**** Malware_Report_-_Results **** This report shows all the different areas TAZER analyzes for the sample: Host, Network Activity, and Detection. Malware Search Criteria: MD5 =b208bc8cf3ae4dfc8555056ee08bde21 **** Malware_Report_-_Results **** _____________________________________________________________________________________________________________________________________________________________________________________________________________________________________ |File_MD5Sum_____________________|SHA1SUM_________________________________|SHA256SUM_______________________________________________________|FUZZY_HASH______________________________________________________________________|File_Size| |b208bc8cf3ae4dfc8555056ee08bde21|9357afe64926dfe3ca4cd1586da5c7a12fba9636|b2f624d176df770fb022197ae58cf2016400f1dfba71947e0afbcf212795305b|6144:g27gCbTehEqclWYaci7TJxNdGazSDKTsmReZGVKnN7BgAOjQcpSEU:g27/bTehEqclr8DimIZGc|283709___| **** File_Results **** ________________ |File_Name_______| |Photo%2D5876.exe| **** SNORT_Results **** ___________________________________________ |Snort_Class|Snort_Alert______________|Count| |N/A________|No_snort_alerts_generated|0____| **** AV_Results **** __________________ |AV_Alert|AV_Vendor| |N/A_____|Symantec_| |N/A_____|McAfee___| |N/A_____|Kaspersky| **** Folders_(Added)_-_ICC_Results **** ______________________________________________________________________________________________ |Path_________________________________________________________________|Folder_Name_____________| |c:/Documents_and_Settings/dmc73144/Local_Settings/History/History.IE5|MSHist012011100420111005| **** Files_(Added)_-_ICC_Results **** _______________________________________________________________________________________________________________________ |Path__________________________________________________________________________________________|File_Name_______________| |c:/Documents_and_Settings/dmc73144/Local_Settings/History/History.IE5/MSHist012011100420111005|index.dat_______________| |c:/Documents_and_Settings/dmc73144/Recent_____________________________________________________|0000q0hb.jpg.lnk________| |c:/Documents_and_Settings/dmc73144/Recent_____________________________________________________|dmc73144.lnk____________| |c:/Documents_and_Settings/dmc73144____________________________________________________________|0000q0hb.jpg____________| |c:/WINDOWS/Prefetch___________________________________________________________________________|AUTOIT3.EXE-32361418.pf_| |c:/WINDOWS/Prefetch___________________________________________________________________________|CHCP.COM-18156052.pf____| |c:/WINDOWS/Prefetch___________________________________________________________________________|REGSHOT.EXE-010A5EE6.pf_| |c:/WINDOWS/Prefetch___________________________________________________________________________|RNM.EXE-04823DAF.pf_____| |c:/WINDOWS/Prefetch___________________________________________________________________________|RUNDLL32.EXE-369A6B7A.pf| |c:/WINDOWS/Prefetch___________________________________________________________________________|SANDNET.EXE-2012C478.pf_| |c:/WINDOWS/Prefetch___________________________________________________________________________|TASKKILL.EXE-0A8306E3.pf| |c:/WINDOWS/system32/drivers/etc_______________________________________________________________|hlsts___________________| **** Files_(Deleted)_-_ICC_Results **** _____________________ |Action|Path|File_Name| **** Files_(Changed)_-_ICC_Results **** ________________________________________________________________________________________________________________________ |Action__|Path__________________________________________________________________________________|File_Name_______________| |modified|c:/Documents_and_Settings/dmc73144/Cookies____________________________________________|index.dat_______________| |modified|c:/Documents_and_Settings/dmc73144/Local_Settings/History/History.IE5_________________|index.dat_______________| |modified|c:/Documents_and_Settings/dmc73144/Local_Settings/Temporary_Internet_Files/Content.IE5|index.dat_______________| |modified|c:/Documents_and_Settings/dmc73144____________________________________________________|ntuser.dat.LOG__________| |modified|c:/WINDOWS/Prefetch___________________________________________________________________|ATTRIB.EXE-39EAFB02.pf__| |modified|c:/WINDOWS/Prefetch___________________________________________________________________|CMD.EXE-087B4001.pf_____| |modified|c:/WINDOWS/Prefetch___________________________________________________________________|HSTART.EXE-221D72BF.pf__| |modified|c:/WINDOWS/Prefetch___________________________________________________________________|SH.EXE-00254D2B.pf______| |modified|c:/WINDOWS/Prefetch___________________________________________________________________|SLEEP.EXE-094A3D2A.pf___| |modified|c:/WINDOWS/Prefetch___________________________________________________________________|SSHD.EXE-298CA236.pf____| |modified|c:/WINDOWS/Prefetch___________________________________________________________________|SWITCH.EXE-0496EC21.pf__| |modified|c:/WINDOWS/Prefetch___________________________________________________________________|WMIPRVSE.EXE-28F301A9.pf| |modified|c:/WINDOWS/system32/drivers/etc_______________________________________________________|hosts___________________| |modified|c:/WINDOWS/system32/wbem/Repository/FS________________________________________________|INDEX.MAP_______________| |modified|c:/WINDOWS/system32/wbem/Repository/FS________________________________________________|MAPPING.VER_____________| |modified|c:/WINDOWS/system32/wbem/Repository/FS________________________________________________|MAPPING2.MAP____________| |modified|c:/WINDOWS/system32/wbem/Repository/FS________________________________________________|OBJECTS.MAP_____________| **** Registry_Keys_(Added)_-_ICC_Results **** _______________________________________________________________________________________________________________________________________________________________________ |Action|Path____________________________________________________________________________________________________________________________________________________________| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Explorer/RecentDocs/.jpg_____________________________________________| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Internet_Settings/5.0/Cache/Extensible_Cache/MSHist012011100420111005| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/WinRAR_SFX____________________________________________________________________________________________| **** Registry_Values_(Added)_-_ICC_Results **** ______________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________ |Action|Path____________________________________________________________________________________________________________________________________________________________|Val_Name_____________________________________|Val_Data________________________________________________________________________| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Explorer/RecentDocs__________________________________________________|9____________________________________________|30_00_30_00_30_00_30_00_71_00_30_00_68_00_62_00_2E_00_6A_00_70_00_67_00_00_00_58| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Explorer/RecentDocs__________________________________________________|10___________________________________________|64_00_6D_00_63_00_37_00_33_00_31_00_34_00_34_00_00_00_4C_00_32_00_00_00_00_00_00| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Explorer/RecentDocs/Folder___________________________________________|4____________________________________________|64_00_6D_00_63_00_37_00_33_00_31_00_34_00_34_00_00_00_4C_00_32_00_00_00_00_00_00| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Explorer/RecentDocs/.jpg_____________________________________________|0____________________________________________|30_00_30_00_30_00_30_00_71_00_30_00_68_00_62_00_2E_00_6A_00_70_00_67_00_00_00_58| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Explorer/RecentDocs/.jpg_____________________________________________|MRUListEx____________________________________|00_00_00_00_FF_FF_FF_FF_________________________________________________________| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Internet_Settings/5.0/Cache/Extensible_Cache/MSHist012011100420111005|CachePath____________________________________|"%USERPROFILE%Local_SettingsHistoryHistory.IE5MSHist012011100420111005"_________| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Internet_Settings/5.0/Cache/Extensible_Cache/MSHist012011100420111005|CachePrefix__________________________________|":2011100420111005:_"___________________________________________________________| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Internet_Settings/5.0/Cache/Extensible_Cache/MSHist012011100420111005|CacheLimit___________________________________|0x00002000______________________________________________________________________| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Internet_Settings/5.0/Cache/Extensible_Cache/MSHist012011100420111005|CacheOptions_________________________________|0x0000000B______________________________________________________________________| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Internet_Settings/5.0/Cache/Extensible_Cache/MSHist012011100420111005|CacheRepair__________________________________|0x00000000______________________________________________________________________| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/ShellNoRoam/MUICache________________________________________________________________|C://Documents_and_Settings//dmc73144//rnm.exe|"rnm"___________________________________________________________________________| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/WinRAR_SFX____________________________________________________________________________________________|C%%Documents_and_Settings%dmc73144___________|"C:/Documents_and_Settings/dmc73144"____________________________________________| **** Registry_Values_(Deleted)_-_ICC_Results **** ________________________________________________________________ |Action|Path|Val_Name|Val_Type|Mod_Val_Type|Val_Data|Mod_Val_Data| **** Registry_Values_(Changed)_-_ICC_Results **** __________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________ |Action__|Path_________________________________________________________________________________________________________________|Val_Name_|Val_Data________________________________________________________________________|Mod_Val_Data____________________________________________________________________| |modified|HKLM/SOFTWARE/Microsoft/Cryptography/RNG_____________________________________________________________________________|Seed_____|27_43_E9_82_EB_F0_06_EB_97_CD_4E_DD_D1_AE_F6_EA_FC_09_4A_B2_DF_81_09_76_8E_C9_60|55_86_63_3D_3E_D5_F0_51_C5_43_C7_A3_AA_B8_C5_04_41_C5_E1_E0_85_38_F8_65_0F_86_6C| |modified|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Explorer/RecentDocs_______|MRUListEx|03_00_00_00_02_00_00_00_00_00_00_00_08_00_00_00_07_00_00_00_06_00_00_00_05_00_00|0A_00_00_00_09_00_00_00_03_00_00_00_02_00_00_00_00_00_00_00_08_00_00_00_07_00_00| |modified|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Explorer/RecentDocs/Folder|MRUListEx|01_00_00_00_03_00_00_00_02_00_00_00_00_00_00_00_FF_FF_FF_FF_____________________|04_00_00_00_01_00_00_00_03_00_00_00_02_00_00_00_00_00_00_00_FF_FF_FF_FF_________| **** DNS_Results **** ________________ |DNS|DNS_Response| **** URL_Results **** _________________________________________________________ |DstIP|HTTP_HOST|HTTP_REQUEST_URI|HTTP_USER_AGENT|PROTOCOL| **** ARGUS_PROTOCOL_Results **** ______________________________________________ |PROTOCOL|SRC_PKTS|DST_PKTS|SRC_BYTES|DST_BYTES| **** ARGUS_DPORT_Results **** ____________________________________________________ |DPORT|PROTOCOL|SRC_PKTS|DST_PKTS|SRC_BYTES|DST_BYTES| **** ARGUS_DATA_Results **** _______________________________________________________________ |Time|Date|Protocol|SrcIP|DstIP|Dir|Flags|Sport|Dport|Pkts|Bytes| **** Packer_Results **** ___________ |Packer_Name| **** HoneyTrap_Results **** ____________________________ |Honey_Trap_Log_File_Location| **** PTFB_Results **** ______________________ |PTFB_Log_File_Location|