Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\WinDivert64] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\WinDivert64] 'ImagePath' = '<DRIVERS>\WinDivert64.sys'
- [<HKLM>\System\CurrentControlSet\Services\Bogard] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Bogard] 'ImagePath' = '"%ProgramFiles%\Bogard\Bogard.exe"'
- [<HKLM>\System\CurrentControlSet\Services\Bogard_updater_service] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Bogard_updater_service] 'ImagePath' = '"%ProgramFiles%\Bogard\Bogard_updater_service.exe"'
Creates the following services
- 'WinDivert64' <DRIVERS>\WinDivert64.sys
- 'Bogard' "%ProgramFiles%\Bogard\Bogard.exe"
- 'Bogard' %ProgramFiles%\Bogard\Bogard.exe
- 'Bogard_updater_service' "%ProgramFiles%\Bogard\Bogard_updater_service.exe"
- 'Bogard_updater_service' %ProgramFiles%\Bogard\Bogard_updater_service.exe
Modifies file system
Creates the following files
- %TEMP%\is-vcgip.tmp\<File name>.tmp
- %ProgramFiles%\bogard\bogard.installstate
- %ProgramFiles%\bogard\bogard.installlog
- %ProgramFiles%\bogard\installutil.installlog
- %WINDIR%\temp\udda91a.tmp
- <DRIVERS>\windivert64.sys
- %TEMP%\is-t1nqk.tmp\windivert64.sys
- %ProgramFiles%\bogard\utils.dll
- %TEMP%\is-t1nqk.tmp\editbin.exe
- %TEMP%\is-t1nqk.tmp\utils.dll
- %TEMP%\is-t1nqk.tmp\is-fn3hv.tmp
- %TEMP%\is-t1nqk.tmp\is-ffpvr.tmp
- %ProgramFiles%\bogard\is-dpins.tmp
- %ProgramFiles%\bogard\is-id87b.tmp
- %ProgramFiles%\bogard\is-73jb9.tmp
- %ProgramFiles%\bogard\is-j0t0n.tmp
- %ProgramFiles%\bogard\is-0fur2.tmp
- %ProgramFiles%\bogard\is-1nurp.tmp
- %ProgramFiles%\bogard\is-sm2ac.tmp
- %ProgramFiles%\bogard\is-nbsvh.tmp
- %TEMP%\is-t1nqk.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-t1nqk.tmp\_isetup\_setup64.tmp
- %TEMP%\is-aiv5t.tmp\bogard.tmp
- %TEMP%\is-236jn.tmp\bogard.exe
- %TEMP%\is-236jn.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-236jn.tmp\_isetup\_setup64.tmp
- %ProgramFiles%\bogard\bogard_updater_service.installlog
- %ProgramFiles%\bogard\bogard_updater_service.installstate
Deletes the following files
- %WINDIR%\temp\udda91a.tmp
Moves the following files
- from %ProgramFiles%\bogard\is-nbsvh.tmp to %ProgramFiles%\bogard\unins000.exe
- from %ProgramFiles%\bogard\is-sm2ac.tmp to %ProgramFiles%\bogard\windivert.dll
- from %ProgramFiles%\bogard\is-1nurp.tmp to %ProgramFiles%\bogard\networkutil.dll
- from %ProgramFiles%\bogard\is-0fur2.tmp to %ProgramFiles%\bogard\installationstatsuploder.exe
- from %ProgramFiles%\bogard\is-j0t0n.tmp to %ProgramFiles%\bogard\newtonsoft.json.dll
- from %ProgramFiles%\bogard\is-73jb9.tmp to %ProgramFiles%\bogard\installutil.exe
- from %ProgramFiles%\bogard\is-id87b.tmp to %ProgramFiles%\bogard\bogard_updater_service.exe
- from %ProgramFiles%\bogard\is-dpins.tmp to %ProgramFiles%\bogard\bogard.exe
- from %TEMP%\is-t1nqk.tmp\is-ffpvr.tmp to %TEMP%\is-t1nqk.tmp\editbin.exe
- from %TEMP%\is-t1nqk.tmp\is-fn3hv.tmp to %TEMP%\is-t1nqk.tmp\utils.dll
Network activity
TCP
HTTP GET requests
- http://ad######s.s3.amazonaws.com/configs/browser.jsonp
UDP
- DNS ASK ad######s.s3.amazonaws.com
Miscellaneous
Creates and executes the following
- '%TEMP%\is-vcgip.tmp\<File name>.tmp' /SL5="$100222,1108563,56832,<Full path to file>"
- '%TEMP%\is-236jn.tmp\bogard.exe' /VERYSILENT /SUBID=bogard2
- '%TEMP%\is-aiv5t.tmp\bogard.tmp' /SL5="$C0022,566560,322560,%TEMP%\is-236JN.tmp\bogard.exe" /VERYSILENT /SUBID=bogard2
- '%TEMP%\is-t1nqk.tmp\editbin.exe' SET_SUBID "bogard2" "%TEMP%\is-T1NQK.tmp\Utils.dll"
- '%ProgramFiles%\bogard\installutil.exe' Bogard.exe
- '%ProgramFiles%\bogard\installutil.exe' Bogard_updater_service.exe
- '%ProgramFiles%\bogard\installationstatsuploder.exe' i
- '%TEMP%\is-236jn.tmp\bogard.exe' /VERYSILENT /SUBID=bogard2' (with hidden window)
- '%TEMP%\is-t1nqk.tmp\editbin.exe' SET_SUBID "bogard2" "%TEMP%\is-T1NQK.tmp\Utils.dll"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' create WinDivert64 type= kernel start= auto error= normal binPath= <DRIVERS>\WinDivert64.sys' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' start WinDivert64' (with hidden window)
- '%ProgramFiles%\bogard\installutil.exe' Bogard.exe' (with hidden window)
- '%ProgramFiles%\bogard\installutil.exe' Bogard_updater_service.exe' (with hidden window)
- '%ProgramFiles%\bogard\installationstatsuploder.exe' i' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\sc.exe' create WinDivert64 type= kernel start= auto error= normal binPath= <DRIVERS>\WinDivert64.sys
- '%WINDIR%\syswow64\sc.exe' start WinDivert64
