APPENDIX A: Mpack State Changes

Monitor	Action	Actor	Action parameter
file	Write	C:\Program Files\Internet Explorer\IEXPLORE.EXE	C:\syswcon.exe
process	Created	C:\Program Files\Internet Explorer\IEXPLORE.EXE	C:\syswcon.exe
file	Write	C:\syswcon.exe	C:\WINDOWS\system32\drivers\uzcx.exe
process	Created	C:\syswcon.exe	C:\WINDOWS\system32\drivers\uzcx.exe
process	Terminated	C:\Program Files\Internet Explorer\IEXPLORE.EXE	C:\syswcon.exe
registry	SetValueKey	C:\WINDOWS\system32\drivers\ uzcx.exe	HKCU\Software\ewrew\uzcx\main\cid
file	Write	C:\WINDOWS\system32\drivers\ uzcx.exe	C:\Documents and Settings\cseifert\Local Settings\Temporary Internet Files\Content.IE5\OPUJWX63\benupd32[1].exe
file	Write	C:\WINDOWS\system32\drivers\ uzcx.exe	C:\WINDOWS\benupd32.exe
process	Created	C:\WINDOWS\system32\drivers\ uzcx.exe	C:\WINDOWS\benupd32.exe
registry	SetValueKey	C:\WINDOWS\system32\drivers\ uzcx.exe	HKCU\Software\ewrew\uzcx\main\term
process	Created	C:\WINDOWS\benupd32.exe	C:\WINDOWS\benupd32.exe
file	Write		C:\Documents and Settings\cseifert\Local Settings\Temp\clean_33d87.dll
process	Created	C:\WINDOWS\benupd32.exe	C:\WINDOWS\system32\regsvr32.exe
registry	SetValueKey	C:\WINDOWS\explorer.exe	HKLM\SYSTEM\ControlSet001\Services\ldrsvc\Parameters\ServiceDll

The Honeynet Project