Malware Report - Results

This report shows all the different areas TAZER analyzes for the sample: Host, Network Activity, and Detection.

Malware Search Criteria:
  • MD5 =d8ce0835898503c09648428d3c57ef0e

    • Malware Report - Results

    File MD5SumSHA1SUMSHA256SUMFUZZY HASHFile Size
    d8ce0835898503c09648428d3c57ef0e3f15f673598831c412363e226c65cc6a44971af187083073d89f37f7ae7fc5d031617bd691604e9bb2fa69f3788dd9db130cb1d312288:Cutrzh9xOXkkKcmcMAzLrEKHYeBgWhaQKlmlO3CXG439HIN3:Cutr5OUk7MGLrB42gWs3kU3ls471112

    File Results

    File Name
    vk%2Dguests.in.exe

    SNORT Results

    Snort ClassSnort AlertCount
    N/ANo snort alerts generated0

    AV Results

    AV AlertAV Vendor

    Folders (Added) - ICC Results

    PathFolder Name
    c:/Documents and Settings/dmc73144/Local Settings/Tempwinsvchost

    Files (Added) - ICC Results

    PathFile Name
    c:/Documents and Settings/dmc73144/Local Settings/TempWinSocks.sw
    c:/Documents and Settings/dmc73144/Local Settings/Temp/winsvchostsvchost.exe
    c:/Documents and Settings/dmc73144/Start Menu/Programs/StartupMicrosoft Update.exe
    c:/WINDOWS/PrefetchAUTOIT3.EXE-32361418.pf
    c:/WINDOWS/PrefetchFILE1.EXE-03B2F7D2.pf
    c:/WINDOWS/PrefetchFILE2.EXE-0FB11BD9.pf
    c:/WINDOWS/PrefetchFILE3.EXE-2A1A7267.pf
    c:/WINDOWS/PrefetchREGSHOT.EXE-010A5EE6.pf
    c:/WINDOWS/PrefetchSANDNET.EXE-2012C478.pf
    c:/WINDOWS/PrefetchSTART.EXE-31104AA4.pf
    c:/WINDOWS/PrefetchSVCHOST.EXE-004EF50F.pf
    c:/WINDOWS/PrefetchSVCHOST.EXE-3530F672.pf
    c:/WINDOWS/PrefetchTRANSCL.EXE-1B822206.pf
    c:/WINDOWS/system32/drivers/etcFile1.exe
    c:/WINDOWS/system32/drivers/etcFile2.exe
    c:/WINDOWS/system32/drivers/etcfile3.exe
    c:/WINDOWS/system32/drivers/etch?sts
    c:/WINDOWS/system32/drivers/etcstart.exe
    c:/WINDOWS/system32TranscL.exe

    Files (Deleted) - ICC Results

    ActionPathFile Name

    Files (Changed) - ICC Results

    ActionPathFile Name
    modifiedc:/Documents and Settings/dmc73144ntuser.dat.LOG
    modifiedc:/WINDOWS/PrefetchHSTART.EXE-221D72BF.pf
    modifiedc:/WINDOWS/system32/configdefault.LOG
    modifiedc:/WINDOWS/system32/configsoftware.LOG
    modifiedc:/WINDOWS/system32/configSYSTEM
    modifiedc:/WINDOWS/system32/configsystem.LOG
    modifiedc:/WINDOWS/system32/drivers/etchosts
    modifiedc:/WINDOWS/system32/wbem/Logswbemess.log
    modifiedc:/WINDOWS/system32/wbem/Logswmiprov.log
    modifiedc:/WINDOWS/system32/wbem/Repository/FSINDEX.MAP
    modifiedc:/WINDOWS/system32/wbem/Repository/FSMAPPING.VER
    modifiedc:/WINDOWS/system32/wbem/Repository/FSMAPPING1.MAP
    modifiedc:/WINDOWS/system32/wbem/Repository/FSOBJECTS.MAP

    Registry Keys (Added) - ICC Results

    ActionPath
    addedHKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/policies/Explorer
    addedHKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/policies/Explorer/run
    addedHKLM/SYSTEM/ControlSet001/Enum/Root/LEGACY_TRANSCENDQUICKLOAD
    addedHKLM/SYSTEM/ControlSet001/Enum/Root/LEGACY_TRANSCENDQUICKLOAD/0000
    addedHKLM/SYSTEM/ControlSet001/Enum/Root/LEGACY_TRANSCENDQUICKLOAD/0000/Control
    addedHKLM/SYSTEM/ControlSet001/Services/SharedAccess/Parameters/FirewallPolicy/StandardProfile/GloballyOpenPorts
    addedHKLM/SYSTEM/ControlSet001/Services/SharedAccess/Parameters/FirewallPolicy/StandardProfile/GloballyOpenPorts/List
    addedHKLM/SYSTEM/ControlSet001/Services/TranscendQuickLoad
    addedHKLM/SYSTEM/ControlSet001/Services/TranscendQuickLoad/Security
    addedHKLM/SYSTEM/ControlSet001/Services/TranscendQuickLoad/Enum
    addedHKLM/SYSTEM/CurrentControlSet/Enum/Root/LEGACY_TRANSCENDQUICKLOAD
    addedHKLM/SYSTEM/CurrentControlSet/Enum/Root/LEGACY_TRANSCENDQUICKLOAD/0000
    addedHKLM/SYSTEM/CurrentControlSet/Enum/Root/LEGACY_TRANSCENDQUICKLOAD/0000/Control
    addedHKLM/SYSTEM/CurrentControlSet/Services/SharedAccess/Parameters/FirewallPolicy/StandardProfile/GloballyOpenPorts
    addedHKLM/SYSTEM/CurrentControlSet/Services/SharedAccess/Parameters/FirewallPolicy/StandardProfile/GloballyOpenPorts/List
    addedHKLM/SYSTEM/CurrentControlSet/Services/TranscendQuickLoad
    addedHKLM/SYSTEM/CurrentControlSet/Services/TranscendQuickLoad/Security
    addedHKLM/SYSTEM/CurrentControlSet/Services/TranscendQuickLoad/Enum
    addedHKU/.DEFAULT/Software/Microsoft/Visual Basic
    addedHKU/.DEFAULT/Software/Microsoft/Visual Basic/6.0
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Visual Basic
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Visual Basic/6.0
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/WinRAR SFX
    addedHKU/S-1-5-18/Software/Microsoft/Visual Basic
    addedHKU/S-1-5-18/Software/Microsoft/Visual Basic/6.0

    Registry Values (Added) - ICC Results

    ActionPathVal_NameVal_Data
    addedHKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/policies/Explorer/runUpdate service "C:/DOCUME~1/dmc73144/LOCALS~1/Temp/winsvchost/svchost.exe"
    addedHKLM/SYSTEM/ControlSet001/Enum/Root/LEGACY_TRANSCENDQUICKLOAD/0000/Control*NewlyCreated*0x00000000
    addedHKLM/SYSTEM/ControlSet001/Enum/Root/LEGACY_TRANSCENDQUICKLOAD/0000/ControlActiveService"TranscendQuickLoad"
    addedHKLM/SYSTEM/ControlSet001/Enum/Root/LEGACY_TRANSCENDQUICKLOAD/0000Service"TranscendQuickLoad"
    addedHKLM/SYSTEM/ControlSet001/Enum/Root/LEGACY_TRANSCENDQUICKLOAD/0000Legacy0x00000001
    addedHKLM/SYSTEM/ControlSet001/Enum/Root/LEGACY_TRANSCENDQUICKLOAD/0000ConfigFlags0x00000000
    addedHKLM/SYSTEM/ControlSet001/Enum/Root/LEGACY_TRANSCENDQUICKLOAD/0000Class"LegacyDriver"
    addedHKLM/SYSTEM/ControlSet001/Enum/Root/LEGACY_TRANSCENDQUICKLOAD/0000ClassGUID"{8ECC055D-047F-11D1-A537-0000F8753ED1}"
    addedHKLM/SYSTEM/ControlSet001/Enum/Root/LEGACY_TRANSCENDQUICKLOAD/0000DeviceDesc"Transcend Quick Load Service"
    addedHKLM/SYSTEM/ControlSet001/Enum/Root/LEGACY_TRANSCENDQUICKLOADNextInstance0x00000001
    addedHKLM/SYSTEM/ControlSet001/Services/SharedAccess/Parameters/FirewallPolicy/StandardProfile/GloballyOpenPorts/List8364TCP
    addedHKLM/SYSTEM/ControlSet001/Services/SharedAccess/Parameters/FirewallPolicy/StandardProfile/GloballyOpenPorts/List8008TCP
    addedHKLM/SYSTEM/ControlSet001/Services/TranscendQuickLoad/Enum0"RootLEGACY_TRANSCENDQUICKLOAD0000"
    addedHKLM/SYSTEM/ControlSet001/Services/TranscendQuickLoad/EnumCount0x00000001
    addedHKLM/SYSTEM/ControlSet001/Services/TranscendQuickLoad/EnumNextInstance0x00000001
    addedHKLM/SYSTEM/ControlSet001/Services/TranscendQuickLoad/SecuritySecurity01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00
    addedHKLM/SYSTEM/ControlSet001/Services/TranscendQuickLoadType0x00000010
    addedHKLM/SYSTEM/ControlSet001/Services/TranscendQuickLoadStart0x00000002
    addedHKLM/SYSTEM/ControlSet001/Services/TranscendQuickLoadErrorControl0x00000000
    addedHKLM/SYSTEM/ControlSet001/Services/TranscendQuickLoadImagePath "C:/WINDOWS/system32/TranscL.exe"
    addedHKLM/SYSTEM/ControlSet001/Services/TranscendQuickLoadDisplayName"Transcend Quick Load Service"
    addedHKLM/SYSTEM/ControlSet001/Services/TranscendQuickLoadObjectName"LocalSystem"
    addedHKLM/SYSTEM/ControlSet001/Services/TranscendQuickLoadDescription"Transcend Quick Load"
    addedHKLM/SYSTEM/CurrentControlSet/Enum/Root/LEGACY_TRANSCENDQUICKLOAD/0000/Control*NewlyCreated*0x00000000
    addedHKLM/SYSTEM/CurrentControlSet/Enum/Root/LEGACY_TRANSCENDQUICKLOAD/0000/ControlActiveService"TranscendQuickLoad"
    addedHKLM/SYSTEM/CurrentControlSet/Enum/Root/LEGACY_TRANSCENDQUICKLOAD/0000Service"TranscendQuickLoad"
    addedHKLM/SYSTEM/CurrentControlSet/Enum/Root/LEGACY_TRANSCENDQUICKLOAD/0000Legacy0x00000001
    addedHKLM/SYSTEM/CurrentControlSet/Enum/Root/LEGACY_TRANSCENDQUICKLOAD/0000ConfigFlags0x00000000
    addedHKLM/SYSTEM/CurrentControlSet/Enum/Root/LEGACY_TRANSCENDQUICKLOAD/0000Class"LegacyDriver"
    addedHKLM/SYSTEM/CurrentControlSet/Enum/Root/LEGACY_TRANSCENDQUICKLOAD/0000ClassGUID"{8ECC055D-047F-11D1-A537-0000F8753ED1}"
    addedHKLM/SYSTEM/CurrentControlSet/Enum/Root/LEGACY_TRANSCENDQUICKLOAD/0000DeviceDesc"Transcend Quick Load Service"
    addedHKLM/SYSTEM/CurrentControlSet/Enum/Root/LEGACY_TRANSCENDQUICKLOADNextInstance0x00000001
    addedHKLM/SYSTEM/CurrentControlSet/Services/SharedAccess/Parameters/FirewallPolicy/StandardProfile/GloballyOpenPorts/List8364TCP
    addedHKLM/SYSTEM/CurrentControlSet/Services/SharedAccess/Parameters/FirewallPolicy/StandardProfile/GloballyOpenPorts/List8008TCP
    addedHKLM/SYSTEM/CurrentControlSet/Services/TranscendQuickLoad/Enum0"RootLEGACY_TRANSCENDQUICKLOAD0000"
    addedHKLM/SYSTEM/CurrentControlSet/Services/TranscendQuickLoad/EnumCount0x00000001
    addedHKLM/SYSTEM/CurrentControlSet/Services/TranscendQuickLoad/EnumNextInstance0x00000001
    addedHKLM/SYSTEM/CurrentControlSet/Services/TranscendQuickLoad/SecuritySecurity01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00
    addedHKLM/SYSTEM/CurrentControlSet/Services/TranscendQuickLoadType0x00000010
    addedHKLM/SYSTEM/CurrentControlSet/Services/TranscendQuickLoadStart0x00000002
    addedHKLM/SYSTEM/CurrentControlSet/Services/TranscendQuickLoadErrorControl0x00000000
    addedHKLM/SYSTEM/CurrentControlSet/Services/TranscendQuickLoadImagePath "C:/WINDOWS/system32/TranscL.exe"
    addedHKLM/SYSTEM/CurrentControlSet/Services/TranscendQuickLoadDisplayName"Transcend Quick Load Service"
    addedHKLM/SYSTEM/CurrentControlSet/Services/TranscendQuickLoadObjectName"LocalSystem"
    addedHKLM/SYSTEM/CurrentControlSet/Services/TranscendQuickLoadDescription"Transcend Quick Load"
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/ShellNoRoam/MUICacheC://WINDOWS//system32//drivers//etc//Start.exe "Start"
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/ShellNoRoam/MUICacheC://WINDOWS//system32//drivers//etc//file1.exe "file1"
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/ShellNoRoam/MUICacheC://WINDOWS//system32//drivers//etc//file2.exe "file2"
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/ShellNoRoam/MUICacheC://WINDOWS//system32//drivers//etc//file3.exe "Crosby Mauritania TampaAudreyOttawaSunnyvale"
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/ShellNoRoam/MUICacheC://DOCUME~1//dmc73144//LOCALS~1//Temp//winsvchost//svchost.exe "Crosby Mauritania TampaAudreyOttawaSunnyvale"
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/WinRAR SFXC%%WINDOWS%system32%drivers%etc "C:/WINDOWS/system32/drivers/etc"

    Registry Values (Deleted) - ICC Results

    ActionPathVal_NameVal_TypeMod_Val_TypeVal_DataMod_Val_Data

    Registry Values (Changed) - ICC Results

    ActionPathVal_NameVal_DataMod_Val_Data
    modifiedHKLM/SOFTWARE/Microsoft/Cryptography/RNGSeed24 0B 96 D7 B0 E6 EF 8C 0F 5E 61 B7 6C AF B4 DD E8 C7 0C 84 4C 5B 4E 8F 54 02 0659 7C 9E B8 3C 71 B4 8B 6C 08 03 4F 67 B2 B8 7A F0 88 7C 66 F4 12 AA 42 A7 1B 8D
    modifiedHKLM/SYSTEM/ControlSet001/Control/ServiceCurrent0x000000090x0000000A
    modifiedHKLM/SYSTEM/ControlSet001/Services/SharedAccess/EpochEpoch0x000001070x00000108
    modifiedHKLM/SYSTEM/CurrentControlSet/Control/ServiceCurrent0x000000090x0000000A
    modifiedHKLM/SYSTEM/CurrentControlSet/Services/SharedAccess/EpochEpoch0x000001070x00000108
    modifiedHKU/S-1-5-21-1844237615-562591055-839522115-1004/SessionInformationProgramCount0x000000020x00000003

    DNS Results

    DNSDNS Response
    www.bytecode.bizStandard query response, Server failure
    vegaszoid.netStandard query response, Server failure

    URL Results

    DstIPHTTP_HOSTHTTP_REQUEST_URIHTTP_USER_AGENTPROTOCOL

    ARGUS PROTOCOL Results

    PROTOCOLSRC_PKTSDST_PKTSSRC_BYTESDST_BYTES

    ARGUS DPORT Results

    DPORTPROTOCOLSRC_PKTSDST_PKTSSRC_BYTESDST_BYTES

    ARGUS DATA Results

    TimeDateProtocolSrcIPDstIPDirFlagsSportDportPktsBytes

    Packer Results

    Packer Name

    HoneyTrap Results

    Honey Trap Log File Location

    PTFB Results

    PTFB Log File Location