T1543.003 Windows Service in real malware

ATT&CK technique T1543.003 Windows Service appears in 2868 publicly analyzed samples on MalwareAnalyzer by Cyble, 2.8% of the analyzed corpus. Seven-day prevalence is rising (1414 recent vs 103 prior). Most associated families: Zusy, VJadtre, NabucurObfs, Wapomi, Somhoveran.

Tactics: persistence, privilege-escalation

Prevalence in the corpus

• Samples exhibiting T1543.003: 2868
• Share of analyzed corpus: 2.8%
• Last 7 days: 1414 · prior 7 days: 103 (rising)

Malware families using T1543.003

• Zusy - 707 samples
• VJadtre - 134 samples
• NabucurObfs - 121 samples
• Wapomi - 103 samples
• Somhoveran - 82 samples
• Salgorea - 73 samples

Example samples

• 0901b477cab1beb5cc72169fe69169b11773f6ab1f5ef28e9b9981b56d940338 - malicious
• 63195aad3d1661b3d621209ac37faf9ba7cc7b3a07b422df3005962f0bc45121 - malicious
• 7fd85c48cdf0ed5bdd07e33075a245175b9ad5ba41f4fe54c9b1d3670b74a99f - malicious
• b7ed730b6386f5160e5ea1f10c9dc35790567b98ba22aa6893eee6ce27bba3a0 - malicious
• 8b89fdf7c7909848e69002fd4212e9649a8db8aa2c974c365e56860a7a08aaf7 - malicious
• 9d96165cf2a52ed821566f7f501c3782d83f8b5969dea157a9d9c34470062823 - malicious
• b1553dba597d062aecbae96d079f9ad873861f46f35da41da425095dfedbd455 - malicious
• 90105cac5ca79c42d416157f23e9b07ef1ded0a8e864c347378c763ee40fd2cc - malicious
• cb8f33fbe8f0d022f3d9e30dbebc7b2d89b3ddca3962955321d76fba02ec31cb - malicious
• ecd37a0351ed993a4bd242700e0b26f5d002ef007ea4391545e3ae171ed638a0 - malicious
• 50da41aab1cf5a3e4af4d7a70531b405534632ba1efc3dc7d92c69dffb2e3d5b - malicious
• 1d743eba105b5336d26bcc5ab62bbb4f7f89904c1b763aa4719576e347dfc9d2 - malicious
• 4eaf8dbd0b9d67dcfc003192b8d975c891182e95681c7f2122a47cb0422fe982 - malicious
• cec4a9c798aa0ea5f1d3aa757fac51969f31cfb9f564e389a2061e4b509c9d1c - malicious
• f8a9e48e24c3a6ab4cbbfc398a10621aa4f9338009946ce512db76654c04a2b4 - malicious
• a614c86e6c11abfc4cd1992ee5bee2a6c0804f7f897ab55fbb1c94251525000b - malicious
• 83b3085fe4f5564efc2159b7276cba851f044851c1e0ef15be66feec7cd1b001 - malicious
• bdd7c6266cfe1c0640dbb380cb29f9dd9179318e2dd48ed51d4d377ff43c7bb0 - malicious
• 2c2390c856ae36b4ece33a03459f4ff7f18e51985c8e921fc916bda0ba304469 - malicious
• 3f27d02f78d50015562f97ca135c3566a4ba2688752d826fda1a4a4186a2b8e2 - malicious
• cdd298849c4406b391d5604c6d17cccef45d98354cfee956193c818c9ac3b63e - malicious
• 9f2bf2ce392d8f4096a11f72d45f2fb760b0ce3dd8982b54515cacd43235f29a - malicious
• f6c0f5fa9aff1e9b96727af92a43b7e122add296e98013d449f3facf84c0f6a9 - malicious
• 9fb175ba2665fd5e9156c56baf7537230abce85204efbce8001f09fd2c876d65 - malicious
• 194961bb17454a32303da16892cb476dd98bd2833c4b08aa904895a439579da5 - malicious

Canonical technique definition: MITRE ATT&CK T1543.003 (ATT&CK v19.1, CC BY 4.0).

Frequently asked about T1543.003

How common is ATT&CK T1543.003 (Windows Service) in real malware?

ATT&CK technique T1543.003 Windows Service appears in 2868 publicly analyzed samples on MalwareAnalyzer by Cyble, 2.8% of the analyzed corpus. Seven-day prevalence is rising (1414 recent vs 103 prior). Most associated families: Zusy, VJadtre, NabucurObfs, Wapomi, Somhoveran.

Is T1543.003 becoming more common?

Prevalence is rising: 1414 samples in the last seven days against 103 in the seven days before. This measures submissions to MalwareAnalyzer by Cyble, so it reflects what is being submitted here rather than global attacker behaviour.

Which malware families use T1543.003?

In this corpus T1543.003 is most associated with Zusy (707), VJadtre (134), NabucurObfs (121), Wapomi (103), Somhoveran (82), Salgorea (73). Counts are analyzed samples per family in which the technique was observed.

What share of analyzed samples use T1543.003?

2.8% of the publicly analyzed corpus (2868 of 100959 samples) exhibits T1543.003. Technique attribution comes from behavior captured during real sandbox detonation and from static analysis, not from a vendor label.

All ATT&CK techniques in the corpus · Latest analyzed threats