Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '{FDF17B4A-8E6F-AD41-BE62-06E3AC4E25FE}' = '%APPDATA%\Roaming\Guvo\riidsu.exe'
Malicious functions:
Creates and executes the following:
- '%APPDATA%\Roaming\Guvo\riidsu.exe'
Executes the following:
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<SYSTEM32>\taskhost.exe"
Injects code into
the following system processes:
- <SYSTEM32>\rundll32.exe
- <SYSTEM32>\cmd.exe
- %WINDIR%\Explorer.EXE
- <SYSTEM32>\taskhost.exe
- <SYSTEM32>\Dwm.exe
Modifies file system :
Creates the following files:
- %TEMP%\tmp2fed664e.bat
- <LS_APPDATA>\Microsoft\Windows Mail\Local Folders\Inbox\679914B0-00000001.eml
- <LS_APPDATA>\Microsoft\Windows Mail\Local Folders\Junk E-mail\winmail.fol
- <LS_APPDATA>\Microsoft\Windows Mail\Local Folders\Deleted Items\winmail.fol
- <LS_APPDATA>\Microsoft\Windows Mail\Local Folders\Drafts\winmail.fol
- <LS_APPDATA>\Microsoft\Windows Mail\Local Folders\Inbox\679914B0-00000001.eml:OECustomProperty
- <LS_APPDATA>Low\Microsoft\CryptnetUrlCache\MetaData\E6024EAC88E6B6165D49FE3C95ADD735
- <LS_APPDATA>Low\Microsoft\CryptnetUrlCache\Content\E6024EAC88E6B6165D49FE3C95ADD735
- %TEMP%\ppcrlui_3972_2
- %TEMP%\Cab80E2.tmp
- %TEMP%\Tar80E3.tmp
- <LS_APPDATA>\Microsoft\Windows Mail\Backup\temp\WindowsMail.MSMessageStore
- <LS_APPDATA>\Microsoft\Windows Mail\edbtmp.log
- <LS_APPDATA>\Microsoft\Windows Mail\tmp.edb
- %APPDATA%\Roaming\Guvo\riidsu.exe
- <LS_APPDATA>\Microsoft\Windows Mail\Backup\temp\edb00002.log
- <LS_APPDATA>\Microsoft\Windows Mail\Local Folders\Outbox\winmail.fol
- <LS_APPDATA>\Microsoft\Windows Mail\Local Folders\Sent Items\winmail.fol
- <LS_APPDATA>\Microsoft\Windows Mail\Local Folders\Inbox\winmail.fol
- <LS_APPDATA>\Microsoft\Windows Mail\Backup\temp\WindowsMail.pat
- <LS_APPDATA>\Microsoft\Windows Mail\edb.log
Deletes the following files:
- %TEMP%\Tar80E3.tmp
- %TEMP%\Cab80E2.tmp
Moves the following files:
- from <LS_APPDATA>\Microsoft\Windows Mail\edbtmp.log to <LS_APPDATA>\Microsoft\Windows Mail\edb.log
Deletes itself.
Network activity:
Connects to:
- '20#.#6.232.182':80
TCP:
HTTP GET requests:
- 20#.#6.232.182/pki/crl/products/CodeSignPCA.crl
UDP:
- DNS ASK crl.microsoft.com
- '66.##7.77.134':15387
- '50.##.177.24':25517
- '15#.#12.138.69':23731
- '18#.#56.76.158':23986
- '15#.#9.166.206':10117
- '85.#.95.205':15080
- '10#.#11.64.46':23323
- '99.##.152.226':27763
Miscellaneous:
Searches for the following windows:
- ClassName: 'OleMainThreadWndClass' WindowName: '(null)'
- ClassName: 'OutlookExpressHiddenWindow' WindowName: '(null)'
- ClassName: 'Indicator' WindowName: '(null)'
