WmiPrvSE.exe

  • File Path: C:\windows\SysWOW64\wbem\WmiPrvSE.exe
  • Description: WMI Provider Host

Hashes

Type Hash
MD5 1DD684E647BF9DD3E486276F5FA07A11
SHA1 0B2E62993B89201F71BE7AFC32E0ABFA97AEE2A7
SHA256 D17557A926C07E11FD21CC737C36E5A0E8742F3F7DEB6B0C95C397605A38ED86
SHA384 BF8AA1DA99810CA1AF0EF2F946FAA5D3CC3093CA9952E114FD93238F378360E80DA51D9174C94C9DEA35757FE008E9B8
SHA512 E43089B3A3CDE7E6CA61BD9BE43031C47F4A5B617CBB94DD96E011D0495F01ED460B2DD77DE1907DC1BB8DBACBCE5885B2F91FBAC10DC26BDE7B520D7FBFA64A
SSDEEP 6144:Ca4NW484t7Iz6DPV6QHzcrR/oOEcHU8unDV1w+ERrjrQPQDePBw:Ca4NW4LIz6DPJgBNn08GDV1lERr4M8B

Signature

  • Status: The file C:\windows\SysWOW64\wbem\WmiPrvSE.exe is not digitally signed. You cannot run this script on the current system. For more information about running scripts and setting execution policy, see about_Execution_Policies at http://go.microsoft.com/fwlink/?LinkID=135170
  • Serial: ``
  • Thumbprint: ``
  • Issuer:
  • Subject:

File Metadata

  • Original Filename: Wmiprvse.exe
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 6.3.9600.18946 (winblue_ltsb_escrow.180302-1800)
  • Product Version: 6.3.9600.18946
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.

Possible Misuse

The following table contains possible examples of WmiPrvSE.exe being misused. While WmiPrvSE.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma win_susp_lsass_dump_generic.yml - '\wmiprvse.exe' DRL 1.0
sigma win_susp_wmi_login.yml ProcessName: "*\\WmiPrvSE.exe" DRL 1.0
sigma sysmon_wmi_module_load.yml description: Detects non wmiprvse loading WMI modules DRL 1.0
sigma sysmon_wmi_module_load.yml - '\WmiPrvSe.exe' DRL 1.0
sigma sysmon_wmi_persistence_commandline_event_consumer.yml Image: 'C:\Windows\System32\wbem\WmiPrvSE.exe' DRL 1.0
sigma win_defender_psexec_wmi_asr.yml - '\wmiprvse.exe' DRL 1.0
sigma sysmon_cred_dump_lsass_access.yml - '\wmiprvse.exe' DRL 1.0
sigma win_apt_ta505_dropper.yml description: Detects mshta loaded by wmiprvse as parent as used by TA505 malicious documents DRL 1.0
sigma win_apt_ta505_dropper.yml ParentImage\|endswith: '\wmiprvse.exe' DRL 1.0
sigma win_impacket_lateralization.yml # parent is wmiprvse.exe DRL 1.0
sigma win_impacket_lateralization.yml - '*\wmiprvse.exe' # wmiexec DRL 1.0
sigma win_shell_spawn_susp_program.yml - '*\wmiprvse.exe' DRL 1.0
sigma win_susp_powershell_parent_process.yml - '\wmiprvse.exe' DRL 1.0
sigma win_wmiprvse_spawning_process.yml title: Wmiprvse Spawning Process DRL 1.0
sigma win_wmiprvse_spawning_process.yml description: Detects wmiprvse spawning processes DRL 1.0
sigma win_wmiprvse_spawning_process.yml ParentImage\|endswith: '\WmiPrvSe.exe' DRL 1.0
sigma win_wmiprvse_spawning_process.yml - '\WmiPrvSE.exe' DRL 1.0
sigma win_wmi_spwns_powershell.yml - '*\wmiprvse.exe' DRL 1.0
sigma sysmon_raw_disk_access_using_illegitimate_tools.yml - '\wmiprvse.exe' DRL 1.0
malware-ioc nukesped_lazarus .WmiPrvse.exe``{:.highlight .language-cmhg} © ESET 2014-2018
malware-ioc nukesped_lazarus .Wmiprvse.exe``{:.highlight .language-cmhg} © ESET 2014-2018
atomic-red-team hta.md ## MSHTA - Wmiprvse Spawning CMD MIT License. © 2018 Red Canary
atomic-red-team hta.md Using COM objects, mshta runs with no child processes. Wmiprvse spawns and executes cmd -> calc. MIT License. © 2018 Red Canary
atomic-red-team hta.md // Child of wmiprvse MIT License. © 2018 Red Canary
atomic-red-team Office_Macro_COM.md Wmiprvse.exe->cmd->powershell. MIT License. © 2018 Red Canary
atomic-red-team T1546.003.md WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges.</blockquote> MIT License. © 2018 Red Canary
signature-base crime_cn_campaign_njrat.yar $s4 = “WmiPrvSE.exe” fullword wide CC BY-NC 4.0
signature-base crime_cn_campaign_njrat.yar $a1 = “WmiPrvSE.exe” fullword wide CC BY-NC 4.0
signature-base crime_cn_campaign_njrat.yar $s2 = “Temporary Projects\WmiPrvSE\” ascii CC BY-NC 4.0
signature-base gen_cn_hacktools.yar $s8 = “wmiprvse.exe” fullword ascii CC BY-NC 4.0
signature-base gen_cn_hacktools.yar $s10 = “wmiprvse.exe” fullword ascii CC BY-NC 4.0
signature-base gen_cn_hacktools.yar $s8 = “wmiprvse.exe” ascii CC BY-NC 4.0
signature-base gen_cn_hacktools.yar $s5 = “wmiprvse.exe” fullword ascii CC BY-NC 4.0
signature-base gen_cn_hacktools.yar $s3 = “wmiprvse.exe” fullword ascii CC BY-NC 4.0
signature-base gen_cn_hacktools.yar $s6 = “wmiprvse.exe” fullword ascii CC BY-NC 4.0

MIT License. Copyright (c) 2020-2021 Strontic.