Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows 10 Update' = '<SYSTEM32>\<File name>.exe'
- %TEMP%\v17e4ixck0.exe
- %TEMP%\bfsvc.exe
- %TEMP%\ech7b4536i.exe
- <SYSTEM32>\tmp_4728
- %TEMP%\bfsvc.exe
- <SYSTEM32>\tmp_4728
- %TEMP%\bfsvc.exe
- %TEMP%\bfsvc.exe
- from <Full path to file> to <SYSTEM32>\<File name>.exe
- http://pu#.sh/jMSLc.txt
- http://ic###azip.com/
- DNS ASK pu#.sh
- DNS ASK ic###azip.com
- DNS ASK sm#####il.outlook.com
- '%TEMP%\v17e4ixck0.exe'
- '%TEMP%\bfsvc.exe' "true" "true" "true" "true"
- '%TEMP%\ech7b4536i.exe'
- '<SYSTEM32>\cmd.exe' cmd /c bfsvc.exe "true" "true" "true" "true"' (with hidden window)
- '<SYSTEM32>\cmd.exe' cmd /c bfsvc.exe "true" "true" "true" "true"