Malware Report

This report shows all the different areas TAZER analyzes for the sample: Host, Network Activity, and Detection.

Malware Search Criteria:

MD5 =5b9055070efc1d0059bb23e4c99664b2

File MD5Sum	SHA1SUM	SHA256SUM	FUZZY HASH	File Size
5b9055070efc1d0059bb23e4c99664b2	508d977b9264b40bf00e0ebd756336f7cb862758	c8a45f311258013c68bad67ddab92110de2f2d5beb7b6d395a52c6ed0cbca99a	768:GsWbnXDVPakro46xkkjvyrdxaiVKTW757gzUtf1zBmQzTGfmgyqS8U:j2JyeT6Ckja/TViQ2otf1	69632

File Name
honey.mid.exe

Snort Class	Snort Alert	Count
N/A	No snort alerts generated	0

Path	Folder Name

Path	File Name
c:/Documents and Settings/dmc73144/Local Settings/Temp	~DF44E2.tmp
c:/Documents and Settings/dmc73144/Local Settings/Temp	~DF4741.tmp
c:/WINDOWS/Prefetch	AUTOIT3.EXE-32361418.pf
c:/WINDOWS/Prefetch	DIEP.EXE-0B3E1DC8.pf
c:/WINDOWS/Prefetch	HSTART.EXE-221D72BF.pf
c:/WINDOWS/Prefetch	SANDNET.EXE-2012C478.pf
c:/WINDOWS/Prefetch	SYSTEM.EXE-123095C8.pf
c:/WINDOWS/Prefetch	USERINIT.EXE-34E6D73A.pf
c:/WINDOWS/system32	system.exe
c:/WINDOWS	kdcoms.dll
c:/WINDOWS	userinit.exe
c:	netstat_post.txt
c:	taskv_post.txt

Action	Path	File Name

Action	Path	File Name
modified	c:/Documents and Settings/dmc73144	ntuser.dat.LOG
modified	c:/WINDOWS/Prefetch	CMD.EXE-087B4001.pf
modified	c:/WINDOWS/Prefetch	NETSTAT.EXE-2B2B4428.pf
modified	c:/WINDOWS/Prefetch	NTOSBOOT-B00DFAAD.pf
modified	c:/WINDOWS/Prefetch	SCP.EXE-174845DC.pf
modified	c:/WINDOWS/Prefetch	SENDIT.EXE-34C997E3.pf
modified	c:/WINDOWS/Prefetch	SH.EXE-00254D2B.pf
modified	c:/WINDOWS/Prefetch	SLEEP.EXE-094A3D2A.pf
modified	c:/WINDOWS/Prefetch	SSHD.EXE-298CA236.pf
modified	c:/WINDOWS/Prefetch	SWITCH.EXE-0496EC21.pf
modified	c:/WINDOWS/Prefetch	TASKLIST.EXE-10D94B23.pf
modified	c:/WINDOWS/Prefetch	WMIPRVSE.EXE-28F301A9.pf
modified	c:/WINDOWS/Prefetch	WUAUCLT.EXE-399A8E72.pf
modified	c:/WINDOWS	SchedLgU.Txt
modified	c:/WINDOWS/SoftwareDistribution/DataStore/Logs	edb.chk
modified	c:/WINDOWS/system32/drivers/etc	hosts
modified	c:/WINDOWS/system32/wbem/Repository/FS	INDEX.MAP
modified	c:/WINDOWS/system32/wbem/Repository/FS	MAPPING.VER
modified	c:/WINDOWS/system32/wbem/Repository/FS	MAPPING2.MAP
modified	c:/WINDOWS/system32/wbem/Repository/FS	OBJECTS.MAP

Action	Path

Action	Path	Val_Name	Val_Data

Action	Path	Val_Name	Val_Type	Mod_Val_Type	Val_Data	Mod_Val_Data

Action	Path	Val_Name	Val_Data	Mod_Val_Data
modified	HKLM/SOFTWARE/Microsoft/Cryptography/RNG	Seed	DB 42 1C 3D 58 14 21 D0 B6 60 AB 6A D6 A3 8C 75 A5 99 70 BE AD 0A 9B E8 FE EC CB	D5 11 56 2F 76 C0 64 87 DD D3 4C 95 CE 07 0B F5 FF 42 D9 BD 47 AE 46 B4 25 90 D
modified	HKLM/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Winlogon	Userinit	C:WINDOWSsystem32userinit.exe,	"C
modified	HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Explorer/Advanced	HideFileExt	0x00000000	0x00000001
modified	HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Explorer/Advanced	Hidden	0x00000001	0x00000002
modified	HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Explorer/Advanced	ShowSuperHidden	0x00000001	0x00000000
modified	HKU/S-1-5-21-1844237615-562591055-839522115-1004/SessionInformation	ProgramCount	0x00000002	0x00000001

DNS	DNS Response

DstIP	HTTP_HOST	HTTP_REQUEST_URI	HTTP_USER_AGENT	PROTOCOL
239.255.255.250	239.255.255.250:1900	*	--blank--	0x11

PROTOCOL	SRC_PKTS	DST_PKTS	SRC_BYTES	DST_BYTES
17	2	0	350	0

DPORT	PROTOCOL	SRC_PKTS	DST_PKTS	SRC_BYTES	DST_BYTES
1900	17	2	0	350	0

Time	Date	Protocol	SrcIP	DstIP	Dir	Flags	Sport	Dport	Pkts	Bytes
06:52:37	2011-04-27	17	10.10.10.7	239.255.255.250	->	e	8	1900	2	350

Packer Name

Honey Trap Log File Location

PTFB Log File Location