SonicALERT
Search

Sonicwall Signatures

 

Go to All Categories list.


  Ganelp.E_3
Ganelp.E_3 is a Worm. Worms are reproducing malicious programs that run independently and travel across network connections without human action. They could spread over email, IM, peer-to-peer networks, or directly over the wire by leveraging vulnerabilities. The threat that a worm poses is its capability to replicate itself on the system so the computer can send out hundreds or thousands of copies of itself.

Mutexes created
  • Nothing to report


Directory level activity
  • create - dir - C:\Program Files\d0eae3e9
  • create - dir - C:\Program Files\d0eae3e9


File level activity
  • write - file - C:\Program Files\d0eae3e9\jusched.exe
  • write - file - C:\Program Files\d0eae3e9\d0eae3e9
  • write - file - C:\WINDOWS\Tasks\Update23.job
  • write - file - PIPE\lsarpc
  • write - file - PIPE\wkssvc


Registry level activity
  • write - registry - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\ListC:\Program Files\d0eae3e9\jusched.exe
  • write - registry - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell FoldersPersonal
  • write - registry - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0932c062-299c-11e2-afd8-806d6172696f}\BaseClass
  • write - registry - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0932c060-299c-11e2-afd8-806d6172696f}\BaseClass
  • write - registry - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell FoldersCommon Documents
  • write - registry - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell FoldersDesktop
  • write - registry - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell FoldersCommon Desktop
  • write - registry - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
  • write - registry - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName
  • write - registry - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet
  • write - registry - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell FoldersCache
  • write - registry - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell FoldersCookies
  • write - registry - HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoamMUICacheLangID
  • write - registry - HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoamMUICacheC:\Program Files\d0eae3e9\jusched.exe


Library level activity
  • load - library - kernel32.dll
  • load - library - advapi32.dll
  • load - library - C:\WINDOWS\system32\rpcss.dll
  • load - library - C:\WINDOWS\system32\uxtheme.dll
  • load - library - uxtheme.dll
  • load - library - CLBCATQ.DLL
  • load - library - ole32.dll
  • load - library - KERNEL32.DLL
  • load - library - C:\WINDOWS\system32\mstask.dll
  • load - library - Secur32.dll
  • load - library - OLE32.DLL
  • load - library - C:\WINDOWS\system32\SHELL32.dll
  • load - library - MPR.DLL
  • load - library - shell32.dll
  • load - library - netapi32
  • load - library - SHELL32.dll
  • load - library - SETUPAPI.dll
  • load - library - C:\WINDOWS\system32\urlmon.dll
  • load - library - kernel32
  • load - library - userenv
  • load - library - KERNEL32
  • load - library - VERSION.dll
  • load - library - C:\Program Files\d0eae3e9\jusched.exe
  • load - library - browseui.dll
  • load - library - kernel32.dll


Process API calls used
  • NtFreeVirtualMemory
  • ZwMapViewOfSection
  • NtCreateSection
  • CreateProcessInternalW
  • ExitProcess


Registry API calls used
  • RegOpenKeyExA
  • RegSetValueExA
  • RegCloseKey
  • RegOpenKeyExW
  • RegQueryValueExW
  • NtOpenKey
  • RegEnumKeyW
  • NtQueryValueKey
  • RegCreateKeyExA
  • RegDeleteValueA
  • RegCreateKeyExW
  • RegSetValueExW
  • RegEnumValueW
  • RegQueryInfoKeyW
  • RegEnumKeyExW
  • RegQueryInfoKeyA
  • RegEnumKeyExA
  • RegEnumValueA
  • RegCloseKey


System API calls used
  • LdrGetDllHandle
  • LdrGetProcedureAddress
  • NtDelayExecution
  • LdrLoadDll
  • IsDebuggerPresent
  • LookupPrivilegeValueW
  • LdrGetDllHandle


Filesystem API calls used
  • NtOpenFile
  • NtQueryInformationFile
  • NtCreateFile
  • NtReadFile
  • CreateDirectoryW
  • NtWriteFile
  • NtSetInformationFile
  • FindFirstFileExW
  • NtReadFile

Network

UDP source >> destination


    TCP source >> destination



      Domains:
      • NA

      DNS Request:
      • NA

      HTTP Request:
      • NA

      DLL related data
      Number of DLL's imported = 4
      • KERNEL32.dll
      • USER32.dll
      • ADVAPI32.dll
      • ole32.dll


      Relevant Information