Procedure examples

DCSrv has created new services for persistence by modifying the Registry.

ShimRat has installed a Windows service to maintain persistence on victim machines.

Conficker copies itself into the %systemroot%\system32 directory and registers as a service.

KeyBoy installs a service pointing to a malicious DLL dropped to disk.

Anchor can establish persistence by creating a service.

SplatDropper has created a service to execute a payload.

Dyre registers itself as a service by adding several Registry keys.

BBSRAT can modify service configurations.

PlugX can be added as a service to establish persistence. PlugX also has a module to change service configurations as well as start, control, and delete services.

Reaver installs itself as a new service.

Bisonal has been modified to be used as a Windows service.

Cuba can modify services by using the OpenService and ChangeServiceConfig functions.

Clambling can register itself as a system service to gain persistence.

LockBit 3.0 can install system services for persistence.

Hydraq creates new services to establish persistence.

Elise configures itself as a service.

WannaCry creates the service "mssecsvc2.0" with the display name "Microsoft Security Center (2.0) Service."

Briba installs a service pointing to a malicious DLL dropped to disk.

TYPEFRAME variants can add malicious DLL modules as new services.TYPEFRAME can also delete services from the victim’s machine.

Uroburos has registered a service, typically named `WerFaultSvc`, to decrypt and find a kernel driver and kernel driver loader to maintain persistence.

Embargo has created persistence through the DLL variant of the MDeployer toolkit by creating a service called irnagentd that launches after the system is rebooted in Safe Mode.

PipeMon can establish persistence by registering a malicious DLL as an alternative Print Processor which is loaded when the print spooler service starts.

KONNI has registered itself as a service using its export function.

gh0st RAT can create a new service to establish persistence.

Shamoon creates a new service named “ntssrv” to execute the payload. Newer versions create the "MaintenaceSrv" and "hdv_725x" services.

JHUHUGIT has registered itself as a service to establish persistence.

Black Basta can create a new service to establish persistence.

Catchamas adds a new service named NetAdapter to establish persistence.

Attor's dispatcher can establish persistence by registering a new service.

StreamEx establishes persistence by installing a new service pointing to its DLL and setting the service to auto-start.

NightClub has created a Windows service named `WmdmPmSp` to establish persistence.

Some Sakula samples install themselves as services for persistence by calling WinExec with the net start argument.

RawPOS installs itself as a service to maintain persistence.

hcdLoader installs itself as a service for persistence.

Nidiran can create a new service named msamger (Microsoft Security Accounts Manager).

MoonWind installs itself as a new service with automatic startup to establish persistence. The service checks every 60 seconds to determine if the malware is running; if not, it will spawn a new instance.

CorKLOG has created a service to establish persistence.

HermeticWiper can load drivers by creating a new service using the `CreateServiceW` API.

Pandora has the ability to gain system privileges through Windows services.

FinFisher creates a new Windows service with the malicious executable for persistence.

Cobalt Strike can install a new service.

Wingbird uses services.exe to register a new autostart service named "Audit Service" using a copy of the local lsass.exe file.

Samurai can create a service at `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost` to trigger execution and maintain persistence.

PoisonIvy creates a Registry subkey that registers a new service. PoisonIvy also creates a Registry entry modifying the Logical Disk Manager service to point to a malicious DLL dropped to disk.

Seasalt is capable of installing itself as a service.

Carbon establishes persistence by creating a service and naming it based off the operating system version running on the current machine.

GoldenSpy has established persistence by running in the background as an autostart service.

FunnyDream has established persistence by running `sc.exe` and by setting the `WSearch` service to run automatically.

SysUpdate can create a service to establish persistence.

TinyZBot can install as a Windows service for persistence.