Adware.Rio.1

To ensure autorun and distribution

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\WinDivert64] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\WinDivert64] 'ImagePath' = '<DRIVERS>\WinDivert64.sys'
[<HKLM>\System\CurrentControlSet\Services\Bogard] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\Bogard] 'ImagePath' = '"%ProgramFiles%\Bogard\Bogard.exe"'
[<HKLM>\System\CurrentControlSet\Services\Bogard_updater_service] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\Bogard_updater_service] 'ImagePath' = '"%ProgramFiles%\Bogard\Bogard_updater_service.exe"'

Creates the following services

Modifies file system

Creates the following files

Deletes the following files

Moves the following files

from %ProgramFiles%\bogard\is-nbsvh.tmp to %ProgramFiles%\bogard\unins000.exe
from %ProgramFiles%\bogard\is-sm2ac.tmp to %ProgramFiles%\bogard\windivert.dll
from %ProgramFiles%\bogard\is-1nurp.tmp to %ProgramFiles%\bogard\networkutil.dll
from %ProgramFiles%\bogard\is-0fur2.tmp to %ProgramFiles%\bogard\installationstatsuploder.exe
from %ProgramFiles%\bogard\is-j0t0n.tmp to %ProgramFiles%\bogard\newtonsoft.json.dll
from %ProgramFiles%\bogard\is-73jb9.tmp to %ProgramFiles%\bogard\installutil.exe
from %ProgramFiles%\bogard\is-id87b.tmp to %ProgramFiles%\bogard\bogard_updater_service.exe
from %ProgramFiles%\bogard\is-dpins.tmp to %ProgramFiles%\bogard\bogard.exe
from %TEMP%\is-t1nqk.tmp\is-ffpvr.tmp to %TEMP%\is-t1nqk.tmp\editbin.exe
from %TEMP%\is-t1nqk.tmp\is-fn3hv.tmp to %TEMP%\is-t1nqk.tmp\utils.dll

Network activity

TCP

HTTP GET requests

UDP

Miscellaneous

Creates and executes the following

'%TEMP%\is-vcgip.tmp\<File name>.tmp' /SL5="$100222,1108563,56832,<Full path to file>"
'%TEMP%\is-236jn.tmp\bogard.exe' /VERYSILENT /SUBID=bogard2
'%TEMP%\is-aiv5t.tmp\bogard.tmp' /SL5="$C0022,566560,322560,%TEMP%\is-236JN.tmp\bogard.exe" /VERYSILENT /SUBID=bogard2
'%TEMP%\is-t1nqk.tmp\editbin.exe' SET_SUBID "bogard2" "%TEMP%\is-T1NQK.tmp\Utils.dll"
'%ProgramFiles%\bogard\installutil.exe' Bogard.exe
'%ProgramFiles%\bogard\installutil.exe' Bogard_updater_service.exe
'%ProgramFiles%\bogard\installationstatsuploder.exe' i
'%TEMP%\is-236jn.tmp\bogard.exe' /VERYSILENT /SUBID=bogard2' (with hidden window)
'%TEMP%\is-t1nqk.tmp\editbin.exe' SET_SUBID "bogard2" "%TEMP%\is-T1NQK.tmp\Utils.dll"' (with hidden window)
'%WINDIR%\syswow64\sc.exe' create WinDivert64 type= kernel start= auto error= normal binPath= <DRIVERS>\WinDivert64.sys' (with hidden window)
'%WINDIR%\syswow64\sc.exe' start WinDivert64' (with hidden window)
'%ProgramFiles%\bogard\installutil.exe' Bogard.exe' (with hidden window)
'%ProgramFiles%\bogard\installutil.exe' Bogard_updater_service.exe' (with hidden window)
'%ProgramFiles%\bogard\installationstatsuploder.exe' i' (with hidden window)

Executes the following

'%WINDIR%\syswow64\sc.exe' create WinDivert64 type= kernel start= auto error= normal binPath= <DRIVERS>\WinDivert64.sys
'%WINDIR%\syswow64\sc.exe' start WinDivert64