PUA.BAT.ServicePermit.A

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Diese Malware hat keine Verbreitungsroutine.

Diese Malware hat keine Backdoor-Routine.

Diese Malware kann keine Daten stehlen.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Fügt die folgenden Prozesse hinzu:

• sc sdset scanplus D:(A;;CCLCSWRPLOCRRC;;;SY)(A;;CCLCSWRPLOCRRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;RPLO;;;S-1-5-32-544)(D;;DCSD;;;S-1-5-32-5444)S:(AU;FA;CCLCSWRPLOCRRCWDWO;;;WD)
• sc sdset scanpluspm D:(A;;CCLCSWRPLOCRRC;;;SY)(A;;CCLCSWRPLOCRRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;RPLO;;;S-1-5-32-544)(D;;DCSD;;;S-1-5-32-5444)S:(AU;FA;CCLCSWRPLOCRRCWDWO;;;WD)
• sc sdset secureitrservice D:(A;;CCLCSWRPLOCRRC;;;SY)(A;;CCLCSWRPLOCRRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;RPLO;;;S-1-5-32-544)(D;;DCSD;;;S-1-5-32-5444)S:(AU;FA;CCLCSWRPLOCRRCWDWO;;;WD)
• sc sdset tba D:(A;;CCLCSWRPLOCRRC;;;SY)(A;;CCLCSWRPLOCRRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;RPLO;;;S-1-5-32-544)(D;;DCSD;;;S-1-5-32-5444)S:(AU;FA;CCLCSWRPLOCRRCWDWO;;;WD)
• cmd /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoControlPanel" /t REG_DWOrD /d 1 /f
• cmd /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWOrD /d 1 /f
• cmd /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWOrD /d 1 /f
• cmd /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWOrD /d 2 /f
• cmd /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System" /v "DisableRegistryTools" /t REG_DWOrD /d 1 /f

Andere Systemänderungen

Fügt die folgenden Registrierungseinträge hinzu:

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NoControlPanel = 1

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableTaskMgr = 1

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NoRun = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\System
DisableCMD = 2

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\System
DisableRegistryTools = 1

Verbreitung

Diese Malware hat keine Verbreitungsroutine.

Backdoor-Routine

Diese Malware hat keine Backdoor-Routine.

Datendiebstahl

Diese Malware kann keine Daten stehlen.

Andere Details

Es macht Folgendes:

• It sets the security descriptor for the services scanplus, scanpluspm, secureitrservice, and tba to include specific permissions for the following user groups:
  • DACL Settings:
    • Local System → Granted full control with specific permissions.
    • Built-in Administrators → Granted full control with additional write permissions.
    • Interactive Users → Granted specific permissions but with some limitations compared to System.
    • Service Users → Similar permissions to Interactive Users.
    • Administrators Group → Allowed read property and list object permissions.
    • Specific SID (S-1-5-32-5444) → Denied delete child and delete permissions
  • SACL Settings:
    • Audits all access with full permissions for Everyone.
• It disables access to the Control Panel, Task Manager, Command Prompt, and Registry Editor.
• It disables the "Run" command.