Malware Report - Results

This report shows all the different areas TAZER analyzes for the sample: Host, Network Activity, and Detection.

Malware Search Criteria:
  • MD5 =4b52e1da2e800ca4ea9db4d5f5288238

    • Malware Report - Results

    File MD5SumSHA1SUMSHA256SUMFUZZY HASHFile Size
    4b52e1da2e800ca4ea9db4d5f52882388a199c2f8bba20fc6146e30399544ce406f88410e4f7a40faff4ec8ad8feb4b3b2aa54bb8060470438bad737f4d8c4a074f09dae12288:9o7YNQXQDzdYD/jGW/nSpVAn8GxyxOzauUPnIpVyKCFJo:OwQORHW/nS3A8G8kVCFJo637750

    File Results

    File Name
    Javaup.exe

    SNORT Results

    Snort ClassSnort AlertCount
    N/ANo snort alerts generated0

    AV Results

    AV AlertAV Vendor
    Trojan.ADH.2Symantec
    Qhost-Gen!fMcAfee
    Trojan.Win32.Qhost.xpfKaspersky

    Folders (Added) - ICC Results

    PathFolder Name

    Files (Added) - ICC Results

    PathFile Name
    c:/Documents and Settings/dmc73144/Local Settings/Temp0FD0D0B0
    c:/WINDOWS/PrefetchAUTOIT3.EXE-32361418.pf
    c:/WINDOWS/PrefetchREGSHOT.EXE-010A5EE6.pf
    c:/WINDOWS/PrefetchSANDNET.EXE-2012C478.pf

    Files (Deleted) - ICC Results

    ActionPathFile Name

    Files (Changed) - ICC Results

    ActionPathFile Name
    modifiedc:/Documents and Settings/dmc73144/Cookiesindex.dat
    modifiedc:/Documents and Settings/dmc73144/Local Settings/History/History.IE5index.dat
    modifiedc:/Documents and Settings/dmc73144/Local Settings/Temporary Internet Files/Content.IE5index.dat
    modifiedc:/Documents and Settings/dmc73144NTUSER.DAT
    modifiedc:/Documents and Settings/dmc73144ntuser.dat.LOG
    modifiedc:/WINDOWS/PrefetchCMD.EXE-087B4001.pf
    modifiedc:/WINDOWS/PrefetchHSTART.EXE-221D72BF.pf
    modifiedc:/WINDOWS/PrefetchSH.EXE-00254D2B.pf
    modifiedc:/WINDOWS/PrefetchSSHD.EXE-298CA236.pf
    modifiedc:/WINDOWS/PrefetchSWITCH.EXE-0496EC21.pf
    modifiedc:/WINDOWS/PrefetchWMIPRVSE.EXE-28F301A9.pf
    modifiedc:/WINDOWS/system32/configsoftware.LOG
    modifiedc:/WINDOWS/system32/drivers/etchosts
    modifiedc:/WINDOWS/system32/wbem/Logswmiprov.log

    Registry Keys (Added) - ICC Results

    ActionPath
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/Active Directory GC
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/Bigfoot
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/VeriSign
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/WhoWhere
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Enigma Protector
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Enigma Protector/11DE3BF085F161D2-32FAACCB8C53C6C1
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Enigma Protector/11DE3BF085F161D2-32FAACCB8C53C6C1/F2056619E67008B6-D3EAB50C2B7144EE

    Registry Values (Added) - ICC Results

    ActionPathVal_NameVal_Data
    addedHKLM/SOFTWARE/Microsoft/Security CenterUACDisableNotify0x00000000
    addedHKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/policies/systemEnableLUA0x00000000
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Identities/{32BF15D6-D919-458D-8A1A-AC3F3B3F3027}Identity Ordinal0x00000001
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/WhoWhereLDAP Server ID0x00000003
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/WhoWhereAccount Name"WhoWhere Internet Directory Service"
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/WhoWhereLDAP Server"ldap.whowhere.com"
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/WhoWhereLDAP URL"http
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/WhoWhereLDAP Search Return0x00000064
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/WhoWhereLDAP Timeout0x0000003C
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/WhoWhereLDAP Authentication0x00000000
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/WhoWhereLDAP Simple Search0x00000001
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/WhoWhereLDAP Logo"%ProgramFiles%Common FilesServiceswhowhere.bmp"
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/VeriSignLDAP Server ID0x00000002
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/VeriSignAccount Name"VeriSign Internet Directory Service"
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/VeriSignLDAP Server"directory.verisign.com"
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/VeriSignLDAP URL"http
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/VeriSignLDAP Search Return0x00000064
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/VeriSignLDAP Timeout0x0000003C
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/VeriSignLDAP Authentication0x00000000
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/VeriSignLDAP Search Base"NULL"
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/VeriSignLDAP Simple Search0x00000001
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/VeriSignLDAP Logo"%ProgramFiles%Common FilesServicesverisign.bmp"
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/BigfootLDAP Server ID0x00000001
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/BigfootAccount Name"Bigfoot Internet Directory Service"
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/BigfootLDAP Server"ldap.bigfoot.com"
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/BigfootLDAP URL"http
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/BigfootLDAP Search Return0x00000064
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/BigfootLDAP Timeout0x0000003C
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/BigfootLDAP Authentication0x00000000
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/BigfootLDAP Simple Search0x00000001
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/BigfootLDAP Logo"%ProgramFiles%Common FilesServicesbigfoot.bmp"
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/Active Directory GCLDAP Server ID0x00000000
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/Active Directory GCAccount Name"Active Directory"
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/Active Directory GCLDAP Server"NULL"
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/Active Directory GCLDAP Search Return0x00000064
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/Active Directory GCLDAP Timeout0x0000003C
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/Active Directory GCLDAP Authentication0x00000002
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/Active Directory GCLDAP Simple Search0x00000000
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/Active Directory GCLDAP Bind DN0x00000000
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/Active Directory GCLDAP Port0x00000CC4
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/Active Directory GCLDAP Resolve Flag0x00000001
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/Active Directory GCLDAP Secure Connection0x00000000
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/Active Directory GCLDAP User Name"NULL"
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/Active Directory GCLDAP Search Base"NULL"
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/AccountsAssociatedIDD6 15 BF 32 19 D9 8D 45 8A 1A AC 3F 3B 3F 30 27
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/AccountsPreConfigVer0x00000004
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/AccountsPreConfigVerNTDS0x00000001
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account ManagerServer ID0x00000004
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account ManagerDefault LDAP Account"Active Directory GC"
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Enigma Protector/11DE3BF085F161D2-32FAACCB8C53C6C1/F2056619E67008B6-D3EAB50C2B7144EE2AA5A6E0A0 4D 8D 7F C1 A3 FB B5 D0 AA 66 4C CE F4

    Registry Values (Deleted) - ICC Results

    ActionPathVal_NameVal_TypeMod_Val_TypeVal_DataMod_Val_Data

    Registry Values (Changed) - ICC Results

    ActionPathVal_NameVal_DataMod_Val_Data
    modifiedHKLM/SOFTWARE/Microsoft/Cryptography/RNGSeedAD 1A 38 42 FA A3 70 5F 60 5D EF 36 2B 66 DA E6 FF 64 A4 8E 95 F3 CC 11 03 58 AD30 76 F4 45 79 3C D5 89 6D E3 A3 A8 39 78 6D 31 B5 48 69 3E 6C 0B F2 8C 22 C6 AF
    modifiedHKU/S-1-5-21-1844237615-562591055-839522115-1004/IdentitiesIdentity Ordinal0x000000010x00000002
    modifiedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Internet Settings/ConnectionsSavedLegacySettings3C 00 00 00 15 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 003C 00 00 00 16 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00

    DNS Results

    DNSDNS Response
    Smtp.Gmail.ComStandard query response CNAME gmail-smtp-msa.l.google.Com A 74.125.115.109 A 74.125.115.108

    URL Results

    DstIPHTTP_HOSTHTTP_REQUEST_URIHTTP_USER_AGENTPROTOCOL

    ARGUS PROTOCOL Results

    PROTOCOLSRC_PKTSDST_PKTSSRC_BYTESDST_BYTES
    6191712161024

    ARGUS DPORT Results

    DPORTPROTOCOLSRC_PKTSDST_PKTSSRC_BYTESDST_BYTES
    4656191712161024

    ARGUS DATA Results

    TimeDateProtocolSrcIPDstIPDirFlagsSportDportPktsBytes
    00:51:432011-10-15610.10.10.774.125.115.109-> e 52346513856
    00:51:482011-10-15610.10.10.774.125.115.109-> e 52346510600
    00:51:532011-10-15610.10.10.774.125.115.109-> e 5234656360
    00:51:542011-10-15610.10.10.774.125.115.109-> e 5604657424

    Packer Results

    Packer Name

    HoneyTrap Results

    Honey Trap Log File Location

    PTFB Results

    PTFB Log File Location