**** Malware_Report_-_Results **** This report shows all the different areas TAZER analyzes for the sample: Host, Network Activity, and Detection. Malware Search Criteria: MD5 =5e1df08bbcb6cd1aebe5f3b9fa0143b5 **** Malware_Report_-_Results **** _____________________________________________________________________________________________________________________________________________________________________________________________________________________________________ |File_MD5Sum_____________________|SHA1SUM_________________________________|SHA256SUM_______________________________________________________|FUZZY_HASH______________________________________________________________________|File_Size| |5e1df08bbcb6cd1aebe5f3b9fa0143b5|1eb900d5e4cbf5c550c6b8668516a5c9add3d0ef|55070d2c83629f0d45df8a737b168564ec3002204c9aa21d7602e193d26adb5f|6144:g27gCbTehEqclWYaci7TJxNdGazSDKTsmReZGVnYqSDdHazjZ8ggSHvkIv:g27/bTehEqclr8Di|279290___| **** File_Results **** ________________ |File_Name_______| |Photo%2D5876.exe| **** SNORT_Results **** ___________________________________________ |Snort_Class|Snort_Alert______________|Count| |N/A________|No_snort_alerts_generated|0____| **** AV_Results **** __________________ |AV_Alert|AV_Vendor| **** Folders_(Added)_-_ICC_Results **** ______________________________________________________________________________________________ |Path_________________________________________________________________|Folder_Name_____________| |c:/Documents_and_Settings/dmc73144/Local_Settings/History/History.IE5|MSHist012011090920110910| **** Files_(Added)_-_ICC_Results **** _______________________________________________________________________________________________________________________ |Path__________________________________________________________________________________________|File_Name_______________| |c:/Documents_and_Settings/dmc73144/Local_Settings/History/History.IE5/MSHist012011090920110910|index.dat_______________| |c:/Documents_and_Settings/dmc73144/Recent_____________________________________________________|0000q0hb.jpg.lnk________| |c:/Documents_and_Settings/dmc73144/Recent_____________________________________________________|dmc73144.lnk____________| |c:/Documents_and_Settings/dmc73144____________________________________________________________|0000q0hb.jpg____________| |c:/WINDOWS/Prefetch___________________________________________________________________________|AUTOIT3.EXE-32361418.pf_| |c:/WINDOWS/Prefetch___________________________________________________________________________|CHCP.COM-18156052.pf____| |c:/WINDOWS/Prefetch___________________________________________________________________________|REGSHOT.EXE-010A5EE6.pf_| |c:/WINDOWS/Prefetch___________________________________________________________________________|RNM.EXE-04823DAF.pf_____| |c:/WINDOWS/Prefetch___________________________________________________________________________|RUNDLL32.EXE-369A6B7A.pf| |c:/WINDOWS/Prefetch___________________________________________________________________________|SANDNET.EXE-2012C478.pf_| |c:/WINDOWS/Prefetch___________________________________________________________________________|TASKKILL.EXE-0A8306E3.pf| |c:/WINDOWS/system32/drivers/etc_______________________________________________________________|hlsts___________________| **** Files_(Deleted)_-_ICC_Results **** _____________________ |Action|Path|File_Name| **** Files_(Changed)_-_ICC_Results **** ______________________________________________________________________________________________________________________ |Action__|Path__________________________________________________________________________________|File_Name_____________| |modified|c:/Documents_and_Settings/dmc73144/Cookies____________________________________________|index.dat_____________| |modified|c:/Documents_and_Settings/dmc73144/Local_Settings/History/History.IE5_________________|index.dat_____________| |modified|c:/Documents_and_Settings/dmc73144/Local_Settings/Temporary_Internet_Files/Content.IE5|index.dat_____________| |modified|c:/Documents_and_Settings/dmc73144____________________________________________________|ntuser.dat.LOG________| |modified|c:/WINDOWS/Prefetch___________________________________________________________________|ATTRIB.EXE-39EAFB02.pf| |modified|c:/WINDOWS/Prefetch___________________________________________________________________|CMD.EXE-087B4001.pf___| |modified|c:/WINDOWS/Prefetch___________________________________________________________________|HSTART.EXE-221D72BF.pf| |modified|c:/WINDOWS/Prefetch___________________________________________________________________|SH.EXE-00254D2B.pf____| |modified|c:/WINDOWS/Prefetch___________________________________________________________________|SSHD.EXE-298CA236.pf__| |modified|c:/WINDOWS/Prefetch___________________________________________________________________|SWITCH.EXE-0496EC21.pf| |modified|c:/WINDOWS/system32/drivers/etc_______________________________________________________|hosts_________________| |modified|c:/WINDOWS/system32/wbem/Repository/FS________________________________________________|INDEX.MAP_____________| |modified|c:/WINDOWS/system32/wbem/Repository/FS________________________________________________|MAPPING.VER___________| |modified|c:/WINDOWS/system32/wbem/Repository/FS________________________________________________|MAPPING2.MAP__________| |modified|c:/WINDOWS/system32/wbem/Repository/FS________________________________________________|OBJECTS.MAP___________| **** Registry_Keys_(Added)_-_ICC_Results **** _______________________________________________________________________________________________________________________________________________________________________ |Action|Path____________________________________________________________________________________________________________________________________________________________| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Explorer/RecentDocs/.jpg_____________________________________________| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Internet_Settings/5.0/Cache/Extensible_Cache/MSHist012011090920110910| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/WinRAR_SFX____________________________________________________________________________________________| **** Registry_Values_(Added)_-_ICC_Results **** ______________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________ |Action|Path____________________________________________________________________________________________________________________________________________________________|Val_Name_____________________________________|Val_Data________________________________________________________________________| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Explorer/RecentDocs__________________________________________________|9____________________________________________|30_00_30_00_30_00_30_00_71_00_30_00_68_00_62_00_2E_00_6A_00_70_00_67_00_00_00_58| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Explorer/RecentDocs__________________________________________________|10___________________________________________|64_00_6D_00_63_00_37_00_33_00_31_00_34_00_34_00_00_00_4C_00_32_00_00_00_00_00_00| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Explorer/RecentDocs/Folder___________________________________________|4____________________________________________|64_00_6D_00_63_00_37_00_33_00_31_00_34_00_34_00_00_00_4C_00_32_00_00_00_00_00_00| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Explorer/RecentDocs/.jpg_____________________________________________|0____________________________________________|30_00_30_00_30_00_30_00_71_00_30_00_68_00_62_00_2E_00_6A_00_70_00_67_00_00_00_58| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Explorer/RecentDocs/.jpg_____________________________________________|MRUListEx____________________________________|00_00_00_00_FF_FF_FF_FF_________________________________________________________| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Internet_Settings/5.0/Cache/Extensible_Cache/MSHist012011090920110910|CachePath____________________________________|"%USERPROFILE%Local_SettingsHistoryHistory.IE5MSHist012011090920110910"_________| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Internet_Settings/5.0/Cache/Extensible_Cache/MSHist012011090920110910|CachePrefix__________________________________|":2011090920110910:_"___________________________________________________________| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Internet_Settings/5.0/Cache/Extensible_Cache/MSHist012011090920110910|CacheLimit___________________________________|0x00002000______________________________________________________________________| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Internet_Settings/5.0/Cache/Extensible_Cache/MSHist012011090920110910|CacheOptions_________________________________|0x0000000B______________________________________________________________________| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Internet_Settings/5.0/Cache/Extensible_Cache/MSHist012011090920110910|CacheRepair__________________________________|0x00000000______________________________________________________________________| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/ShellNoRoam/MUICache________________________________________________________________|C://Documents_and_Settings//dmc73144//rnm.exe|"rnm"___________________________________________________________________________| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/WinRAR_SFX____________________________________________________________________________________________|C%%Documents_and_Settings%dmc73144___________|"C:/Documents_and_Settings/dmc73144"____________________________________________| **** Registry_Values_(Deleted)_-_ICC_Results **** ________________________________________________________________ |Action|Path|Val_Name|Val_Type|Mod_Val_Type|Val_Data|Mod_Val_Data| **** Registry_Values_(Changed)_-_ICC_Results **** __________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________ |Action__|Path_________________________________________________________________________________________________________________|Val_Name_|Val_Data________________________________________________________________________|Mod_Val_Data____________________________________________________________________| |modified|HKLM/SOFTWARE/Microsoft/Cryptography/RNG_____________________________________________________________________________|Seed_____|96_01_7C_CE_00_35_81_50_4E_54_A9_9A_4B_A6_DA_D4_6C_DD_02_0D_81_9E_73_44_21_9A_98|4D_DD_F5_8E_E8_D9_00_B9_D5_E4_65_46_17_75_C7_3C_E4_6D_0D_B8_A3_39_13_3C_A5_74_52| |modified|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Explorer/RecentDocs_______|MRUListEx|03_00_00_00_02_00_00_00_00_00_00_00_08_00_00_00_07_00_00_00_06_00_00_00_05_00_00|0A_00_00_00_09_00_00_00_03_00_00_00_02_00_00_00_00_00_00_00_08_00_00_00_07_00_00| |modified|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Explorer/RecentDocs/Folder|MRUListEx|01_00_00_00_03_00_00_00_02_00_00_00_00_00_00_00_FF_FF_FF_FF_____________________|04_00_00_00_01_00_00_00_03_00_00_00_02_00_00_00_00_00_00_00_FF_FF_FF_FF_________| **** DNS_Results **** ________________ |DNS|DNS_Response| **** URL_Results **** _________________________________________________________ |DstIP|HTTP_HOST|HTTP_REQUEST_URI|HTTP_USER_AGENT|PROTOCOL| **** ARGUS_PROTOCOL_Results **** ______________________________________________ |PROTOCOL|SRC_PKTS|DST_PKTS|SRC_BYTES|DST_BYTES| **** ARGUS_DPORT_Results **** ____________________________________________________ |DPORT|PROTOCOL|SRC_PKTS|DST_PKTS|SRC_BYTES|DST_BYTES| **** ARGUS_DATA_Results **** _______________________________________________________________ |Time|Date|Protocol|SrcIP|DstIP|Dir|Flags|Sport|Dport|Pkts|Bytes| **** Packer_Results **** ___________ |Packer_Name| **** HoneyTrap_Results **** ____________________________ |Honey_Trap_Log_File_Location| **** PTFB_Results **** ______________________ |PTFB_Log_File_Location|