Malware Report

Malware Report - Results

This report shows all the different areas TAZER analyzes for the sample: Host, Network Activity, and Detection.

Malware Search Criteria:

MD5 =dc5b8cd091a18330874c482c21bff82b

Malware Report - Results

File MD5Sum	SHA1SUM	SHA256SUM	FUZZY HASH	File Size
dc5b8cd091a18330874c482c21bff82b	fe5cf336eada05991756b6388d277404b08a5473	f01891a0771e194d48c280dc85a7d764a9fddeb15e7e3fa3a6648e5ca482eeb4	768:5rueZc6uK+rq5ebaMworHc/K1N6SZHfHSv2RgLp6F+JhtUlM7:Vue1e+URjw/qNNZHfk2OkFN4	43238

File Results

File Name
load24345.45047.exe
installer.0042.exe
ccc.html.exe
%3Fsrc%3Dsv%26id%3B%3Dtemp123%26o%3B%3Do.exe

SNORT Results

Snort Class	Snort Alert	Count
Misc Attack	ET RBN Known Russian Business Network IP TCP (280)	1

AV Results

AV Alert	AV Vendor
N/A	Symantec
Artemis!DC5B8CD091A1	McAfee
N/A	Kaspersky

Folders (Added) - ICC Results

Path	Folder Name
c:/Documents and Settings/dmc73144/Local Settings/Temp	1de41e67-bd18-49bc-b107-e68cc7e067e7
c:/Documents and Settings/dmc73144/Local Settings/Temp	7230677c-2d49-42fb-b963-8b5b0422eeb8

Files (Added) - ICC Results

Path	File Name
c:/Documents and Settings/dmc73144/Application Data	8fbc0ebc-15d7-4dae-818a-50f3473ae912_46.avi
c:/Documents and Settings/dmc73144/Local Settings/Temp/1de41e67-bd18-49bc-b107-e68cc7e067e7	wrk1.tmp_46
c:/WINDOWS/Prefetch	RUNDLL32.EXE-2D54F356.pf
c:/WINDOWS/Prefetch	SANDNET.EXE-2012C478.pf
c:	netstat_post.txt
c:	taskv_post.txt
c:/Documents and Settings/dmc73144/Application Data	8fbc0ebc-15d7-4dae-818a-50f3473ae912_46.avi
c:/Documents and Settings/dmc73144/Local Settings/Temp/7230677c-2d49-42fb-b963-8b5b0422eeb8	wrk1.tmp_46
c:/WINDOWS/Prefetch	RUNDLL32.EXE-474092B9.pf
c:/WINDOWS/Prefetch	SANDNET.EXE-2012C478.pf
c:	netstat_post.txt
c:	taskv_post.txt

Files (Deleted) - ICC Results

Action	Path	File Name

Files (Changed) - ICC Results

Action	Path	File Name
modified	c:/Documents and Settings/dmc73144/Cookies	index.dat
modified	c:/Documents and Settings/dmc73144/Local Settings/History/History.IE5	index.dat
modified	c:/Documents and Settings/dmc73144/Local Settings/Temporary Internet Files/Content.IE5	index.dat
modified	c:/Documents and Settings/dmc73144	ntuser.dat.LOG
modified	c:/WINDOWS/Prefetch	CMD.EXE-087B4001.pf
modified	c:/WINDOWS/Prefetch	HSTART.EXE-221D72BF.pf
modified	c:/WINDOWS/Prefetch	NETSTAT.EXE-2B2B4428.pf
modified	c:/WINDOWS/Prefetch	SH.EXE-00254D2B.pf
modified	c:/WINDOWS/Prefetch	SLEEP.EXE-094A3D2A.pf
modified	c:/WINDOWS/Prefetch	SSHD.EXE-298CA236.pf
modified	c:/WINDOWS/Prefetch	SWITCH.EXE-0496EC21.pf
modified	c:/WINDOWS/system32/drivers/etc	hosts
modified	c:/WINDOWS/system32/wbem/Logs	wmiprov.log
modified	c:/WINDOWS/system32/wbem/Repository/FS	INDEX.MAP
modified	c:/WINDOWS/system32/wbem/Repository/FS	MAPPING.VER
modified	c:/WINDOWS/system32/wbem/Repository/FS	MAPPING1.MAP
modified	c:/WINDOWS/system32/wbem/Repository/FS	OBJECTS.MAP
modified	c:/Documents and Settings/dmc73144/Cookies	index.dat
modified	c:/Documents and Settings/dmc73144/Local Settings/History/History.IE5	index.dat
modified	c:/Documents and Settings/dmc73144/Local Settings/Temporary Internet Files/Content.IE5	index.dat
modified	c:/Documents and Settings/dmc73144	ntuser.dat.LOG
modified	c:/WINDOWS/Prefetch	CMD.EXE-087B4001.pf
modified	c:/WINDOWS/Prefetch	HSTART.EXE-221D72BF.pf
modified	c:/WINDOWS/Prefetch	NETSTAT.EXE-2B2B4428.pf
modified	c:/WINDOWS/Prefetch	SH.EXE-00254D2B.pf
modified	c:/WINDOWS/Prefetch	SLEEP.EXE-094A3D2A.pf
modified	c:/WINDOWS/Prefetch	SSHD.EXE-298CA236.pf
modified	c:/WINDOWS/Prefetch	SWITCH.EXE-0496EC21.pf
modified	c:/WINDOWS/system32/drivers/etc	hosts
modified	c:/WINDOWS/system32/wbem/Logs	wmiprov.log
modified	c:/WINDOWS/system32/wbem/Repository/FS	INDEX.MAP
modified	c:/WINDOWS/system32/wbem/Repository/FS	MAPPING.VER
modified	c:/WINDOWS/system32/wbem/Repository/FS	MAPPING2.MAP
modified	c:/WINDOWS/system32/wbem/Repository/FS	OBJECTS.MAP

Registry Keys (Added) - ICC Results

Action	Path

Registry Values (Added) - ICC Results

Action	Path	Val_Name	Val_Data

Registry Values (Deleted) - ICC Results

Action	Path	Val_Name	Val_Type	Mod_Val_Type	Val_Data	Mod_Val_Data

Registry Values (Changed) - ICC Results

Action	Path	Val_Name	Val_Data	Mod_Val_Data
modified	HKLM/SOFTWARE/Microsoft/Cryptography/RNG	Seed	CA 54 87 04 48 53 46 8D E9 DD AB 74 98 D1 A9 07 98 33 42 01 F6 24 75 92 73 D2 55	79 82 E8 24 03 A2 FF ED 4D 7D CA EF 5B BE A7 E6 73 DE 09 1C A3 32 A0 6A 7F 52 E
modified	HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Internet Settings/Connections	SavedLegacySettings	3C 00 00 00 15 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00	3C 00 00 00 16 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0
modified	HKU/S-1-5-21-1844237615-562591055-839522115-1004/SessionInformation	ProgramCount	0x00000002	0x00000001
modified	HKLM/SOFTWARE/Microsoft/Cryptography/RNG	Seed	45 C6 A8 E3 6A D7 3C CE 7A C6 9A A0 3B 4C F6 F0 3D 58 8B 45 10 FE 4F 21 6F 7C 61	1F F1 70 69 42 45 3C 5D 12 FA 21 C7 25 C1 58 7D EA CE B8 08 0F 73 E5 94 9C 75 4
modified	HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Internet Settings/Connections	SavedLegacySettings	3C 00 00 00 15 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00	3C 00 00 00 16 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0
modified	HKU/S-1-5-21-1844237615-562591055-839522115-1004/SessionInformation	ProgramCount	0x00000002	0x00000001

DNS Results

DNS	DNS Response

URL Results

DstIP	HTTP_HOST	HTTP_REQUEST_URI	HTTP_USER_AGENT	PROTOCOL
91.188.60.5	91.188.60.5	/hit.php?v=46&app_type_id=1&wm_id=acc0042&u=1de41e67-bd18-49bc-b107-e68cc7e067e7&t=2		0x06
91.188.60.5	91.188.60.5	/hit.php?v=46&app_type_id=1&wm_id=acc0042&u=7230677c-2d49-42fb-b963-8b5b0422eeb8&t=2		0x06
239.255.255.250	239.255.255.250:1900	*	--blank--	0x11

ARGUS PROTOCOL Results

PROTOCOL	SRC_PKTS	DST_PKTS	SRC_BYTES	DST_BYTES
6	5	4	441	515
17	2	0	350	0

ARGUS DPORT Results

DPORT	PROTOCOL	SRC_PKTS	DST_PKTS	SRC_BYTES	DST_BYTES
80	6	5	4	441	515
1900	17	2	0	350	0

ARGUS DATA Results

Time	Date	Protocol	SrcIP	DstIP	Dir	Flags	Sport	Dport	Pkts	Bytes
13:19:52	2010-07-23	6	10.10.10.7	91.188.60.5	->	e	412	80	9	956
14:51:46	2010-07-23	6	10.10.10.7	91.188.60.5	->	e	284	80	9	956
13:25:08	2010-07-23	17	10.10.10.7	239.255.255.250	->	e	8	1900	2	350
14:57:09	2010-07-23	17	10.10.10.7	239.255.255.250	->	e	8	1900	2	350

Packer Results

Packer Name

HoneyTrap Results

Honey Trap Log File Location

PTFB Results

PTFB Log File Location