Malware Report

Malware Report - Results

This report shows all the different areas TAZER analyzes for the sample: Host, Network Activity, and Detection.

Malware Search Criteria:

MD5 =cd7e03c43ee0e7eb1ff3e8be0f83ca12

Malware Report - Results

File MD5Sum	SHA1SUM	SHA256SUM	FUZZY HASH	File Size
cd7e03c43ee0e7eb1ff3e8be0f83ca12	ce24b4681bb8997b7ffcb37a3c0835948c226638	574bf2b7fda2190aedfe8c03ebe00454c1dcfdc2445263f1ec687fdf8d02e4ef	6144:Cu2urzh9xu/Xkaun+ngy3tQX6SwbNTLOd8udHh1:Cutrzh9xOXkkl2XY1vQ1	249789

File Results

File Name
index.html.exe

SNORT Results

Snort Class	Snort Alert	Count
A Network Trojan was Detected	SPYWARE-PUT Backdoor.Win32.Darkness contact to server attempt	1

AV Results

AV Alert	AV Vendor
Suspicious.IRCBo	Symantec
Artemis!2AAAAB739123	McAfee
HEUR:Trojan.Win32.Generic	Kaspersky

Folders (Added) - ICC Results

Path	Folder Name
c:/Documents and Settings/dmc73144/Local Settings/Temporary Internet Files/Content.IE5	ITB2CJ0C

Files (Added) - ICC Results

Path	File Name
c:/Documents and Settings/dmc73144/Local Settings/Temporary Internet Files/Content.IE5/ITB2CJ0C	desktop.ini
c:/Documents and Settings/dmc73144/Start Menu/Programs/Startup	Microsoft Update.exe
c:/Documents and Settings/LocalService/Local Settings/Temporary Internet Files/Content.IE5/19FBBWXL	index[1].htm
c:/WINDOWS/Prefetch	7Z.EXE-1A62CD19.pf
c:/WINDOWS/Prefetch	DWM.EXE-04164222.pf
c:/WINDOWS/Prefetch	FILE1.EXE-03B2F7D2.pf
c:/WINDOWS/Prefetch	FILE2.EXE-0FB11BD9.pf
c:/WINDOWS/Prefetch	FILE3.EXE-2A1A7267.pf
c:/WINDOWS/Prefetch	SANDNET.EXE-2012C478.pf
c:/WINDOWS/Prefetch	SC.EXE-012262AF.pf
c:/WINDOWS/Prefetch	START.EXE-31104AA4.pf
c:/WINDOWS/Prefetch	SVCHOST.EXE-3530F672.pf
c:/WINDOWS/system	dwm.exe
c:/WINDOWS/system32/drivers/etc	File1.exe
c:/WINDOWS/system32/drivers/etc	File2.exe
c:/WINDOWS/system32/drivers/etc	file3.exe
c:/WINDOWS/system32/drivers/etc	h?sts
c:/WINDOWS/system32/drivers/etc	start.exe
c:/WINDOWS/Temp	ddid
c:	netstat_post.txt

Files (Deleted) - ICC Results

Action	Path	File Name

Files (Changed) - ICC Results

Action	Path	File Name
modified	c:/Documents and Settings/dmc73144/Cookies	index.dat
modified	c:/Documents and Settings/dmc73144/Local Settings/History/History.IE5	index.dat
modified	c:/Documents and Settings/dmc73144/Local Settings/Temporary Internet Files/Content.IE5	index.dat
modified	c:/Documents and Settings/dmc73144	ntuser.dat.LOG
modified	c:/Documents and Settings/LocalService/Cookies	index.dat
modified	c:/Documents and Settings/LocalService/Local Settings/History/History.IE5	index.dat
modified	c:/Documents and Settings/LocalService/Local Settings/Temporary Internet Files/Content.IE5	index.dat
modified	c:/WINDOWS/Prefetch	CMD.EXE-087B4001.pf
modified	c:/WINDOWS/Prefetch	HSTART.EXE-221D72BF.pf
modified	c:/WINDOWS/Prefetch	NETSTAT.EXE-2B2B4428.pf
modified	c:/WINDOWS/Prefetch	SH.EXE-00254D2B.pf
modified	c:/WINDOWS/Prefetch	SSHD.EXE-298CA236.pf
modified	c:/WINDOWS/Prefetch	SWITCH.EXE-0496EC21.pf
modified	c:/WINDOWS/Prefetch	TASKLIST.EXE-10D94B23.pf
modified	c:/WINDOWS/SoftwareDistribution/DataStore	DataStore.edb
modified	c:/WINDOWS/SoftwareDistribution/DataStore/Logs	edb.chk
modified	c:/WINDOWS/SoftwareDistribution/DataStore/Logs	edb.log
modified	c:/WINDOWS/system32/config	default.LOG
modified	c:/WINDOWS/system32/config	software.LOG
modified	c:/WINDOWS/system32/config	system.LOG
modified	c:/WINDOWS/system32/drivers/etc	hosts
modified	c:/WINDOWS/system32/wbem/Logs	wbemess.log
modified	c:/WINDOWS/system32/wbem/Repository/FS	INDEX.MAP
modified	c:/WINDOWS/system32/wbem/Repository/FS	MAPPING.VER
modified	c:/WINDOWS/system32/wbem/Repository/FS	MAPPING1.MAP
modified	c:/WINDOWS/system32/wbem/Repository/FS	OBJECTS.MAP

Registry Keys (Added) - ICC Results

Action	Path

Registry Values (Added) - ICC Results

Action	Path	Val_Name	Val_Data

Registry Values (Deleted) - ICC Results

Action	Path	Val_Name	Val_Type	Mod_Val_Type	Val_Data	Mod_Val_Data

Registry Values (Changed) - ICC Results

Action	Path	Val_Name	Val_Data	Mod_Val_Data
modified	HKLM/SOFTWARE/Microsoft/Cryptography/RNG	Seed	D4 E6 76 46 DF AE E0 18 C2 30 26 DE BC 3B 5C DE 3C 7C 09 C3 B2 16 07 8F B2 8F 8B	D6 76 B4 52 8F 0D 3E 76 DC B7 B2 78 62 97 A0 D3 ED 2E 8D CB 7F C8 8C 2C EA 46 4
modified	HKLM/SYSTEM/ControlSet001/Control/ServiceCurrent		0x00000009	0x0000000A
modified	HKLM/SYSTEM/ControlSet001/Services/SharedAccess/Epoch	Epoch	0x00000104	0x00000105
modified	HKLM/SYSTEM/CurrentControlSet/Control/ServiceCurrent		0x00000009	0x0000000A
modified	HKLM/SYSTEM/CurrentControlSet/Services/SharedAccess/Epoch	Epoch	0x00000104	0x00000105
modified	HKU/.DEFAULT/Software/Microsoft/Windows/CurrentVersion/Explorer/Shell Folders	Cookies	C:Documents and SettingsDefault UserCookies	"C
modified	HKU/.DEFAULT/Software/Microsoft/Windows/CurrentVersion/Explorer/Shell Folders	Cache	C:Documents and SettingsDefault UserLocal SettingsTemporary Internet Files	"C
modified	HKU/.DEFAULT/Software/Microsoft/Windows/CurrentVersion/Explorer/Shell Folders	History	C:Documents and SettingsDefault UserLocal SettingsHistory	"C
modified	HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Internet Settings/Connections	SavedLegacySettings	3C 00 00 00 15 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00	3C 00 00 00 16 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0
modified	HKU/S-1-5-18/Software/Microsoft/Windows/CurrentVersion/Explorer/Shell Folders	Cookies	C:Documents and SettingsDefault UserCookies	"C
modified	HKU/S-1-5-18/Software/Microsoft/Windows/CurrentVersion/Explorer/Shell Folders	Cache	C:Documents and SettingsDefault UserLocal SettingsTemporary Internet Files	"C
modified	HKU/S-1-5-18/Software/Microsoft/Windows/CurrentVersion/Explorer/Shell Folders	History	C:Documents and SettingsDefault UserLocal SettingsHistory	"C

DNS Results

DNS	DNS Response
boooot.ru	Standard query response A 77.109.85.227
kvazimoder.com	Standard query response A 92.38.209.207

URL Results

DstIP	HTTP_HOST	HTTP_REQUEST_URI	HTTP_USER_AGENT	PROTOCOL
77.109.85.227	boooot.ru	/index.php?uid=283187&ver=6m%20XP	Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Avant Browser [avantbrowser.com]; iOpus-I-M; QXW03416; .NET CLR 1.1.4322)	0x06
92.38.209.207	kvazimoder.com	/sky/gate.php?v=2&b=0&r=1		0x06
92.38.209.207	kvazimoder.com	/sky/gate.php?v=2&b=0&r=2		0x06
239.255.255.250	239.255.255.250:1900	*	--blank--	0x11

ARGUS PROTOCOL Results

PROTOCOL	SRC_PKTS	DST_PKTS	SRC_BYTES	DST_BYTES
6	15	12	1287	1545
17	2	0	350	0

ARGUS DPORT Results

DPORT	PROTOCOL	SRC_PKTS	DST_PKTS	SRC_BYTES	DST_BYTES
80	6	15	12	1287	1545
1900	17	2	0	350	0

ARGUS DATA Results

Time	Date	Protocol	SrcIP	DstIP	Dir	Flags	Sport	Dport	Pkts	Bytes
05:34:14	2011-08-27	6	10.10.10.7	77.109.85.227	->	e	316	80	9	1034
05:34:45	2011-08-27	6	10.10.10.7	92.38.209.207	->	e	191	80	9	899
05:34:46	2011-08-27	6	10.10.10.7	92.38.209.207	->	e	515	80	9	899
05:39:41	2011-08-27	17	10.10.10.7	239.255.255.250	->	e	8	1900	2	350

Packer Results

Packer Name

HoneyTrap Results

Honey Trap Log File Location

PTFB Results

PTFB Log File Location