Service path links a placed executable to auto-start execution
Across three sandbox analyses of the same file, commands place executables in Windows system directories and register them as auto-start services. One analysis also records a matching service registry path and execution beneath the service manager, strengthening the installation finding without proving persistence across a reboot.
An executable named gbifebxy.exe appears beneath services.exe in a sandbox process tree. In the same report, a Windows service’s ImagePath points to that filename inside a newly named system-directory folder. The service-creation command gives it the display name “wifi support.” Is this simply a file being run, or an installation mechanism intended to keep it running? The records support the second interpretation.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read