Procedure examples

BADNEWS is sometimes signed with an invalid Authenticode certificate in an apparent effort to make it look more legitimate.

Gelsemium has used unverified signatures on malicious DLLs.

SplatCloak has used a revoked certificate to exploit Windows driver execution policy where certificates issued before a specific date could still load.

PcShare has used an invalid certificate in attempt to appear legitimate.

DarkGate executes a Windows Batch script during installation that creases a randomly-named directory in the C:\\ root directory that copies and renames the legitimate Windows <curl>curl</code> command to this new location.

StrelaStealer has used a renamed, legitimate `msinfo32.exe` executable to sideload the StrelaStealer payload during initial installation.

PHASEJAM has renamed the file `/home/bin/remotedebug` to `remotedebug.bak`, allowing the threats actors to write a malicious `/home/bin/remotedebug` shell script.

The CozyCar dropper has masqueraded a copy of the infected system's rundll32.exe executable that was moved to the malware's install directory and renamed according to a predefined configuration file.

Kevin has renamed an image of `cmd.exe` with a random name followed by a `.tmpl` extension.

The Exaramel for Windows dropper creates and starts a Windows service named wsmprovav with the description “Windows Check AV” in an apparent attempt to masquerade as a legitimate service.

StrongPity has named services to appear legitimate.

Nebulae has created a service named "Windows Update Agent1" to appear legitimate.

TONESHELL has masqueraded as the legitimate Windows utility service DISMsrv (Dism Images Servicing Utility Service).

RainyDay has named services and scheduled tasks to appear benign including "ChromeCheck" and "googleupdate."

TinyTurla has mimicked an existing Windows service by being installed as Windows Time Service.

BOOKWORM has created services that attempt to resemble legitimate services to include a service named `Microsoft Windows DeviceSync Service`.

Emotet has installed itself as a new service with the service name `Windows Defender System Service` and display name `WinDefService`.

Turian can disguise as a legitimate service to blend into normal operations.

Machete renamed task names to masquerade as legitimate Google Chrome, Java, Dropbox, Adobe Reader and Python tasks.

PingPull can mimic the names and descriptions of legitimate services such as `iphlpsvc`, `IP Helper`, and `Onedrive` to evade detection.

Hildegard has disguised itself as a known Linux process.

InvisiMole has attempted to disguise itself by registering under a seemingly legitimate service name.

Some Volgmer variants add new services with display names generated by a list of hard-coded strings such as Application, Background, Security, and Windows, presumably as a way to masquerade as a legitimate service.

RDAT has used Windows Video Service as a name for malicious services.

Okrum can establish persistence by adding a new service NtmsSvc with the display name Removable Storage to masquerade as a legitimate Removable Storage Manager.

Raspberry Robin will execute its payload prior to initializing command and control traffic by impersonating one of several legitimate program names such as dllhost.exe, regsvr32.exe, or rundll32.exe.

Fysbis has masqueraded as the rsyncd and dbus-inotifier services.

DCSrv has masqueraded its service as a legitimate svchost.exe process.

ShimRat can impersonate Windows services and antivirus products to avoid detection on compromised systems.

Green Lambert has created a new executable named `Software Update Check` to appear legitimate.

GoldMax has impersonated systems management software to avoid detection.

In one instance, menuPass added PlugX as a service with a display name of "Corel Writing Tools Utility."

To establish persistence, Truvasys adds a Registry Run key with a value "TaskMgr" in an attempt to masquerade as the legitimate Windows Task Manager.

SVCReady has named a task `RecoveryExTask` as part of its persistence activity.

Uroburos has registered a service named `WerFaultSvc`, likely to spoof the legitimate Windows error reporting service.

Spica has created a scheduled task named `CalendarChecker` for persistence on compromised hosts.

KONNI has pretended to be the xmlProv Network Provisioning service.

Shamoon creates a new service named “ntssrv” that attempts to appear legitimate; the service's display name is “Microsoft Network Realtime Inspection Service” and its description is “Helps guard against time change attempts targeting known and newly discovered vulnerabilities in network time protocols.” Newer versions create the "MaintenaceSrv" service, which misspells the word "maintenance."

Black Basta has established persistence by creating a new service named `FAX` after deleting the legitimate service by the same name.

Catchamas adds a new service named NetAdapter in an apparent attempt to masquerade as a legitimate service.

Attor's dispatcher disguises itself as a legitimate task (i.e., the task name and description appear legitimate).

NightClub has created a service named `WmdmPmSp` to spoof a Windows Media service.

Crutch has established persistence with a scheduled task impersonating the Outlook item finder.

RTM has named the scheduled task it creates "Windows Update".

New services created by RawPOS are made to appear like legitimate Windows services, with names such as "Windows Management Help Service", "Microsoft Support", and "Windows Advanced Task Manager".

ZxxZ has been disguised as a Windows security update service.

Tarrask creates a scheduled task called “WinUpdate” to re-establish any dropped C2 connections.

Bazar can create a task named to appear benign.

SUGARDUMP's scheduled task has been named `MicrosoftInternetExplorerCrashRepoeterTaskMachineUA` or `MicrosoftEdgeCrashRepoeterTaskMachineUA`, depending on the Windows OS version.

Nidiran can create a new service named msamger (Microsoft Security Accounts Manager), which mimics the legitimate Microsoft database by the same name.