Gamarue_12 is a Trojan. A Trojan is a program that pretends to have a valid use, but in fact modifies the user's computer in malicious ways. Trojans do not replicate or spread to other computers.
Process Related Changes
It creates the following mutex(es):
- ZonesCacheCounterMutex"
- ZonesLockedCacheCounterMutex"
- c:!documents and settings!admin!local settings!application data!microsoft!feeds cache!"
- c:!documents and settings!admin!local settings!history!history.ie5!"
- qazwsxedc"
- CTF.TMD.MutexDefaultS-1-5-21-1078081533-842925246-854245398-1003"
- CTF.TimListCache.FMPDefaultS-1-5-21-1078081533-842925246-854245398-1003MUTEX.DefaultS-1-5-21-1078081533-842925246-854245398-1003"
- CTF.Compart.MutexDefaultS-1-5-21-1078081533-842925246-854245398-1003"
- c:!documents and settings!admin!local settings!temporary internet files!content.ie5!"
- ZoneAttributeCacheCounterMutex"
- !PrivacIE!SharedMemory!Mutex"
- ZonesCounterMutex"
- CTF.Layouts.MutexDefaultS-1-5-21-1078081533-842925246-854245398-1003"
- SHIMLIB_LOG_MUTEX"
- CTF.Asm.MutexDefaultS-1-5-21-1078081533-842925246-854245398-1003"
- SmartScreen_ClientId_Mutex"
- SmartScreen_UrsCacheMutex_2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2High_S-1-5-21-1078081533-842925246-854245398-1003"
- CTF.LBES.MutexDefaultS-1-5-21-1078081533-842925246-854245398-1003"
- c:!documents and settings!admin!cookies!"
It creates the following process(es): - C:\WINDOWS\Temp\7469c1ee0827a289fa775f4a5656e5f9.exe [ c:\windows\temp\7469c1ee0827a289fa775f4a5656e5f9.exe ]
- C:\WINDOWS\system32\msiexec.exe
- C:\WINDOWS\Temp\7469c1ee0827a289fa775f4a5656e5f9.exe [ \c:\windows\temp\7469c1ee0827a289fa775f4a5656e5f9.exe ]
It injects malicious code into the following process(es): - "C:\Program Files\Internet Explorer\iexplore.exe"
Network Activity
We observed the following DNS query/queries: - south-america.pool.ntp.org
- north-america.pool.ntp.org
- europe.pool.ntp.org
|
