Registry setting targeted a temporary executable that also ran as a child
In separate sandbox reports, the sample launched temporary executables whose paths also appeared in persistence-related registry settings; two reports show those executables launching further files. Two configured C2 addresses also appeared as TCP traffic destinations, but the records do not show a successful command exchange or a later logon launch.
A temporary executable launched by bofuv.exe was also the target of a persistence-related registry setting. In the same Zenbox report, that temporary executable dropped and launched another executable. Was the temporary directory merely a staging area, or did it hold the components the sample was arranging to keep running? The evidence supports the second interpretation, with a specific limit: it shows an execution pattern linked to a launch setting, not a demonstrated return after logon.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read