Malware Report

This report shows all the different areas TAZER analyzes for the sample: Host, Network Activity, and Detection.

Malware Search Criteria:

MD5 =23e032393492562ddbc03a7140f02ec4

File MD5Sum	SHA1SUM	SHA256SUM	FUZZY HASH	File Size
23e032393492562ddbc03a7140f02ec4	de430c0c49786f43fb3f9951fb55247018c3ffde	2fd1cbf87da19e7d0494eea54ffc7ea750e70bff1e4c64abb77c72d91d5332a2	3072:wBAp5XhKpN4eOyVTGfhEClj8jTk+0hzfAZuaBMNUz:nbXE9OiTGfhEClq9UPa+Nq	147556

File Name
myguestssetup.exe

Snort Class	Snort Alert	Count
N/A	No snort alerts generated	0

Path	File Name
c:/DELL/VIDEO/OUTPUT	netstat_base.txt
c:/DELL/VIDEO/OUTPUT	netstat_post.txt
c:/DELL/VIDEO/OUTPUT	tasksvc_base.txt
c:/DELL/VIDEO/OUTPUT	taskv_base.txt
c:/DELL/VIDEO/OUTPUT	taskv_post.txt
c:/Program Files/VKSOFT/FreeGolos VK	uninstall.exe
c:/Program Files/VKSOFT/FreeGolos VK	Uninstall.ini
c:/WINDOWS/Prefetch	7Z.EXE-1A62CD19.pf
c:/WINDOWS/Prefetch	SANDNET.EXE-2012C478.pf
c:	netstat_post.txt
c:/Program Files/VKSOFT/FreeGolos VK	uninstall.exe
c:/Program Files/VKSOFT/FreeGolos VK	Uninstall.ini
c:/WINDOWS/Prefetch	SANDNET.EXE-2012C478.pf
c:	netstat_post.txt
c:	taskv_post.txt

Action	Path	File Name

Action	Path	File Name
modified	c:/WINDOWS/Prefetch	CMD.EXE-087B4001.pf
modified	c:/WINDOWS/Prefetch	NETSTAT.EXE-2B2B4428.pf
modified	c:/WINDOWS/Prefetch	SH.EXE-00254D2B.pf
modified	c:/WINDOWS/Prefetch	SLEEP.EXE-094A3D2A.pf
modified	c:/WINDOWS/Prefetch	SSHD.EXE-298CA236.pf
modified	c:/WINDOWS/Prefetch	SWITCH.EXE-0496EC21.pf
modified	c:/WINDOWS/Prefetch	TASKLIST.EXE-10D94B23.pf
modified	c:/WINDOWS/Prefetch	WMIPRVSE.EXE-28F301A9.pf
modified	c:/WINDOWS/system32/config	software.LOG
modified	c:/WINDOWS/system32/drivers/etc	hosts
modified	c:/WINDOWS/system32/wbem/Logs	wbemess.log
modified	c:/WINDOWS/system32/wbem/Logs	wmiprov.log
modified	c:/WINDOWS/system32/wbem/Repository/FS	INDEX.MAP
modified	c:/WINDOWS/system32/wbem/Repository/FS	MAPPING.VER
modified	c:/WINDOWS/system32/wbem/Repository/FS	MAPPING1.MAP
modified	c:/WINDOWS/system32/wbem/Repository/FS	OBJECTS.MAP
modified	c:/WINDOWS/Prefetch	CMD.EXE-087B4001.pf
modified	c:/WINDOWS/Prefetch	HSTART.EXE-221D72BF.pf
modified	c:/WINDOWS/Prefetch	NETSTAT.EXE-2B2B4428.pf
modified	c:/WINDOWS/Prefetch	SH.EXE-00254D2B.pf
modified	c:/WINDOWS/Prefetch	SLEEP.EXE-094A3D2A.pf
modified	c:/WINDOWS/Prefetch	SSHD.EXE-298CA236.pf
modified	c:/WINDOWS/Prefetch	SWITCH.EXE-0496EC21.pf
modified	c:/WINDOWS/system32/config	software.LOG
modified	c:/WINDOWS/system32/drivers/etc	hosts
modified	c:/WINDOWS/system32/wbem/Repository/FS	INDEX.MAP
modified	c:/WINDOWS/system32/wbem/Repository/FS	MAPPING.VER
modified	c:/WINDOWS/system32/wbem/Repository/FS	MAPPING2.MAP
modified	c:/WINDOWS/system32/wbem/Repository/FS	OBJECTS.MAP

Action	Path

Action	Path	Val_Name	Val_Data

Action	Path	Val_Name	Val_Type	Mod_Val_Type	Val_Data	Mod_Val_Data

Action	Path	Val_Name	Val_Data	Mod_Val_Data
modified	HKLM/SOFTWARE/Microsoft/Cryptography/RNG	Seed	78 A0 8E 21 FE C3 69 69 F9 69 6D F2 29 D5 13 EB 3C 85 7C D0 8F E7 FA 13 61 86 0F	12 48 2E 39 91 26 23 A2 A8 9E A8 1B 98 B1 C1 FC E7 42 6B 2B 5E 8D C0 A1 95 B0 4
modified	HKLM/SOFTWARE/Microsoft/Cryptography/RNG	Seed	32 A5 83 DD B6 66 8A 2C 21 3F 95 64 C0 34 6A 28 45 18 F2 13 B5 7A 45 3F FF 04 95	12 BB 3E FF C4 FE 9E 97 07 27 DC 88 C7 73 7A F8 F6 BF 76 27 E8 BF C5 52 51 6B 1

DNS	DNS Response

DstIP	HTTP_HOST	HTTP_REQUEST_URI	HTTP_USER_AGENT	PROTOCOL
239.255.255.250	239.255.255.250:1900	*	--blank--	0x11

PROTOCOL	SRC_PKTS	DST_PKTS	SRC_BYTES	DST_BYTES
17	2	0	350	0

DPORT	PROTOCOL	SRC_PKTS	DST_PKTS	SRC_BYTES	DST_BYTES
1900	17	2	0	350	0

Time	Date	Protocol	SrcIP	DstIP	Dir	Flags	Sport	Dport	Pkts	Bytes
13:34:17	2011-06-02	17	10.10.10.7	239.255.255.250	->	e	8	1900	2	350

Packer Name

Honey Trap Log File Location

PTFB Log File Location