Malware Report

This report shows all the different areas TAZER analyzes for the sample: Host, Network Activity, and Detection.

Malware Search Criteria:

MD5 =75d4d437c5dff63085279696fb8eff63

File MD5Sum	SHA1SUM	SHA256SUM	FUZZY HASH	File Size
75d4d437c5dff63085279696fb8eff63	6fd2c1f5afb5236a92c20cd818fbda1e60a416d5	23b2a151fb0fd662686058cab7914914dd88b9ccc7ce1198ff4932b6f2cf240d	768:IRGuY2P0Vo6r7SiAwyrMRjb5nnbcuyD7U5:GPcVo6r7S/rabNnouy8	90624

File Name
makat.exe

Snort Class	Snort Alert	Count
N/A	No snort alerts generated	0

Path	Folder Name

Action	Path	File Name

Action	Path	File Name
modified	c:/Documents and Settings/dmc73144	ntuser.dat.LOG
modified	c:/WINDOWS/Prefetch	ATTRIB.EXE-39EAFB02.pf
modified	c:/WINDOWS/Prefetch	CMD.EXE-087B4001.pf
modified	c:/WINDOWS/Prefetch	NETSTAT.EXE-2B2B4428.pf
modified	c:/WINDOWS/Prefetch	SH.EXE-00254D2B.pf
modified	c:/WINDOWS/Prefetch	SLEEP.EXE-094A3D2A.pf
modified	c:/WINDOWS/Prefetch	SSHD.EXE-298CA236.pf
modified	c:/WINDOWS/Prefetch	SWITCH.EXE-0496EC21.pf
modified	c:/WINDOWS/Prefetch	TASKLIST.EXE-10D94B23.pf
modified	c:/WINDOWS/Prefetch	WMIPRVSE.EXE-28F301A9.pf
modified	c:/WINDOWS/system32/config	system.LOG
modified	c:/WINDOWS/system32/drivers/etc	hosts
modified	c:/WINDOWS/system32/wbem/Logs	wbemess.log
modified	c:/WINDOWS/system32/wbem/Logs	wmiprov.log
modified	c:/WINDOWS/system32/wbem/Repository/FS	INDEX.BTR
modified	c:/WINDOWS/system32/wbem/Repository/FS	INDEX.MAP
modified	c:/WINDOWS/system32/wbem/Repository/FS	MAPPING.VER
modified	c:/WINDOWS/system32/wbem/Repository/FS	MAPPING1.MAP
modified	c:/WINDOWS/system32/wbem/Repository/FS	MAPPING2.MAP
modified	c:/WINDOWS/system32/wbem/Repository/FS	OBJECTS.DATA
modified	c:/WINDOWS/system32/wbem/Repository/FS	OBJECTS.MAP

Action	Path

Action	Path	Val_Name	Val_Data

Action	Path	Val_Name	Val_Type	Mod_Val_Type	Val_Data	Mod_Val_Data

Action	Path	Val_Name	Val_Data	Mod_Val_Data
modified	HKLM/SOFTWARE/Microsoft/Cryptography/RNG	Seed	F8 CD 13 79 03 5D 30 92 7E A8 6E 25 C4 08 CE DF 8B 23 73 BE 69 95 BC 33 C5 79 7F	BD 5A E1 A1 73 AC CD 66 4E 65 B3 BA 74 EF 1F 78 F9 6C CA 22 39 A7 D8 B6 52 A4 7
modified	HKLM/SYSTEM/ControlSet001/Services/SharedAccess/Epoch	Epoch	0x00000104	0x00000108
modified	HKLM/SYSTEM/ControlSet001/Services/Tcpip/Parameters/Interfaces/{9B7E3E9B-6887-4894-8EE4-B4EFDC3EBE75}	NameServer	"10.10.10.2"	"8.8.8.8,8.8.4.4,10.10.10.2"
modified	HKLM/SYSTEM/CurrentControlSet/Services/SharedAccess/Epoch	Epoch	0x00000104	0x00000108
modified	HKLM/SYSTEM/CurrentControlSet/Services/Tcpip/Parameters/Interfaces/{9B7E3E9B-6887-4894-8EE4-B4EFDC3EBE75}	NameServer	"10.10.10.2"	"8.8.8.8,8.8.4.4,10.10.10.2"

DNS	DNS Response

DstIP	HTTP_HOST	HTTP_REQUEST_URI	HTTP_USER_AGENT	PROTOCOL

PROTOCOL	SRC_PKTS	DST_PKTS	SRC_BYTES	DST_BYTES

DPORT	PROTOCOL	SRC_PKTS	DST_PKTS	SRC_BYTES	DST_BYTES

Time	Date	Protocol	SrcIP	DstIP	Dir	Flags	Sport	Dport	Pkts	Bytes

Packer Name

Honey Trap Log File Location

PTFB Log File Location