PUA.BAT.ServicePermit.A

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It does not have any backdoor routine.

It does not have any information-stealing capability.

Arrival Details

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Potentially Unwanted Application adds the following processes:

• sc sdset scanplus D:(A;;CCLCSWRPLOCRRC;;;SY)(A;;CCLCSWRPLOCRRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;RPLO;;;S-1-5-32-544)(D;;DCSD;;;S-1-5-32-5444)S:(AU;FA;CCLCSWRPLOCRRCWDWO;;;WD)
• sc sdset scanpluspm D:(A;;CCLCSWRPLOCRRC;;;SY)(A;;CCLCSWRPLOCRRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;RPLO;;;S-1-5-32-544)(D;;DCSD;;;S-1-5-32-5444)S:(AU;FA;CCLCSWRPLOCRRCWDWO;;;WD)
• sc sdset secureitrservice D:(A;;CCLCSWRPLOCRRC;;;SY)(A;;CCLCSWRPLOCRRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;RPLO;;;S-1-5-32-544)(D;;DCSD;;;S-1-5-32-5444)S:(AU;FA;CCLCSWRPLOCRRCWDWO;;;WD)
• sc sdset tba D:(A;;CCLCSWRPLOCRRC;;;SY)(A;;CCLCSWRPLOCRRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;RPLO;;;S-1-5-32-544)(D;;DCSD;;;S-1-5-32-5444)S:(AU;FA;CCLCSWRPLOCRRCWDWO;;;WD)
• cmd /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoControlPanel" /t REG_DWOrD /d 1 /f
• cmd /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWOrD /d 1 /f
• cmd /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWOrD /d 1 /f
• cmd /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWOrD /d 2 /f
• cmd /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System" /v "DisableRegistryTools" /t REG_DWOrD /d 1 /f

Other System Modifications

This Potentially Unwanted Application adds the following registry entries:

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NoControlPanel = 1

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableTaskMgr = 1

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NoRun = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\System
DisableCMD = 2

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\System
DisableRegistryTools = 1

Propagation

This Potentially Unwanted Application does not have any propagation routine.

Backdoor Routine

This Potentially Unwanted Application does not have any backdoor routine.

Rootkit Capabilities

This Potentially Unwanted Application does not have rootkit capabilities.

Information Theft

This Potentially Unwanted Application does not have any information-stealing capability.

Other Details

This Potentially Unwanted Application does the following:

• It sets the security descriptor for the services scanplus, scanpluspm, secureitrservice, and tba to include specific permissions for the following user groups:
  • DACL Settings:
    • Local System → Granted full control with specific permissions.
    • Built-in Administrators → Granted full control with additional write permissions.
    • Interactive Users → Granted specific permissions but with some limitations compared to System.
    • Service Users → Similar permissions to Interactive Users.
    • Administrators Group → Allowed read property and list object permissions.
    • Specific SID (S-1-5-32-5444) → Denied delete child and delete permissions
  • SACL Settings:
    • Audits all access with full permissions for Everyone.
• It disables access to the Control Panel, Task Manager, Command Prompt, and Registry Editor.
• It disables the "Run" command.

It does not exploit any vulnerability.