HTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com

Source: Joe Sandbox View	IP Address: 193.166.255.171 193.166.255.171
Source: Joe Sandbox View	IP Address: 98.136.96.91 98.136.96.91
Source: Joe Sandbox View	IP Address: 67.195.204.74 67.195.204.74

Source: Network traffic	Suricata IDS: 2016998 - Severity 1 - ET MALWARE Connection to Fitsec Sinkhole IP (Possible Infected Host) : 192.168.2.7:49717 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49717 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.7:49717 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49762 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.7:49762 -> 193.166.255.171:80

Source: global traffic	TCP traffic: 192.168.2.7:49718 -> 67.195.204.73:25
Source: global traffic	TCP traffic: 192.168.2.7:49767 -> 67.195.204.74:25
Source: global traffic	TCP traffic: 192.168.2.7:49815 -> 98.136.96.91:25
Source: global traffic	TCP traffic: 192.168.2.7:49866 -> 108.177.98.26:25
Source: global traffic	TCP traffic: 192.168.2.7:49960 -> 142.250.141.26:25
Source: global traffic	TCP traffic: 192.168.2.7:49984 -> 142.250.157.27:25
Source: global traffic	TCP traffic: 192.168.2.7:49986 -> 64.233.165.27:25

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com
Source: global traffic	HTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com

Source: global traffic	DNS traffic detected: DNS query: yahoo.com
Source: global traffic	DNS traffic detected: DNS query: mta5.am0.yahoodns.net
Source: global traffic	DNS traffic detected: DNS query: mta6.am0.yahoodns.net
Source: global traffic	DNS traffic detected: DNS query: www4.cedesunjerinkas.com
Source: global traffic	DNS traffic detected: DNS query: mta7.am0.yahoodns.net
Source: global traffic	DNS traffic detected: DNS query: gmail.com
Source: global traffic	DNS traffic detected: DNS query: alt4.gmail-smtp-in.l.google.com
Source: global traffic	DNS traffic detected: DNS query: alt1.gmail-smtp-in.l.google.com
Source: global traffic	DNS traffic detected: DNS query: alt2.gmail-smtp-in.l.google.com
Source: global traffic	DNS traffic detected: DNS query: gmail-smtp-in.l.google.com
Source: global traffic	DNS traffic detected: DNS query: alt3.gmail-smtp-in.l.google.com
Source: global traffic	DNS traffic detected: DNS query: hotmail.com
Source: global traffic	DNS traffic detected: DNS query: hotmail-com.olc.protection.outlook.com

Source: C:\Users\user\Desktop\Update-KB3406-x86.exe

Code function: 2_2_00423D83: QueryDosDeviceA,lstrcpyA,lstrcatA,GetLastError,lstrcpyA,lstrcatA,DefineDosDeviceA,GetLastError,lstrcpyA,lstrcatA,CreateFileA,DeviceIoControl,GetLastError,GetLastError,DefineDosDeviceA,GetLastError,

2_2_00423D83

Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	File created: C:\Windows\tserv.exe			Jump to behavior
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	File created: C:\Windows\tserv.exe\:Zone.Identifier:$DATA			Jump to behavior

Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Code function: 2_2_00411800	2_2_00411800
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Code function: 2_2_004108D0	2_2_004108D0
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Code function: 2_2_0040C8E0	2_2_0040C8E0
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Code function: 2_2_0040F0E9	2_2_0040F0E9
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Code function: 2_2_00410907	2_2_00410907
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Code function: 2_2_00404110	2_2_00404110
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Code function: 2_2_00409119	2_2_00409119
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Code function: 2_2_0040F1C7	2_2_0040F1C7
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Code function: 2_2_0040C1D0	2_2_0040C1D0
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Code function: 2_2_00404990	2_2_00404990
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Code function: 2_2_004091A7	2_2_004091A7
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Code function: 2_2_0040E246	2_2_0040E246
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Code function: 2_2_00428A08	2_2_00428A08
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Code function: 2_2_00425214	2_2_00425214
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Code function: 2_2_00405310	2_2_00405310
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Code function: 2_2_00408BC0	2_2_00408BC0
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Code function: 2_2_00415BD0	2_2_00415BD0
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Code function: 2_2_0041B3D0	2_2_0041B3D0
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Code function: 2_2_0040DBF0	2_2_0040DBF0
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Code function: 2_2_0041E3A0	2_2_0041E3A0
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Code function: 2_2_00409436	2_2_00409436
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Code function: 2_2_00409CF7	2_2_00409CF7
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Code function: 2_2_0041BD00	2_2_0041BD00
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Code function: 2_2_0040EDE0	2_2_0040EDE0
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Code function: 2_2_0040DE56	2_2_0040DE56
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Code function: 2_2_0041C660	2_2_0041C660
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Code function: 2_2_00410670	2_2_00410670
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Code function: 2_2_0040E676	2_2_0040E676
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Code function: 2_2_00409F47	2_2_00409F47
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Code function: 2_2_0040EF78	2_2_0040EF78
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Code function: 2_2_0040FF30	2_2_0040FF30
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Code function: 2_2_00405F30	2_2_00405F30

Source: C:\Users\user\Desktop\Update-KB3406-x86.exe

Code function: String function: 0042664C appears 45 times

Source: Update-KB3406-x86.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.evad.winEXE@4/2@14/9

Source: C:\Users\user\Desktop\Update-KB3406-x86.exe

Code function: 2_2_004047A0 lstrcatA,GetCurrentProcess,GetCurrentProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,

2_2_004047A0

Source: C:\Users\user\Desktop\Update-KB3406-x86.exe

Code function: 2_2_00405090 GetSystemDirectoryA,lstrcatA,lstrcatA,lstrcatA,GetFileAttributesA,CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

2_2_00405090

Source: C:\Users\user\Desktop\Update-KB3406-x86.exe

Code function: 2_2_0041E0B0 FindResourceA,LoadResource,SizeofResource,LockResource,CreateFileA,WriteFile,CloseHandle,

2_2_0041E0B0

Source: C:\Windows\tserv.exe

Mutant created: NULL

Source: Update-KB3406-x86.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Update-KB3406-x86.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Update-KB3406-x86.exe	ReversingLabs: Detection: 94%
Source: Update-KB3406-x86.exe	Virustotal: Detection: 80%

Source: C:\Users\user\Desktop\Update-KB3406-x86.exe

File read: C:\Users\user\Desktop\Update-KB3406-x86.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Update-KB3406-x86.exe "C:\Users\user\Desktop\Update-KB3406-x86.exe"
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Process created: C:\Windows\tserv.exe C:\Windows\tserv.exe s
Source: unknown	Process created: C:\Windows\tserv.exe "C:\Windows\tserv.exe" s
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Process created: C:\Windows\tserv.exe C:\Windows\tserv.exe s	Jump to behavior

Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Section loaded: cmut449c14b7.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: cmut449c14b7.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: cmut449c14b7.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: cmut449c14b7.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: cmut449c14b7.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\Update-KB3406-x86.exe

Code function: 2_2_0041F660 LoadLibraryA,GetProcAddress,SetWindowsHookExA,

2_2_0041F660

Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Code function: 2_2_0042647C push eax; ret	2_2_0042649A
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Code function: 2_2_004254B0 push eax; ret	2_2_004254C4
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Code function: 2_2_004254B0 push eax; ret	2_2_004254EC
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Code function: 2_2_00426687 push ecx; ret	2_2_00426697

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Users\user\Desktop\Update-KB3406-x86.exe

Executable created and started: C:\Windows\tserv.exe

Jump to behavior

Source: C:\Users\user\Desktop\Update-KB3406-x86.exe

File created: C:\Windows\tserv.exe

Jump to dropped file

Source: C:\Users\user\Desktop\Update-KB3406-x86.exe

File created: C:\Windows\tserv.exe

Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Windows\tserv.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows AppInit_DLLs

Jump to behavior

Source: C:\Windows\tserv.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run tserv			Jump to behavior
Source: C:\Windows\tserv.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run tserv			Jump to behavior

Source: C:\Users\user\Desktop\Update-KB3406-x86.exe

Code function: 2_2_0041D159 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,

2_2_0041D159

Source: C:\Users\user\Desktop\Update-KB3406-x86.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Detected PE file pumping (to bypass AV & sandboxing)

Source: Update-KB3406-x86.exe

Static PE information: Resource name: RT_ICON size: 0xffffff28

Source: C:\Users\user\Desktop\Update-KB3406-x86.exe

Code function: 2_2_0040C1D0 rdtsc

2_2_0040C1D0

Source: C:\Windows\tserv.exe	Thread delayed: delay time: 300000			Jump to behavior
Source: C:\Windows\tserv.exe	Thread delayed: delay time: 300000			Jump to behavior

Source: C:\Users\user\Desktop\Update-KB3406-x86.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_2-12761

Source: C:\Users\user\Desktop\Update-KB3406-x86.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_2-12695

Source: C:\Users\user\Desktop\Update-KB3406-x86.exe

API coverage: 9.7 %

Source: C:\Windows\tserv.exe TID: 7928	Thread sleep time: -300000s >= -30000s			Jump to behavior
Source: C:\Windows\tserv.exe TID: 8148	Thread sleep time: -300000s >= -30000s			Jump to behavior

Source: C:\Windows\tserv.exe	Last function: Thread delayed
Source: C:\Windows\tserv.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Update-KB3406-x86.exe

Code function: 2_2_00406360 GetFileAttributesA,lstrcpyA,lstrcatA,lstrcatA,FindFirstFileA,GetLastError,lstrcmpA,lstrcmpA,lstrcmpA,lstrcpyA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,FindNextFileA,FindClose,

2_2_00406360

Source: C:\Users\user\Desktop\Update-KB3406-x86.exe

Code function: 2_2_00429F44 VirtualQuery,GetSystemInfo,VirtualQuery,VirtualAlloc,VirtualProtect,

2_2_00429F44

Source: C:\Windows\tserv.exe	Thread delayed: delay time: 300000			Jump to behavior
Source: C:\Windows\tserv.exe	Thread delayed: delay time: 300000			Jump to behavior

Source: C:\Users\user\Desktop\Update-KB3406-x86.exe

API call chain: ExitProcess graph end node

graph_2-12762

Source: C:\Users\user\Desktop\Update-KB3406-x86.exe

Code function: 2_2_0040C1D0 rdtsc

2_2_0040C1D0

Source: C:\Users\user\Desktop\Update-KB3406-x86.exe

Code function: 2_2_0041F660 LoadLibraryA,GetProcAddress,SetWindowsHookExA,

2_2_0041F660

Source: C:\Users\user\Desktop\Update-KB3406-x86.exe

Code function: 2_2_0041F830 GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,SetEvent,Sleep,

2_2_0041F830

Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Code function: 2_2_0042731A SetUnhandledExceptionFilter,		2_2_0042731A
Source: C:\Users\user\Desktop\Update-KB3406-x86.exe	Code function: 2_2_0042732E SetUnhandledExceptionFilter,		2_2_0042732E

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject threads in other processes

Source: C:\Users\user\Desktop\Update-KB3406-x86.exe

Code function: 2_2_00404840 OpenProcess,lstrlenA,VirtualAllocEx,WriteProcessMemory,GetModuleHandleA,GetProcAddress,CreateRemoteThread,

2_2_00404840

Source: C:\Users\user\Desktop\Update-KB3406-x86.exe

Code function: 2_2_00423260 GetProcessHeap,HeapAlloc,HeapAlloc,HeapAlloc,HeapFree,HeapAlloc,HeapFree,HeapFree,HeapFree,HeapAlloc,HeapFree,HeapFree,HeapFree,HeapAlloc,HeapFree,HeapFree,HeapFree,HeapFree,HeapAlloc,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,InitializeSecurityDescriptor,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetTokenInformation,GetTokenInformation,GetTokenInformation,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,AllocateAndInitializeSid,GetLengthSid,AddAce,AllocateAndInitializeSid,GetLengthSid,AddAce,AllocateAndInitializeSid,GetLengthSid,AddAce,IsValidSecurityDescriptor,

2_2_00423260

Source: C:\Users\user\Desktop\Update-KB3406-x86.exe

Code function: GetLocaleInfoA,

2_2_0042C8B2

Source: C:\Users\user\Desktop\Update-KB3406-x86.exe

Code function: 2_2_00401830 ExpandEnvironmentStringsA,GetLocalTime,CreateFileA,CloseHandle,

2_2_00401830

Source: C:\Users\user\Desktop\Update-KB3406-x86.exe

Code function: 2_2_0040BE00 lstrlenA,GetLocalTime,GetTimeZoneInformation,lstrlenA,

2_2_0040BE00

Source: C:\Users\user\Desktop\Update-KB3406-x86.exe

Code function: 2_2_00425D91 EntryPoint,GetVersionExA,GetModuleHandleA,GetModuleHandleA,_fast_error_exit,_fast_error_exit,GetCommandLineA,GetStartupInfoA,__wincmdln,GetModuleHandleA,

2_2_00425D91

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Native API	11 Registry Run Keys / Startup Folder	1 Access Token Manipulation	12 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	11 Process Injection	121 Virtualization/Sandbox Evasion	LSASS Memory	22 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	11 Registry Run Keys / Startup Folder	1 Access Token Manipulation	Security Account Manager	121 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	11 Process Injection	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	14 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
Update-KB3406-x86.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Update-KB3406-x86.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
Update-KB3406-x86.exe