Procedure examples

LockBit 3.0 can install system services for persistence.

Hydraq creates new services to establish persistence.

Elise configures itself as a service.

WannaCry creates the service "mssecsvc2.0" with the display name "Microsoft Security Center (2.0) Service."

Briba installs a service pointing to a malicious DLL dropped to disk.

TYPEFRAME variants can add malicious DLL modules as new services.TYPEFRAME can also delete services from the victim’s machine.

Uroburos has registered a service, typically named `WerFaultSvc`, to decrypt and find a kernel driver and kernel driver loader to maintain persistence.

Embargo has created persistence through the DLL variant of the MDeployer toolkit by creating a service called irnagentd that launches after the system is rebooted in Safe Mode.

PipeMon can establish persistence by registering a malicious DLL as an alternative Print Processor which is loaded when the print spooler service starts.

KONNI has registered itself as a service using its export function.

gh0st RAT can create a new service to establish persistence.

Shamoon creates a new service named “ntssrv” to execute the payload. Newer versions create the "MaintenaceSrv" and "hdv_725x" services.

JHUHUGIT has registered itself as a service to establish persistence.

Black Basta can create a new service to establish persistence.

Catchamas adds a new service named NetAdapter to establish persistence.

Attor's dispatcher can establish persistence by registering a new service.

StreamEx establishes persistence by installing a new service pointing to its DLL and setting the service to auto-start.

NightClub has created a Windows service named `WmdmPmSp` to establish persistence.

Some Sakula samples install themselves as services for persistence by calling WinExec with the net start argument.

RawPOS installs itself as a service to maintain persistence.

hcdLoader installs itself as a service for persistence.

Nidiran can create a new service named msamger (Microsoft Security Accounts Manager).

MoonWind installs itself as a new service with automatic startup to establish persistence. The service checks every 60 seconds to determine if the malware is running; if not, it will spawn a new instance.

CorKLOG has created a service to establish persistence.

HermeticWiper can load drivers by creating a new service using the `CreateServiceW` API.

Pandora has the ability to gain system privileges through Windows services.

FinFisher creates a new Windows service with the malicious executable for persistence.

Cobalt Strike can install a new service.

Wingbird uses services.exe to register a new autostart service named "Audit Service" using a copy of the local lsass.exe file.

Samurai can create a service at `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost` to trigger execution and maintain persistence.

PoisonIvy creates a Registry subkey that registers a new service. PoisonIvy also creates a Registry entry modifying the Logical Disk Manager service to point to a malicious DLL dropped to disk.

Seasalt is capable of installing itself as a service.

Carbon establishes persistence by creating a service and naming it based off the operating system version running on the current machine.

GoldenSpy has established persistence by running in the background as an autostart service.

FunnyDream has established persistence by running `sc.exe` and by setting the `WSearch` service to run automatically.

SysUpdate can create a service to establish persistence.

TinyZBot can install as a Windows service for persistence.

Kwampirs creates a new service named WmiApSrvEx to establish persistence.

Nerex creates a Registry subkey that registers a new service.

Some InnaputRAT variants create a new Windows service to establish persistence.

ZxShell can create a new service using the service parser function ProcessScCommand.

Winnti for Windows sets its DLL file as a new service in the Registry to establish persistence.

AppleJeus can install itself as a service.

STARWHALE has the ability to create the following Windows service to establish persistence on an infected host: `sc create Windowscarpstss binpath= "cmd.exe /c cscript.exe c:\\windows\\system32\\w7_1.wsf humpback_whale" start= "auto" obj= "LocalSystem"`.

Industroyer can use an arbitrary system service to load at system boot for persistence and replaces the ImagePath registry value of a Windows service with a new backdoor binary.

One persistence mechanism used by CozyCar is to register itself as a Windows service.

QakBot can remotely create a temporary service on a target host.

Gelsemium can drop itself in `C:\Windows\System32\spool\prtprocs\x64\winprint.dll` as an alternative Print Processor to be loaded automatically when the spoolsv Windows service starts.

Dtrack can add a service called WBService to establish persistence.

LoudMiner can automatically launch a Linux virtual machine as a service at startup if the AutoStart option is enabled in the VBoxVmService configuration file.