**** Malware_Report_-_Results **** This report shows all the different areas TAZER analyzes for the sample: Host, Network Activity, and Detection. Malware Search Criteria: MD5 =d0023abc578dcdc9138f57b99cdd734f **** Malware_Report_-_Results **** _____________________________________________________________________________________________________________________________________________________________________________________________________________________________________ |File_MD5Sum_____________________|SHA1SUM_________________________________|SHA256SUM_______________________________________________________|FUZZY_HASH______________________________________________________________________|File_Size| |d0023abc578dcdc9138f57b99cdd734f|cbd7fac27142feb1a29df85d1396afb68b49a8f0|30c42391420af7d196d8c4381b7bc0f41aa9a023febc6f5a07929f2b78e8e37e|6144:g27gCbTehEqclWYaci7TJxNdGazSDKTsmReZGV+nM/KFY12BWbZVx7ciDBpPq:g27/bTehEqclr|281045___| **** File_Results **** ________________ |File_Name_______| |Photo%2D5876.exe| **** SNORT_Results **** ___________________________________________ |Snort_Class|Snort_Alert______________|Count| |N/A________|No_snort_alerts_generated|0____| **** AV_Results **** __________________ |AV_Alert|AV_Vendor| **** Folders_(Added)_-_ICC_Results **** ______________________________________________________________________________________________ |Path_________________________________________________________________|Folder_Name_____________| |c:/Documents_and_Settings/dmc73144/Local_Settings/History/History.IE5|MSHist012011090220110903| **** Files_(Added)_-_ICC_Results **** _______________________________________________________________________________________________________________________ |Path__________________________________________________________________________________________|File_Name_______________| |c:/Documents_and_Settings/dmc73144/Local_Settings/History/History.IE5/MSHist012011090220110903|index.dat_______________| |c:/Documents_and_Settings/dmc73144/Recent_____________________________________________________|0000q0hb.jpg.lnk________| |c:/Documents_and_Settings/dmc73144/Recent_____________________________________________________|dmc73144.lnk____________| |c:/Documents_and_Settings/dmc73144____________________________________________________________|0000q0hb.jpg____________| |c:/WINDOWS/Prefetch___________________________________________________________________________|AUTOIT3.EXE-32361418.pf_| |c:/WINDOWS/Prefetch___________________________________________________________________________|CHCP.COM-18156052.pf____| |c:/WINDOWS/Prefetch___________________________________________________________________________|REGSHOT.EXE-010A5EE6.pf_| |c:/WINDOWS/Prefetch___________________________________________________________________________|RNM.EXE-04823DAF.pf_____| |c:/WINDOWS/Prefetch___________________________________________________________________________|RUNDLL32.EXE-369A6B7A.pf| |c:/WINDOWS/Prefetch___________________________________________________________________________|SANDNET.EXE-2012C478.pf_| |c:/WINDOWS/Prefetch___________________________________________________________________________|TASKKILL.EXE-0A8306E3.pf| |c:/WINDOWS/system32/drivers/etc_______________________________________________________________|hlsts___________________| **** Files_(Deleted)_-_ICC_Results **** _____________________ |Action|Path|File_Name| **** Files_(Changed)_-_ICC_Results **** ______________________________________________________________________________________________________________________ |Action__|Path__________________________________________________________________________________|File_Name_____________| |modified|c:/Documents_and_Settings/dmc73144/Cookies____________________________________________|index.dat_____________| |modified|c:/Documents_and_Settings/dmc73144/Local_Settings/History/History.IE5_________________|index.dat_____________| |modified|c:/Documents_and_Settings/dmc73144/Local_Settings/Temporary_Internet_Files/Content.IE5|index.dat_____________| |modified|c:/Documents_and_Settings/dmc73144____________________________________________________|ntuser.dat.LOG________| |modified|c:/WINDOWS/Prefetch___________________________________________________________________|ATTRIB.EXE-39EAFB02.pf| |modified|c:/WINDOWS/Prefetch___________________________________________________________________|CMD.EXE-087B4001.pf___| |modified|c:/WINDOWS/Prefetch___________________________________________________________________|HSTART.EXE-221D72BF.pf| |modified|c:/WINDOWS/Prefetch___________________________________________________________________|SH.EXE-00254D2B.pf____| |modified|c:/WINDOWS/Prefetch___________________________________________________________________|SSHD.EXE-298CA236.pf__| |modified|c:/WINDOWS/Prefetch___________________________________________________________________|SWITCH.EXE-0496EC21.pf| |modified|c:/WINDOWS/system32/drivers/etc_______________________________________________________|hosts_________________| |modified|c:/WINDOWS/system32/wbem/Logs_________________________________________________________|wmiprov.log___________| |modified|c:/WINDOWS/system32/wbem/Repository/FS________________________________________________|INDEX.MAP_____________| |modified|c:/WINDOWS/system32/wbem/Repository/FS________________________________________________|MAPPING.VER___________| |modified|c:/WINDOWS/system32/wbem/Repository/FS________________________________________________|MAPPING2.MAP__________| |modified|c:/WINDOWS/system32/wbem/Repository/FS________________________________________________|OBJECTS.MAP___________| **** Registry_Keys_(Added)_-_ICC_Results **** _______________________________________________________________________________________________________________________________________________________________________ |Action|Path____________________________________________________________________________________________________________________________________________________________| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Explorer/RecentDocs/.jpg_____________________________________________| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Internet_Settings/5.0/Cache/Extensible_Cache/MSHist012011090220110903| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/WinRAR_SFX____________________________________________________________________________________________| **** Registry_Values_(Added)_-_ICC_Results **** ______________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________ |Action|Path____________________________________________________________________________________________________________________________________________________________|Val_Name_____________________________________|Val_Data________________________________________________________________________| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Explorer/RecentDocs__________________________________________________|9____________________________________________|30_00_30_00_30_00_30_00_71_00_30_00_68_00_62_00_2E_00_6A_00_70_00_67_00_00_00_58| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Explorer/RecentDocs__________________________________________________|10___________________________________________|64_00_6D_00_63_00_37_00_33_00_31_00_34_00_34_00_00_00_4C_00_32_00_00_00_00_00_00| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Explorer/RecentDocs/Folder___________________________________________|4____________________________________________|64_00_6D_00_63_00_37_00_33_00_31_00_34_00_34_00_00_00_4C_00_32_00_00_00_00_00_00| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Explorer/RecentDocs/.jpg_____________________________________________|0____________________________________________|30_00_30_00_30_00_30_00_71_00_30_00_68_00_62_00_2E_00_6A_00_70_00_67_00_00_00_58| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Explorer/RecentDocs/.jpg_____________________________________________|MRUListEx____________________________________|00_00_00_00_FF_FF_FF_FF_________________________________________________________| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Internet_Settings/5.0/Cache/Extensible_Cache/MSHist012011090220110903|CachePath____________________________________|"%USERPROFILE%Local_SettingsHistoryHistory.IE5MSHist012011090220110903"_________| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Internet_Settings/5.0/Cache/Extensible_Cache/MSHist012011090220110903|CachePrefix__________________________________|":2011090220110903:_"___________________________________________________________| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Internet_Settings/5.0/Cache/Extensible_Cache/MSHist012011090220110903|CacheLimit___________________________________|0x00002000______________________________________________________________________| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Internet_Settings/5.0/Cache/Extensible_Cache/MSHist012011090220110903|CacheOptions_________________________________|0x0000000B______________________________________________________________________| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Internet_Settings/5.0/Cache/Extensible_Cache/MSHist012011090220110903|CacheRepair__________________________________|0x00000000______________________________________________________________________| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/ShellNoRoam/MUICache________________________________________________________________|C://Documents_and_Settings//dmc73144//rnm.exe|"rnm"___________________________________________________________________________| |added_|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/WinRAR_SFX____________________________________________________________________________________________|C%%Documents_and_Settings%dmc73144___________|"C:/Documents_and_Settings/dmc73144"____________________________________________| **** Registry_Values_(Deleted)_-_ICC_Results **** ________________________________________________________________ |Action|Path|Val_Name|Val_Type|Mod_Val_Type|Val_Data|Mod_Val_Data| **** Registry_Values_(Changed)_-_ICC_Results **** __________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________ |Action__|Path_________________________________________________________________________________________________________________|Val_Name_|Val_Data________________________________________________________________________|Mod_Val_Data____________________________________________________________________| |modified|HKLM/SOFTWARE/Microsoft/Cryptography/RNG_____________________________________________________________________________|Seed_____|40_60_E8_2A_2B_B1_38_92_69_DC_78_A2_FB_D2_7F_54_BE_A9_DF_42_F8_01_54_D1_09_44_2F|65_F7_18_81_4C_D9_41_1F_1F_79_3D_B4_67_54_D5_0D_E9_CB_00_DC_0E_08_9B_B0_CA_01_D4| |modified|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Explorer/RecentDocs_______|MRUListEx|03_00_00_00_02_00_00_00_00_00_00_00_08_00_00_00_07_00_00_00_06_00_00_00_05_00_00|0A_00_00_00_09_00_00_00_03_00_00_00_02_00_00_00_00_00_00_00_08_00_00_00_07_00_00| |modified|HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Explorer/RecentDocs/Folder|MRUListEx|01_00_00_00_03_00_00_00_02_00_00_00_00_00_00_00_FF_FF_FF_FF_____________________|04_00_00_00_01_00_00_00_03_00_00_00_02_00_00_00_00_00_00_00_FF_FF_FF_FF_________| **** DNS_Results **** ________________ |DNS|DNS_Response| **** URL_Results **** _________________________________________________________ |DstIP|HTTP_HOST|HTTP_REQUEST_URI|HTTP_USER_AGENT|PROTOCOL| **** ARGUS_PROTOCOL_Results **** ______________________________________________ |PROTOCOL|SRC_PKTS|DST_PKTS|SRC_BYTES|DST_BYTES| **** ARGUS_DPORT_Results **** ____________________________________________________ |DPORT|PROTOCOL|SRC_PKTS|DST_PKTS|SRC_BYTES|DST_BYTES| **** ARGUS_DATA_Results **** _______________________________________________________________ |Time|Date|Protocol|SrcIP|DstIP|Dir|Flags|Sport|Dport|Pkts|Bytes| **** Packer_Results **** ___________ |Packer_Name| **** HoneyTrap_Results **** ____________________________ |Honey_Trap_Log_File_Location| **** PTFB_Results **** ______________________ |PTFB_Log_File_Location|