serviceman

a simple spike bloatware for your computer - proof of concept.

telemetry.bat is the original code; can be wrapped into setup.msi for secret execution. currently startup.bat is harmless; but theoretically can be used to launch external code (e.g by updating telemetry code).

Execution flow

1. Writes "spike.ps1" to user's startup directory.
2. calls "spike.ps1" to download "startup.bat" from internet.
3. Deletes "spike.ps1".
4. Startup.bat executes on every user boot.

Poisioning

1. Currently, startup.bat is harmless and displays load animation only to poison this code, modify telemetry.bat to point to different location with malicious code.
2. Wrap telemetry.bat to setup.exe or setup.msi and distribute to end user.

Why this is dangerous

1. Utilises simple windows API call to create a batch file.
2. The newly downloaded batch file is equivalent to user-created code, therefore computer allows execution easily.

To remove

1. Delete startup.bat from startup folder at "%LocalAppData%/../Roaming/Microsoft/Windows/Start Menu/Programs/Startup"
2. Delete .rat file from "%temp%". This is sample library folder to store future executables; called directly from script using "./%temp%/.rat/application.exe"

To prevent

1. Set execution-policy to restricted