Why can I move the executable of a service but not delete it?

Question

I am learning about privilege escalation and dangerous service configurations on Windows.

Here is the thing:

• A service has a world writeable executable myservice.exe (baaaad idea).
• The service is running with system privileges
• When you try to copy/replace myservice.exe while it is running, that will not work. (Permission Denied)
• However when you first move the executable and then copy a second (evil) myservice.exe into the folder, windows will not complain
• Next time the service is restarted, the evil service.exe is executed

My question: What process keeps a handle on the myservice.exe to prevent me from deleting it? How can that same process allow me to move the file and continue functioning?

I tried to answer those question myself using procmon.exe from the Sysinternals Suite, but so far I found nothing.

Answer 1

I don't have the exact answer but i did notice that if you move a running service, you can't overwrite the moved file.

Example:

Overwrite the process used by the "Serviio" service:

    cd "C:\Program Files\Serviio\bin\"
    move "ServiioService.exe" "ServiioService_original.exe"

Try to overwrite the new file name:

copy "K:\18.2.4.1_win_add_user.exe" "C:\Program Files\Serviio\bin\ServiioService_original.
exe"
copy : The process cannot access the file 'C:\Program Files\Serviio\bin\ServiioService_original.exe' because it is
being used by another process.
At line:1 char:1
+ copy "K:\18.2.4.1_win_add_user.exe" "C:\Program Files\Serviio\bin\Ser ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Copy-Item], IOException
    + FullyQualifiedErrorId : System.IO.IOException,Microsoft.PowerShell.Commands.CopyItemCommand