value: One variant of BlackEnergy locates existing driver services that have been disabled and drops its driver component into one of those service's paths replacing the legitimate executable. The malware then sets the hijacked service to start automatically to establish persistence.
name: Hijack Execution Flow: Services File Permissions Weakness