Malware Report

This report shows all the different areas TAZER analyzes for the sample: Host, Network Activity, and Detection.

Malware Search Criteria:

MD5 =939d68ee5e9b4396f06a889b08b5ec9a

File MD5Sum	SHA1SUM	SHA256SUM	FUZZY HASH	File Size
939d68ee5e9b4396f06a889b08b5ec9a	d33d977e3021cce0823787ad3096c52567bc4c0b	749f2d138e631fe5efbd46c512161fca1d6c323ee3139498873ac0a44600b38d	768:UT9+8RN6UTqiV/Wy9MugNSh4pNY7RlzjIe/iuNorltD4RE6+3aDt49MBuRa+Ks:U5vrigWyVZh4w	49152

File Name
kp.jpg.exe

Snort Class	Snort Alert	Count
N/A	No snort alerts generated	0

AV Alert	AV Vendor

Path	Folder Name

Path	File Name
c:/Documents and Settings/dmc73144/Local Settings/Temp	i88o7ar.exe
c:/Documents and Settings/dmc73144/Local Settings/Temp	MouseDriver.bat
c:/Documents and Settings/dmc73144/Local Settings/Temp	nftngqxl.bat
c:/Documents and Settings/dmc73144/Local Settings/Temp	~DF673.tmp
c:/WINDOWS/Prefetch	GRPCONV.EXE-111CD845.pf
c:/WINDOWS/Prefetch	I88O7AR.EXE-3AC08857.pf
c:/WINDOWS/Prefetch	NET.EXE-01A53C2F.pf
c:/WINDOWS/Prefetch	NET1.EXE-029B9DB4.pf
c:/WINDOWS/Prefetch	RUNDLL32.EXE-4B010C9D.pf
c:/WINDOWS/Prefetch	RUNONCE.EXE-2803F297.pf
c:/WINDOWS/Prefetch	SANDNET.EXE-2012C478.pf
c:/WINDOWS/Prefetch	SC.EXE-012262AF.pf
c:/WINDOWS/Prefetch	SVCHOST.EXE-3530F672.pf
c:/WINDOWS/system32	gojz.log
c:	netstat_post.txt
c:	tasksvc_post.txt
c:	taskv_post.txt

Action	Path	File Name

Action	Path	File Name
modified	c:/Documents and Settings/dmc73144/Cookies	index.dat
modified	c:/Documents and Settings/dmc73144/Local Settings/History/History.IE5	index.dat
modified	c:/Documents and Settings/dmc73144/Local Settings/Temporary Internet Files/Content.IE5	index.dat
modified	c:/Documents and Settings/dmc73144	ntuser.dat.LOG
modified	c:/Documents and Settings/LocalService	ntuser.dat.LOG
modified	c:/WINDOWS/Prefetch	CMD.EXE-087B4001.pf
modified	c:/WINDOWS/Prefetch	HSTART.EXE-221D72BF.pf
modified	c:/WINDOWS/Prefetch	NETSTAT.EXE-2B2B4428.pf
modified	c:/WINDOWS/Prefetch	SH.EXE-00254D2B.pf
modified	c:/WINDOWS/Prefetch	SLEEP.EXE-094A3D2A.pf
modified	c:/WINDOWS/Prefetch	SSHD.EXE-298CA236.pf
modified	c:/WINDOWS/Prefetch	SWITCH.EXE-0496EC21.pf
modified	c:/WINDOWS/Prefetch	TASKLIST.EXE-10D94B23.pf
modified	c:/WINDOWS/system32/config	software.LOG
modified	c:/WINDOWS/system32/config	system.LOG
modified	c:/WINDOWS/system32/drivers/etc	hosts
modified	c:/WINDOWS/system32/wbem/Logs	wbemess.log
modified	c:/WINDOWS/system32/wbem/Logs	wmiprov.log
modified	c:/WINDOWS/system32/wbem/Repository/FS	INDEX.MAP
modified	c:/WINDOWS/system32/wbem/Repository/FS	MAPPING.VER
modified	c:/WINDOWS/system32/wbem/Repository/FS	MAPPING2.MAP
modified	c:/WINDOWS/system32/wbem/Repository/FS	OBJECTS.MAP

Action	Path

Action	Path	Val_Name	Val_Data

Action	Path	Val_Name	Val_Type	Mod_Val_Type	Val_Data	Mod_Val_Data

Action	Path	Val_Name	Val_Data	Mod_Val_Data
modified	HKLM/SOFTWARE/Microsoft/Cryptography/RNG	Seed	36 FA 90 A8 6F 2C 0B 44 7D BC 9C FA A5 83 43 FF 40 62 5F 16 6D C2 F5 9D 84 46 9A	96 07 F1 30 94 07 01 62 DB EF 07 AC 36 25 A1 F8 1F 84 DD AB 91 53 55 F8 5B 49 A
modified	HKLM/SOFTWARE/Microsoft/Windows NT/CurrentVersion/ProfileList/S-1-5-19	RefCount	0x00000002	0x00000001
modified	HKLM/SYSTEM/ControlSet001/Services/SharedAccess	Start	0x00000002	0x00000004
modified	HKLM/SYSTEM/ControlSet001/Services/SharedAccess/Epoch	Epoch	0x00000104	0x00000105
modified	HKLM/SYSTEM/ControlSet001/Services/wscsvc	Start	0x00000002	0x00000004
modified	HKLM/SYSTEM/CurrentControlSet/Services/SharedAccess	Start	0x00000002	0x00000004
modified	HKLM/SYSTEM/CurrentControlSet/Services/SharedAccess/Epoch	Epoch	0x00000104	0x00000105
modified	HKLM/SYSTEM/CurrentControlSet/Services/wscsvc	Start	0x00000002	0x00000004
modified	HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Internet Settings/Connections	SavedLegacySettings	3C 00 00 00 15 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00	3C 00 00 00 16 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0
modified	HKU/S-1-5-21-1844237615-562591055-839522115-1004/SessionInformation	ProgramCount	0x00000002	0x00000001

DNS	DNS Response
w.nucleardiscover.com	Standard query response A 60.190.223.75

DstIP	HTTP_HOST	HTTP_REQUEST_URI	HTTP_USER_AGENT	PROTOCOL

PROTOCOL	SRC_PKTS	DST_PKTS	SRC_BYTES	DST_BYTES
6	57	62	4692	3728

DPORT	PROTOCOL	SRC_PKTS	DST_PKTS	SRC_BYTES	DST_BYTES
888	6	57	62	4692	3728

Time	Date	Protocol	SrcIP	DstIP	Dir	Flags	Sport	Dport	Pkts	Bytes
17:13:29	2011-04-14	6	10.10.10.7	60.190.223.75	->	e	316	888	13	1100
17:13:34	2011-04-14	6	10.10.10.7	60.190.223.75	->	e	316	888	11	660
17:13:39	2011-04-14	6	10.10.10.7	60.190.223.75	->	e	316	888	5	300
17:14:41	2011-04-14	6	10.10.10.7	60.190.223.75	->	e	578	888	14	1163
17:14:46	2011-04-14	6	10.10.10.7	60.190.223.75	->	e	578	888	11	660
17:14:52	2011-04-14	6	10.10.10.7	60.190.223.75	->	e	578	888	4	240
17:15:52	2011-04-14	6	10.10.10.7	60.190.223.75	->	e	260	888	13	1100
17:15:57	2011-04-14	6	10.10.10.7	60.190.223.75	->	e	260	888	10	600
17:16:02	2011-04-14	6	10.10.10.7	60.190.223.75	->	e	260	888	6	360
17:17:03	2011-04-14	6	10.10.10.7	60.190.223.75	->	e	811	888	13	1097
17:17:08	2011-04-14	6	10.10.10.7	60.190.223.75	->	e	811	888	11	660
17:17:13	2011-04-14	6	10.10.10.7	60.190.223.75	->	e d	811	888	4	240
17:17:20	2011-04-14	6	10.10.10.7	60.190.223.75	->	e d	811	888	1	60
17:17:26	2011-04-14	6	10.10.10.7	60.190.223.75	->	e d	811	888	1	60
17:17:40	2011-04-14	6	10.10.10.7	60.190.223.75	->	e d	811	888	1	60
17:18:08	2011-04-14	6	10.10.10.7	60.190.223.75	->	e d	811	888	1	60

Packer Name

Honey Trap Log File Location

PTFB Log File Location