Malware Report - Results

This report shows all the different areas TAZER analyzes for the sample: Host, Network Activity, and Detection.

Malware Search Criteria:
  • MD5 =e260be6942e13c0159ca42964c7bb5f6

    • Malware Report - Results

    File MD5SumSHA1SUMSHA256SUMFUZZY HASHFile Size
    e260be6942e13c0159ca42964c7bb5f6b438a4d58c7d64f24764ccf0fdcc60850f80120d947653b7d0efb47b2ac99abdd7e68f1206887418d541273d0bc8c673bb9d0a183072:124/wTotfpE4mCYT/6i5HSfiyY4x/3g0B8yf/WwG3VTiXa4aLC/lQ6qAkKcY:1sVHTii5HSfrx/237836

    File Results

    File Name
    Commune.exe

    SNORT Results

    Snort ClassSnort AlertCount
    N/ANo snort alerts generated0

    AV Results

    AV AlertAV Vendor
    Backdoor.TrojanSymantec
    Generic.dx!b2zkMcAfee
    Trojan.Win32.Scar.edlvKaspersky

    Folders (Added) - ICC Results

    PathFolder Name
    c:/Documents and Settings/dmc73144/Local Settings/Temporary Internet Files/Content.IE5ITB2CJ0C

    Files (Added) - ICC Results

    PathFile Name
    c:/Documents and Settings/dmc73144/Application Data/Mozilla/Firefox/Profiles/ektregxy.defaultsignons.sqlite
    c:/Documents and Settings/dmc73144/Application DataFirewall.exe
    c:/Documents and Settings/dmc73144/Application Datalovely.ini
    c:/Documents and Settings/dmc73144/Application Datanet.bat
    c:/Documents and Settings/dmc73144/Application Datanet.vbs
    c:/Documents and Settings/dmc73144/Local Settings/Temporary Internet Files/Content.IE5/ITB2CJ0Cdesktop.ini
    c:/Documents and Settings/dmc73144/Local Settings/Temporary Internet Files/Content.IE5/ITB2CJ0Cprofile[1].htm
    c:/Documents and Settings/dmc73144/Local Settings/Temporary Internet Files/Content.IE5/ITB2CJ0Cprofile[2].htm
    c:/Documents and Settings/dmc73144/Local Settings/Temporary Internet Files/Content.IE5/ITB2CJ0Cprofile[3].htm
    c:/Documents and Settings/dmc73144/Local Settings/Temporary Internet Files/Content.IE5/ITB2CJ0Cprofile[4].htm
    c:/Documents and Settings/dmc73144/Local Settings/Temporary Internet Files/Content.IE5/ITB2CJ0Cprofile[5].htm
    c:/Documents and Settings/dmc73144/Local Settings/Temporary Internet Files/Content.IE5/ITB2CJ0Cprofile[6].htm
    c:/Documents and Settings/dmc73144/Local Settings/Temporary Internet Files/Content.IE5/ITB2CJ0Cwarrior_logdata=downloaded payload[1].htm
    c:/Documents and Settings/dmc73144/Local Settings/Temporary Internet Files/Content.IE5/ITB2CJ0Cwarrior_logdata=executed payload[1].htm
    c:/Documents and Settings/dmc73144/Local Settings/Temporary Internet Files/Content.IE5/ITB2CJ0Cwarrior_logdata=infected[1].htm
    c:/Documents and Settings/dmc73144/Local Settings/Temporary Internet Files/Content.IE5/ITB2CJ0Cwarrior_logdata=rar archives infected[1].htm
    c:/WINDOWS/PrefetchAUTOIT3.EXE-32361418.pf
    c:/WINDOWS/PrefetchREGSHOT.EXE-010A5EE6.pf
    c:/WINDOWS/PrefetchSANDNET.EXE-2012C478.pf

    Files (Deleted) - ICC Results

    ActionPathFile Name

    Files (Changed) - ICC Results

    ActionPathFile Name
    modifiedc:/Documents and Settings/dmc73144/Cookiesindex.dat
    modifiedc:/Documents and Settings/dmc73144/Local Settings/History/History.IE5index.dat
    modifiedc:/Documents and Settings/dmc73144/Local Settings/Temporary Internet Files/Content.IE5index.dat
    modifiedc:/Documents and Settings/dmc73144NTUSER.DAT
    modifiedc:/Documents and Settings/dmc73144ntuser.dat.LOG
    modifiedc:/WINDOWS/PrefetchCMD.EXE-087B4001.pf
    modifiedc:/WINDOWS/PrefetchHSTART.EXE-221D72BF.pf
    modifiedc:/WINDOWS/PrefetchSH.EXE-00254D2B.pf
    modifiedc:/WINDOWS/PrefetchSSHD.EXE-298CA236.pf
    modifiedc:/WINDOWS/PrefetchSWITCH.EXE-0496EC21.pf
    modifiedc:/WINDOWS/PrefetchWMIPRVSE.EXE-28F301A9.pf
    modifiedc:/WINDOWS/system32/configsoftware.LOG
    modifiedc:/WINDOWS/system32/drivers/etchosts
    modifiedc:/WINDOWS/system32/wbem/Logswmiprov.log

    Registry Keys (Added) - ICC Results

    ActionPath
    addedHKLM/SOFTWARE/Microsoft/DownloadManager
    addedHKLM/SYSTEM/ControlSet001/Enum/Root/LEGACY_FASTFAT/0000/Control
    addedHKLM/SYSTEM/CurrentControlSet/Enum/Root/LEGACY_FASTFAT/0000/Control
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/Active Directory GC
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/Bigfoot
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/VeriSign
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/WhoWhere

    Registry Values (Added) - ICC Results

    ActionPathVal_NameVal_Data
    addedHKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/RunFirewall.ex "C:/Documents and Settings/dmc73144/Application Data/Firewall.exe"
    addedHKLM/SYSTEM/ControlSet001/Enum/Root/LEGACY_FASTFAT/0000/ControlActiveService"Fastfat"
    addedHKLM/SYSTEM/CurrentControlSet/Enum/Root/LEGACY_FASTFAT/0000/ControlActiveService"Fastfat"
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Identities/{32BF15D6-D919-458D-8A1A-AC3F3B3F3027}Identity Ordinal0x00000001
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/RunFirewall.ex "C:/Documents and Settings/dmc73144/Application Data/Firewall.exe"
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/RunOnceFILE_47200 "C:/Documents and Settings/dmc73144/Application Data/FILE_47200.exe"
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/WhoWhereLDAP Server ID0x00000003
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/WhoWhereAccount Name"WhoWhere Internet Directory Service"
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/WhoWhereLDAP Server"ldap.whowhere.com"
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/WhoWhereLDAP URL"http
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/WhoWhereLDAP Search Return0x00000064
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/WhoWhereLDAP Timeout0x0000003C
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/WhoWhereLDAP Authentication0x00000000
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/WhoWhereLDAP Simple Search0x00000001
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/WhoWhereLDAP Logo"%ProgramFiles%Common FilesServiceswhowhere.bmp"
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/VeriSignLDAP Server ID0x00000002
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/VeriSignAccount Name"VeriSign Internet Directory Service"
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/VeriSignLDAP Server"directory.verisign.com"
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/VeriSignLDAP URL"http
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/VeriSignLDAP Search Return0x00000064
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/VeriSignLDAP Timeout0x0000003C
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/VeriSignLDAP Authentication0x00000000
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/VeriSignLDAP Search Base"NULL"
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/VeriSignLDAP Simple Search0x00000001
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/VeriSignLDAP Logo"%ProgramFiles%Common FilesServicesverisign.bmp"
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/BigfootLDAP Server ID0x00000001
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/BigfootAccount Name"Bigfoot Internet Directory Service"
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/BigfootLDAP Server"ldap.bigfoot.com"
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/BigfootLDAP URL"http
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/BigfootLDAP Search Return0x00000064
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/BigfootLDAP Timeout0x0000003C
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/BigfootLDAP Authentication0x00000000
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/BigfootLDAP Simple Search0x00000001
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/BigfootLDAP Logo"%ProgramFiles%Common FilesServicesbigfoot.bmp"
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/Active Directory GCLDAP Server ID0x00000000
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/Active Directory GCAccount Name"Active Directory"
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/Active Directory GCLDAP Server"NULL"
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/Active Directory GCLDAP Search Return0x00000064
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/Active Directory GCLDAP Timeout0x0000003C
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/Active Directory GCLDAP Authentication0x00000002
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/Active Directory GCLDAP Simple Search0x00000000
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/Active Directory GCLDAP Bind DN0x00000000
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/Active Directory GCLDAP Port0x00000CC4
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/Active Directory GCLDAP Resolve Flag0x00000001
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/Active Directory GCLDAP Secure Connection0x00000000
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/Active Directory GCLDAP User Name"NULL"
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/Accounts/Active Directory GCLDAP Search Base"NULL"
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/AccountsAssociatedIDD6 15 BF 32 19 D9 8D 45 8A 1A AC 3F 3B 3F 30 27
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/AccountsPreConfigVer0x00000004
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account Manager/AccountsPreConfigVerNTDS0x00000001
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account ManagerServer ID0x00000004
    addedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Internet Account ManagerDefault LDAP Account"Active Directory GC"

    Registry Values (Deleted) - ICC Results

    ActionPathVal_NameVal_TypeMod_Val_TypeVal_DataMod_Val_Data

    Registry Values (Changed) - ICC Results

    ActionPathVal_NameVal_DataMod_Val_Data
    modifiedHKLM/SOFTWARE/Microsoft/Cryptography/RNGSeed47 33 7C 69 CE 6C 80 0A E3 1A D9 58 94 0B 8E 76 30 47 B0 4F 3E 74 FC EA 12 7C 0F38 70 CD 70 09 2D D9 FD CA 7A 7C 0C 1E C2 2F 29 C1 3A 25 5C 9F 90 9B 28 CD AA B7
    modifiedHKU/S-1-5-21-1844237615-562591055-839522115-1004/IdentitiesIdentity Ordinal0x000000010x00000002
    modifiedHKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Internet Settings/ConnectionsSavedLegacySettings3C 00 00 00 15 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 003C 00 00 00 16 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00

    DNS Results

    DNSDNS Response
    www.warrior?logdata=downloaded payloadStandard query response A 63.251.179.57 A 64.158.56.57
    www.warrior?logdata=executed payloadStandard query response A 63.251.179.57 A 64.158.56.57
    www.warrior?logdata=infectedStandard query response A 63.251.179.57 A 64.158.56.57
    www.warrior?logdata=rar archives infectedStandard query response A 63.251.179.57 A 64.158.56.57
    www.facebook.comStandard query response A 69.171.228.39
    warriorz.orgStandard query response, Server failure

    URL Results

    DstIPHTTP_HOSTHTTP_REQUEST_URIHTTP_USER_AGENTPROTOCOL
    63.251.179.57www.warrior?logdata=Downloaded payload/Mozilla/5.0 (Windows NT 6.1; rv:2.0b7pre) Gecko/20100921 Firefox/4.0b7pre0x06
    63.251.179.57www.warrior?logdata=Executed payload/Mozilla/5.0 (Windows NT 6.1; rv:2.0b7pre) Gecko/20100921 Firefox/4.0b7pre0x06
    63.251.179.57www.warrior?logdata=Infected/Mozilla/5.0 (Windows NT 6.1; rv:2.0b7pre) Gecko/20100921 Firefox/4.0b7pre0x06
    63.251.179.57www.warrior?logdata=RAR archives infected/Mozilla/5.0 (Windows NT 6.1; rv:2.0b7pre) Gecko/20100921 Firefox/4.0b7pre0x06
    69.171.228.39www.facebook.com/profile.php?id=122439211758459&sk=infoMozilla/5.0 (Windows NT 6.1; rv:2.0b7pre) Gecko/20100921 Firefox/4.0b7pre0x06
    69.171.228.39www.facebook.com/profile.php?id=215439087642321&sk=infoMozilla/5.0 (Windows NT 6.1; rv:2.0b7pre) Gecko/20100921 Firefox/4.0b7pre0x06
    69.171.228.39www.facebook.com/profile.php?id=376398625752988&sk=infoMozilla/5.0 (Windows NT 6.1; rv:2.0b7pre) Gecko/20100921 Firefox/4.0b7pre0x06
    69.171.228.39www.facebook.com/profile.php?id=241360917393383&sk=infoMozilla/5.0 (Windows NT 6.1; rv:2.0b7pre) Gecko/20100921 Firefox/4.0b7pre0x06
    69.171.228.39www.facebook.com/profile.php?id=686682047654965&sk=infoMozilla/5.0 (Windows NT 6.1; rv:2.0b7pre) Gecko/20100921 Firefox/4.0b7pre0x06
    69.171.228.39www.facebook.com/profile.php?id=74703789741141&sk=infoMozilla/5.0 (Windows NT 6.1; rv:2.0b7pre) Gecko/20100921 Firefox/4.0b7pre0x06
    69.171.228.39www.facebook.com/profile.php?id=7812863055943&sk=infoMozilla/5.0 (Windows NT 6.1; rv:2.0b7pre) Gecko/20100921 Firefox/4.0b7pre0x06
    69.171.228.39www.facebook.com/profile.php?id=443011053336067&sk=infoMozilla/5.0 (Windows NT 6.1; rv:2.0b7pre) Gecko/20100921 Firefox/4.0b7pre0x06

    ARGUS PROTOCOL Results

    PROTOCOLSRC_PKTSDST_PKTSSRC_BYTESDST_BYTES
    6604857806180

    ARGUS DPORT Results

    DPORTPROTOCOLSRC_PKTSDST_PKTSSRC_BYTESDST_BYTES
    806604857806180

    ARGUS DATA Results

    TimeDateProtocolSrcIPDstIPDirFlagsSportDportPktsBytes
    04:58:562011-10-10610.10.10.763.251.179.57-> e 253809987
    04:58:572011-10-10610.10.10.763.251.179.57-> e 254809985
    04:58:582011-10-10610.10.10.763.251.179.57-> e 397809977
    04:58:592011-10-10610.10.10.763.251.179.57-> e 398809990
    04:59:052011-10-10610.10.10.769.171.228.39-> e 5088091003
    04:59:142011-10-10610.10.10.769.171.228.39-> e 5238091003
    04:59:232011-10-10610.10.10.769.171.228.39-> e 5248091003
    04:59:322011-10-10610.10.10.769.171.228.39-> e 5598091003
    04:59:402011-10-10610.10.10.769.171.228.39-> e 5608091003
    04:59:492011-10-10610.10.10.769.171.228.39-> e 4698091002
    04:59:572011-10-10610.10.10.769.171.228.39-> e 5988091001
    05:00:122011-10-10610.10.10.769.171.228.39-> e 3088091003

    Packer Results

    Packer Name

    HoneyTrap Results

    Honey Trap Log File Location

    PTFB Results

    PTFB Log File Location