resource	yara_rule
behavioral2/memory/1684-0-0x0000000000400000-0x0000000000599000-memory.dmp	upx
behavioral2/files/0x000900000002314b-10.dat	upx
behavioral2/memory/1684-25-0x0000000000400000-0x0000000000599000-memory.dmp	upx
behavioral2/memory/1684-26-0x0000000000400000-0x0000000000599000-memory.dmp	upx
behavioral2/memory/1684-27-0x0000000000400000-0x0000000000599000-memory.dmp	upx
behavioral2/memory/1684-28-0x0000000000400000-0x0000000000599000-memory.dmp	upx
behavioral2/memory/1684-32-0x0000000000400000-0x0000000000599000-memory.dmp	upx
behavioral2/memory/1684-33-0x0000000000400000-0x0000000000599000-memory.dmp	upx
behavioral2/memory/1684-34-0x0000000000400000-0x0000000000599000-memory.dmp	upx
behavioral2/memory/1684-37-0x0000000000400000-0x0000000000599000-memory.dmp	upx
behavioral2/memory/1684-38-0x0000000000400000-0x0000000000599000-memory.dmp	upx
behavioral2/memory/1684-39-0x0000000000400000-0x0000000000599000-memory.dmp	upx

description	ioc	Process
File opened (read-only)	\??\k:	8df8c579fd804944150aa3e2d11c4752.exe
File opened (read-only)	\??\r:	8df8c579fd804944150aa3e2d11c4752.exe
File opened (read-only)	\??\z:	8df8c579fd804944150aa3e2d11c4752.exe
File opened (read-only)	\??\h:	8df8c579fd804944150aa3e2d11c4752.exe
File opened (read-only)	\??\u:	8df8c579fd804944150aa3e2d11c4752.exe
File opened (read-only)	\??\v:	8df8c579fd804944150aa3e2d11c4752.exe
File opened (read-only)	\??\x:	8df8c579fd804944150aa3e2d11c4752.exe
File opened (read-only)	\??\y:	8df8c579fd804944150aa3e2d11c4752.exe
File opened (read-only)	\??\m:	8df8c579fd804944150aa3e2d11c4752.exe
File opened (read-only)	\??\g:	8df8c579fd804944150aa3e2d11c4752.exe
File opened (read-only)	\??\j:	8df8c579fd804944150aa3e2d11c4752.exe
File opened (read-only)	\??\n:	8df8c579fd804944150aa3e2d11c4752.exe
File opened (read-only)	\??\o:	8df8c579fd804944150aa3e2d11c4752.exe
File opened (read-only)	\??\s:	8df8c579fd804944150aa3e2d11c4752.exe
File opened (read-only)	\??\t:	8df8c579fd804944150aa3e2d11c4752.exe
File opened (read-only)	\??\b:	8df8c579fd804944150aa3e2d11c4752.exe
File opened (read-only)	\??\e:	8df8c579fd804944150aa3e2d11c4752.exe
File opened (read-only)	\??\i:	8df8c579fd804944150aa3e2d11c4752.exe
File opened (read-only)	\??\l:	8df8c579fd804944150aa3e2d11c4752.exe
File opened (read-only)	\??\p:	8df8c579fd804944150aa3e2d11c4752.exe
File opened (read-only)	\??\q:	8df8c579fd804944150aa3e2d11c4752.exe
File opened (read-only)	\??\w:	8df8c579fd804944150aa3e2d11c4752.exe
File opened (read-only)	\??\a:	8df8c579fd804944150aa3e2d11c4752.exe

resource	yara_rule
behavioral2/memory/1684-25-0x0000000000400000-0x0000000000599000-memory.dmp	autoit_exe
behavioral2/memory/1684-26-0x0000000000400000-0x0000000000599000-memory.dmp	autoit_exe
behavioral2/memory/1684-27-0x0000000000400000-0x0000000000599000-memory.dmp	autoit_exe
behavioral2/memory/1684-28-0x0000000000400000-0x0000000000599000-memory.dmp	autoit_exe
behavioral2/memory/1684-32-0x0000000000400000-0x0000000000599000-memory.dmp	autoit_exe
behavioral2/memory/1684-33-0x0000000000400000-0x0000000000599000-memory.dmp	autoit_exe
behavioral2/memory/1684-34-0x0000000000400000-0x0000000000599000-memory.dmp	autoit_exe
behavioral2/memory/1684-37-0x0000000000400000-0x0000000000599000-memory.dmp	autoit_exe
behavioral2/memory/1684-38-0x0000000000400000-0x0000000000599000-memory.dmp	autoit_exe
behavioral2/memory/1684-39-0x0000000000400000-0x0000000000599000-memory.dmp	autoit_exe

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\system32_.exe	8df8c579fd804944150aa3e2d11c4752.exe
File created	C:\Windows\SysWOW64\system32_.exe	8df8c579fd804944150aa3e2d11c4752.exe

description	ioc	Process
File opened for modification	C:\Windows\system32_.exe	8df8c579fd804944150aa3e2d11c4752.exe
File created	C:\Windows\system32_.exe	8df8c579fd804944150aa3e2d11c4752.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main	8df8c579fd804944150aa3e2d11c4752.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\RunOnceComplete = "1"	8df8c579fd804944150aa3e2d11c4752.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	8df8c579fd804944150aa3e2d11c4752.exe
Key created	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Internet Explorer\Main	8df8c579fd804944150aa3e2d11c4752.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\Main\RunOnceComplete = "1"	8df8c579fd804944150aa3e2d11c4752.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	8df8c579fd804944150aa3e2d11c4752.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\Main\RunOnceHasShown = "1"	8df8c579fd804944150aa3e2d11c4752.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "h\x01t\x01t\x01p\x01:\x01/\x01/\x01w\x01w\x01w\x01.\x01g\x01o\x01o\x01g\x01l\x01e\x01.\x01c\x01o\x01m\x01/\x01s\x01e\x01a\x01r\x01c\x01h\x01?\x01q\x01=\x01{\x01s\x01e\x01a\x01r\x01c\x01h\x01T\x01e\x01r\x01m\x01s\x01}\x01&\x01s\x01o\x01u\x01r\x01c\x01e\x01i\x01d\x01=\x01i\x01e\x017\x01&\x01r\x01l\x01s\x01=\x01c\x01o\x01m\x01.\x01m\x01i\x01c\x01r\x01o\x01s\x01o\x01f\x01t\x01:\x01{\x01l\x01a\x01n\x01g\x01u\x01a\x01g\x01e\x01}\x01:\x01{\x01r\x01e\x01f\x01e\x01r\x01r\x01e\x01r\x01:\x01s\x01o\x01u\x01r\x01c\x01e\x01}\x01&\x01i\x01e\x01=\x01{\x01i\x01n\x01p\x01u\x01t\x01E\x01n\x01c\x01o\x01d\x01i\x01n\x01g\x01?\x01}\x01&\x01o\x01e\x01=\x01{\x01o\x01u\x01t\x01p\x01u\x01t\x01E\x01n\x01c\x01o\x01d\x01i\x01n\x01g\x01?\x01}\x01"	8df8c579fd804944150aa3e2d11c4752.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://www.todaygoogle.com"	8df8c579fd804944150aa3e2d11c4752.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://www.sioril.com"	8df8c579fd804944150aa3e2d11c4752.exe
Key created	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	8df8c579fd804944150aa3e2d11c4752.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.sioril.com"	8df8c579fd804944150aa3e2d11c4752.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://www.sioril.com"	8df8c579fd804944150aa3e2d11c4752.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\RunOnceHasShown = "1"	8df8c579fd804944150aa3e2d11c4752.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "h\x01t\x01t\x01p\x01:\x01/\x01/\x01w\x01w\x01w\x01.\x01g\x01o\x01o\x01g\x01l\x01e\x01.\x01c\x01o\x01m\x01/\x01s\x01e\x01a\x01r\x01c\x01h\x01?\x01q\x01=\x01{\x01s\x01e\x01a\x01r\x01c\x01h\x01T\x01e\x01r\x01m\x01s\x01}\x01&\x01s\x01o\x01u\x01r\x01c\x01e\x01i\x01d\x01=\x01i\x01e\x017\x01&\x01r\x01l\x01s\x01=\x01c\x01o\x01m\x01.\x01m\x01i\x01c\x01r\x01o\x01s\x01o\x01f\x01t\x01:\x01{\x01l\x01a\x01n\x01g\x01u\x01a\x01g\x01e\x01}\x01:\x01{\x01r\x01e\x01f\x01e\x01r\x01r\x01e\x01r\x01:\x01s\x01o\x01u\x01r\x01c\x01e\x01}\x01&\x01i\x01e\x01=\x01{\x01i\x01n\x01p\x01u\x01t\x01E\x01n\x01c\x01o\x01d\x01i\x01n\x01g\x01?\x01}\x01&\x01o\x01e\x01=\x01{\x01o\x01u\x01t\x01p\x01u\x01t\x01E\x01n\x01c\x01o\x01d\x01i\x01n\x01g\x01?\x01}\x01"	8df8c579fd804944150aa3e2d11c4752.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.todaygoogle.com"	8df8c579fd804944150aa3e2d11c4752.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://www.todaygoogle.com"	8df8c579fd804944150aa3e2d11c4752.exe

pid	Process
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe
1684	8df8c579fd804944150aa3e2d11c4752.exe

description	pid	Process	procid_target
PID 1684 wrote to memory of 2284	1684	8df8c579fd804944150aa3e2d11c4752.exe	89
PID 1684 wrote to memory of 2284	1684	8df8c579fd804944150aa3e2d11c4752.exe	89
PID 1684 wrote to memory of 2284	1684	8df8c579fd804944150aa3e2d11c4752.exe	89
PID 2284 wrote to memory of 840	2284	cmd.exe	90
PID 2284 wrote to memory of 840	2284	cmd.exe	90
PID 2284 wrote to memory of 840	2284	cmd.exe	90
PID 1684 wrote to memory of 4068	1684	8df8c579fd804944150aa3e2d11c4752.exe	93
PID 1684 wrote to memory of 4068	1684	8df8c579fd804944150aa3e2d11c4752.exe	93
PID 1684 wrote to memory of 4068	1684	8df8c579fd804944150aa3e2d11c4752.exe	93
PID 4068 wrote to memory of 2732	4068	cmd.exe	91
PID 4068 wrote to memory of 2732	4068	cmd.exe	91
PID 4068 wrote to memory of 2732	4068	cmd.exe	91
PID 1684 wrote to memory of 4256	1684	8df8c579fd804944150aa3e2d11c4752.exe	99
PID 1684 wrote to memory of 4256	1684	8df8c579fd804944150aa3e2d11c4752.exe	99
PID 1684 wrote to memory of 4256	1684	8df8c579fd804944150aa3e2d11c4752.exe	99
PID 4256 wrote to memory of 4064	4256	cmd.exe	101
PID 4256 wrote to memory of 4064	4256	cmd.exe	101
PID 4256 wrote to memory of 4064	4256	cmd.exe	101
PID 1684 wrote to memory of 2552	1684	8df8c579fd804944150aa3e2d11c4752.exe	102
PID 1684 wrote to memory of 2552	1684	8df8c579fd804944150aa3e2d11c4752.exe	102
PID 1684 wrote to memory of 2552	1684	8df8c579fd804944150aa3e2d11c4752.exe	102
PID 2552 wrote to memory of 2408	2552	cmd.exe	104
PID 2552 wrote to memory of 2408	2552	cmd.exe	104
PID 2552 wrote to memory of 2408	2552	cmd.exe	104

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request