**** Malware_Report_-_Results **** This report shows all the different areas TAZER analyzes for the sample: Host, Network Activity, and Detection. Malware Search Criteria: MD5 =aacdc783b5681ce6d269e086e70d85de **** Malware_Report_-_Results **** _____________________________________________________________________________________________________________________________________________________________________________________________________________________________________ |File_MD5Sum_____________________|SHA1SUM_________________________________|SHA256SUM_______________________________________________________|FUZZY_HASH______________________________________________________________________|File_Size| |aacdc783b5681ce6d269e086e70d85de|de90d290a91c5b8fcc6cf90628d52ec6cd648f53|e71b27edfd371f056739e64615784047960d31c0ec9c5cba2f4ac15fe35d76dd|12288:5yVaekvacnivjzx5iuS/Woh5utDb/kCH3qu0B1WUakdrVAaS3:Y+bibbiuS5hwxDzWXNa4r+aS|584324___| **** File_Results **** ____________________________ |File_Name___________________| |xxx%5Fvideo%5F836674.avi.exe| |xxx%5Fvideo%5F683.avi.exe___| |www.mjsn.org.exe____________| |statistics.php.exe__________| |l.php.exe___________________| |index.php.exe_______________| |in.cgi%3F2.exe______________| |hcp.php.exe_________________| |exe.exe_____________________| |counter.php.exe_____________| |amor.exe____________________| **** SNORT_Results **** ___________________________________________ |Snort_Class|Snort_Alert______________|Count| |N/A________|No_snort_alerts_generated|0____| **** AV_Results **** __________________ |AV_Alert|AV_Vendor| **** Folders_(Added)_-_ICC_Results **** ________________ |Path|Folder_Name| **** Files_(Added)_-_ICC_Results **** ________________________________________________________________________________ |Path__________________________________________________|File_Name________________| |c:/DELL/VIDEO/OUTPUT__________________________________|netstat_base.txt_________| |c:/DELL/VIDEO/OUTPUT__________________________________|netstat_post.txt_________| |c:/DELL/VIDEO/OUTPUT__________________________________|tasksvc_base.txt_________| |c:/DELL/VIDEO/OUTPUT__________________________________|tasksvc_post.txt_________| |c:/DELL/VIDEO/OUTPUT__________________________________|taskv_base.txt___________| |c:/DELL/VIDEO/OUTPUT__________________________________|taskv_post.txt___________| |c:/Documents_and_Settings/dmc73144/Local_Settings/Temp|php1.tmp_________________| |c:/Documents_and_Settings/dmc73144/Local_Settings/Temp|php2.tmp_________________| |c:/Documents_and_Settings/dmc73144/Local_Settings/Temp|php3.tmp_________________| |c:/WINDOWS/Prefetch___________________________________|7Z.EXE-1A62CD19.pf_______| |c:/WINDOWS/Prefetch___________________________________|NETSH.EXE-085CFFDE.pf____| |c:/WINDOWS/Prefetch___________________________________|REG.EXE-0D2A95F7.pf______| |c:/WINDOWS/Prefetch___________________________________|SVCHOTS.EXE-20933DD1.pf__| |c:/DELL/VIDEO/OUTPUT__________________________________|netstat_base.txt_________| |c:/DELL/VIDEO/OUTPUT__________________________________|netstat_post.txt_________| |c:/DELL/VIDEO/OUTPUT__________________________________|tasksvc_base.txt_________| |c:/DELL/VIDEO/OUTPUT__________________________________|tasksvc_post.txt_________| |c:/DELL/VIDEO/OUTPUT__________________________________|taskv_base.txt___________| |c:/DELL/VIDEO/OUTPUT__________________________________|taskv_post.txt___________| |c:/Documents_and_Settings/dmc73144/Local_Settings/Temp|php1.tmp_________________| |c:/Documents_and_Settings/dmc73144/Local_Settings/Temp|php2.tmp_________________| |c:/Documents_and_Settings/dmc73144/Local_Settings/Temp|php3.tmp_________________| |c:/WINDOWS/Prefetch___________________________________|7Z.EXE-1A62CD19.pf_______| |c:/WINDOWS/Prefetch___________________________________|CYGRUNSRV.EXE-01BF82AE.pf| |c:/WINDOWS/Prefetch___________________________________|NETSH.EXE-085CFFDE.pf____| |c:/WINDOWS/Prefetch___________________________________|REG.EXE-0D2A95F7.pf______| |c:/WINDOWS/Prefetch___________________________________|SVCHOTS.EXE-20933DD1.pf__| |c:/DELL/VIDEO/OUTPUT__________________________________|netstat_base.txt_________| |c:/DELL/VIDEO/OUTPUT__________________________________|netstat_post.txt_________| |c:/DELL/VIDEO/OUTPUT__________________________________|tasksvc_base.txt_________| |c:/DELL/VIDEO/OUTPUT__________________________________|tasksvc_post.txt_________| |c:/DELL/VIDEO/OUTPUT__________________________________|taskv_base.txt___________| |c:/DELL/VIDEO/OUTPUT__________________________________|taskv_post.txt___________| |c:/Documents_and_Settings/dmc73144/Local_Settings/Temp|php1.tmp_________________| |c:/Documents_and_Settings/dmc73144/Local_Settings/Temp|php2.tmp_________________| |c:/Documents_and_Settings/dmc73144/Local_Settings/Temp|php3.tmp_________________| |c:/WINDOWS/Prefetch___________________________________|7Z.EXE-1A62CD19.pf_______| |c:/WINDOWS/Prefetch___________________________________|NETSH.EXE-085CFFDE.pf____| |c:/WINDOWS/Prefetch___________________________________|REG.EXE-0D2A95F7.pf______| |c:/WINDOWS/Prefetch___________________________________|SVCHOTS.EXE-20933DD1.pf__| |c:/Documents_and_Settings/dmc73144/Local_Settings/Temp|php1.tmp_________________| |c:/Documents_and_Settings/dmc73144/Local_Settings/Temp|php2.tmp_________________| |c:/Documents_and_Settings/dmc73144/Local_Settings/Temp|php3.tmp_________________| |c:/WINDOWS/Prefetch___________________________________|NET.EXE-01A53C2F.pf______| |c:/WINDOWS/Prefetch___________________________________|NET1.EXE-029B9DB4.pf_____| |c:/WINDOWS/Prefetch___________________________________|NETSH.EXE-085CFFDE.pf____| |c:/WINDOWS/Prefetch___________________________________|REG.EXE-0D2A95F7.pf______| |c:/WINDOWS/Prefetch___________________________________|SVCHOTS.EXE-20933DD1.pf__| |c:/WINDOWS/Prefetch___________________________________|WSCRIPT.EXE-32960AB9.pf__| |c:____________________________________________________|netstat_post.txt_________| |c:____________________________________________________|taskv_post.txt___________| **** Files_(Deleted)_-_ICC_Results **** _____________________ |Action|Path|File_Name| **** Files_(Changed)_-_ICC_Results **** ________________________________________________________________________ |Action__|Path__________________________________|File_Name_______________| |modified|c:/Documents_and_Settings/dmc73144____|ntuser.dat.LOG__________| |modified|c:/WINDOWS/Prefetch___________________|CMD.EXE-087B4001.pf_____| |modified|c:/WINDOWS/Prefetch___________________|NETSTAT.EXE-2B2B4428.pf_| |modified|c:/WINDOWS/Prefetch___________________|SH.EXE-00254D2B.pf______| |modified|c:/WINDOWS/Prefetch___________________|SSHD.EXE-298CA236.pf____| |modified|c:/WINDOWS/Prefetch___________________|SWITCH.EXE-0496EC21.pf__| |modified|c:/WINDOWS/Prefetch___________________|TASKLIST.EXE-10D94B23.pf| |modified|c:/WINDOWS/Prefetch___________________|WMIPRVSE.EXE-28F301A9.pf| |modified|c:/WINDOWS/system32/config____________|software.LOG____________| |modified|c:/WINDOWS/system32/drivers/etc_______|hosts___________________| |modified|c:/WINDOWS/system32/wbem/Logs_________|wbemess.log_____________| |modified|c:/WINDOWS/system32/wbem/Logs_________|wmiprov.log_____________| |modified|c:/WINDOWS/system32/wbem/Repository/FS|INDEX.MAP_______________| |modified|c:/WINDOWS/system32/wbem/Repository/FS|MAPPING.VER_____________| |modified|c:/WINDOWS/system32/wbem/Repository/FS|MAPPING2.MAP____________| |modified|c:/WINDOWS/system32/wbem/Repository/FS|OBJECTS.MAP_____________| |modified|c:/Documents_and_Settings/dmc73144____|ntuser.dat.LOG__________| |modified|c:/WINDOWS/Prefetch___________________|CMD.EXE-087B4001.pf_____| |modified|c:/WINDOWS/Prefetch___________________|NET.EXE-01A53C2F.pf_____| |modified|c:/WINDOWS/Prefetch___________________|NET1.EXE-029B9DB4.pf____| |modified|c:/WINDOWS/Prefetch___________________|NETSTAT.EXE-2B2B4428.pf_| |modified|c:/WINDOWS/Prefetch___________________|SH.EXE-00254D2B.pf______| |modified|c:/WINDOWS/Prefetch___________________|SLEEP.EXE-094A3D2A.pf___| |modified|c:/WINDOWS/Prefetch___________________|SSHD.EXE-298CA236.pf____| |modified|c:/WINDOWS/Prefetch___________________|SWITCH.EXE-0496EC21.pf__| |modified|c:/WINDOWS/Prefetch___________________|TASKLIST.EXE-10D94B23.pf| |modified|c:/WINDOWS/Prefetch___________________|WMIPRVSE.EXE-28F301A9.pf| |modified|c:/WINDOWS/system32/config____________|software.LOG____________| |modified|c:/WINDOWS/system32/drivers/etc_______|hosts___________________| |modified|c:/WINDOWS/system32/wbem/Logs_________|wbemess.log_____________| |modified|c:/WINDOWS/system32/wbem/Logs_________|wmiprov.log_____________| |modified|c:/WINDOWS/system32/wbem/Repository/FS|INDEX.MAP_______________| |modified|c:/WINDOWS/system32/wbem/Repository/FS|MAPPING.VER_____________| |modified|c:/WINDOWS/system32/wbem/Repository/FS|MAPPING2.MAP____________| |modified|c:/WINDOWS/system32/wbem/Repository/FS|OBJECTS.MAP_____________| |modified|c:/Documents_and_Settings/dmc73144____|ntuser.dat.LOG__________| |modified|c:/WINDOWS/Prefetch___________________|CMD.EXE-087B4001.pf_____| |modified|c:/WINDOWS/Prefetch___________________|NET.EXE-01A53C2F.pf_____| |modified|c:/WINDOWS/Prefetch___________________|NET1.EXE-029B9DB4.pf____| |modified|c:/WINDOWS/Prefetch___________________|NETSTAT.EXE-2B2B4428.pf_| |modified|c:/WINDOWS/Prefetch___________________|SH.EXE-00254D2B.pf______| |modified|c:/WINDOWS/Prefetch___________________|SSHD.EXE-298CA236.pf____| |modified|c:/WINDOWS/Prefetch___________________|SWITCH.EXE-0496EC21.pf__| |modified|c:/WINDOWS/Prefetch___________________|TASKLIST.EXE-10D94B23.pf| |modified|c:/WINDOWS/Prefetch___________________|WMIPRVSE.EXE-28F301A9.pf| |modified|c:/WINDOWS/system32/config____________|software.LOG____________| |modified|c:/WINDOWS/system32/drivers/etc_______|hosts___________________| |modified|c:/WINDOWS/system32/wbem/Logs_________|wbemess.log_____________| |modified|c:/WINDOWS/system32/wbem/Logs_________|wmiprov.log_____________| |modified|c:/WINDOWS/system32/wbem/Repository/FS|INDEX.MAP_______________| |modified|c:/WINDOWS/system32/wbem/Repository/FS|MAPPING.VER_____________| |modified|c:/WINDOWS/system32/wbem/Repository/FS|MAPPING2.MAP____________| |modified|c:/WINDOWS/system32/wbem/Repository/FS|OBJECTS.MAP_____________| |modified|c:/Documents_and_Settings/dmc73144____|ntuser.dat.LOG__________| |modified|c:/WINDOWS/Prefetch___________________|CMD.EXE-087B4001.pf_____| |modified|c:/WINDOWS/Prefetch___________________|NETSTAT.EXE-2B2B4428.pf_| |modified|c:/WINDOWS/Prefetch___________________|SH.EXE-00254D2B.pf______| |modified|c:/WINDOWS/Prefetch___________________|SLEEP.EXE-094A3D2A.pf___| |modified|c:/WINDOWS/Prefetch___________________|SSHD.EXE-298CA236.pf____| |modified|c:/WINDOWS/Prefetch___________________|SWITCH.EXE-0496EC21.pf__| |modified|c:/WINDOWS/Prefetch___________________|TASKLIST.EXE-10D94B23.pf| |modified|c:/WINDOWS/system32/config____________|software.LOG____________| |modified|c:/WINDOWS/system32/drivers/etc_______|hosts___________________| |modified|c:/WINDOWS/system32/wbem/Repository/FS|INDEX.MAP_______________| |modified|c:/WINDOWS/system32/wbem/Repository/FS|MAPPING.VER_____________| |modified|c:/WINDOWS/system32/wbem/Repository/FS|MAPPING1.MAP____________| |modified|c:/WINDOWS/system32/wbem/Repository/FS|OBJECTS.MAP_____________| **** Registry_Keys_(Added)_-_ICC_Results **** ___________ |Action|Path| **** Registry_Values_(Added)_-_ICC_Results **** _____________________________ |Action|Path|Val_Name|Val_Data| **** Registry_Values_(Deleted)_-_ICC_Results **** ________________________________________________________________ |Action|Path|Val_Name|Val_Type|Mod_Val_Type|Val_Data|Mod_Val_Data| **** Registry_Values_(Changed)_-_ICC_Results **** __________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________ |Action__|Path_______________________________________________________________|Val_Name____|Val_Data________________________________________________________________________|Mod_Val_Data___________________________________________________________________| |modified|HKLM/SOFTWARE/Microsoft/Cryptography/RNG___________________________|Seed________|98_0D_56_B1_C2_97_75_EE_62_1F_B6_71_C8_09_E5_2F_B8_DC_1C_5D_4E_40_FF_CA_46_7D_9A|63_F6_AB_D7_6D_49_E2_D4_55_3A_A3_F6_E6_78_43_9D_CE_67_6D_46_87_7A_21_A5_B0_00_3| |modified|HKU/S-1-5-21-1844237615-562591055-839522115-1004/SessionInformation|ProgramCount|0x00000002______________________________________________________________________|0x00000001_____________________________________________________________________| |modified|HKLM/SOFTWARE/Microsoft/Cryptography/RNG___________________________|Seed________|6E_6C_D6_F4_54_E7_82_07_FF_78_4F_81_5F_07_4D_C4_8C_97_A6_2D_DF_85_75_A7_41_5C_9A|C6_21_9C_42_95_46_9C_9A_12_A7_EF_57_79_98_1A_66_C8_E0_90_FC_26_F0_0C_A4_BE_04_5| |modified|HKU/S-1-5-21-1844237615-562591055-839522115-1004/SessionInformation|ProgramCount|0x00000002______________________________________________________________________|0x00000001_____________________________________________________________________| |modified|HKLM/SOFTWARE/Microsoft/Cryptography/RNG___________________________|Seed________|55_5F_D9_7A_C9_02_34_7D_3A_9E_62_35_45_71_1D_05_CA_C1_D7_3B_54_A6_96_4F_9D_18_0D|BF_0D_21_42_1C_BF_87_E2_0A_24_01_80_3A_05_B0_97_AA_A4_67_EE_87_6E_31_DD_85_B1_9| |modified|HKU/S-1-5-21-1844237615-562591055-839522115-1004/SessionInformation|ProgramCount|0x00000002______________________________________________________________________|0x00000001_____________________________________________________________________| |modified|HKLM/SOFTWARE/Microsoft/Cryptography/RNG___________________________|Seed________|ED_03_53_B8_A0_81_22_21_1C_AA_AC_FE_74_AE_9F_15_FB_90_1E_F0_B7_95_2C_8C_2C_C2_2F|F6_74_8A_71_E0_0D_99_CD_24_27_A1_75_EC_4B_96_4B_22_6B_1A_87_F0_9D_0A_0E_CD_FA_2| |modified|HKU/S-1-5-21-1844237615-562591055-839522115-1004/SessionInformation|ProgramCount|0x00000002______________________________________________________________________|0x00000001_____________________________________________________________________| **** DNS_Results **** ____________________________________________________________________ |DNS_________________________|DNS_Response___________________________| |multiserviciosblackcat.co.cc|Standard_query_response_A_72.14.253.104| |multiserviciosblackcat.co.cc|Standard_query_response_A_209.51.159.34| **** URL_Results **** ______________________________________________________________________________ |DstIP__________|HTTP_HOST___________|HTTP_REQUEST_URI|HTTP_USER_AGENT|PROTOCOL| |239.255.255.250|239.255.255.250:1900|*_______________|--blank--______|0x11____| **** ARGUS_PROTOCOL_Results **** ______________________________________________ |PROTOCOL|SRC_PKTS|DST_PKTS|SRC_BYTES|DST_BYTES| |17______|2_______|0_______|350______|0________| **** ARGUS_DPORT_Results **** ____________________________________________________ |DPORT|PROTOCOL|SRC_PKTS|DST_PKTS|SRC_BYTES|DST_BYTES| |1900_|17______|2_______|0_______|350______|0________| **** ARGUS_DATA_Results **** ________________________________________________________________________________________ |Time____|Date______|Protocol|SrcIP_____|DstIP__________|Dir|Flags|Sport|Dport|Pkts|Bytes| |17:17:15|2010-08-17|17______|10.10.10.7|239.255.255.250|->_|e____|8____|1900_|2___|350__| |22:40:48|2010-08-17|17______|10.10.10.7|239.255.255.250|->_|e____|8____|1900_|2___|350__| |09:36:57|2010-08-18|17______|10.10.10.7|239.255.255.250|->_|e____|8____|1900_|2___|350__| |03:11:17|2010-08-19|17______|10.10.10.7|239.255.255.250|->_|e____|8____|1900_|2___|350__| **** Packer_Results **** ___________ |Packer_Name| **** HoneyTrap_Results **** ____________________________ |Honey_Trap_Log_File_Location| **** PTFB_Results **** ______________________ |PTFB_Log_File_Location|