Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Abusing the Service Control Manager to Establish Persistence for Non-Service Applications

Summary: Unit 42 analysed an Emotet sample that abuses the Windows Service Control Manager to create and start a Windows service even though the executable never calls StartServiceCtrlDispatcher(), which Microsoft requires of service applications. The SCM runs the executable briefly, StartService() returns ERROR_SERVICE_REQUEST_TIMEOUT, and before the SCM terminates the parent the malware spawns a detached child process that survives parentless; the technique requires UAC disabled or an administrator account and was tested on Windows 7, 8.1 and 10.

What's compelling: Because the SCM restarts the executable on every reboot, this gives Emotet a persistence mechanism that leaves the executable running without it ever behaving as a valid service - and it only needs UAC disabled or an admin-level user to work.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related