WmiPrvSE.exe

  • File Path: C:\WINDOWS\system32\wbem\WmiPrvSE.exe
  • Description: WMI Provider Host

Hashes

Type Hash
MD5 3296C30628C8088CBB26871DB04E9C13
SHA1 493722B4ED7A3468C8AEEBA0CF4ED3C690CB97C8
SHA256 97D33B99AAB79C32FE5A9CD134824AC1B2EFFB89956D0817590876DEED282288
SHA384 2661C31ACBEC8FE716FCFD3DE27707BE22BC32920CB2FD01EEF229D5FAD0FF48A8F2A6E3D16576E44D2CEE3641B5DA07
SHA512 4E4730A00EE1AD6B9CBC6B297B756352B65B5F77C6B3BE14826E4903907EB2511FA74F43E0B4EA14F30B63F01EB045B9B7CF15E292B3C3E781049FA9D3BDC67C
SSDEEP 12288:f2zhs2yMqNR9yPOF5WtSDI+Zn0Nr/Zasv6p08/qb98cS80xtm0I+Z8Pc7ZxRqhqp:f2zhsDMqzGOF5WQDIqn0Nr/ZaSR8/qbQ
IMP EEF7A7FBBC54E78B2A1B262353515AE0
PESHA1 300BB6AA1EEC0F22DFD87A6FBE7932F28DB2401D
PE256 FF73BE99B032B4CD15423D05A9FBD38E3778DABB5ED9D2C8EA13BE92784884B5

Runtime Data

Open Handles:

Path Type
(R-D) C:\Windows\System32\en-US\user32.dll.mui File
(RW-) C:\Windows\System32 File
\BaseNamedObjects__ComCatalogCache__ Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro Section
\Sessions\2\BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 Section
\Sessions\2\BaseNamedObjects\NLS_CodePage_437_3_2_0_0 Section
\Sessions\2\Windows\Theme1077709572 Section
\Windows\Theme3461253685 Section

Loaded Modules:

Path
C:\WINDOWS\System32\combase.dll
C:\WINDOWS\System32\KERNEL32.DLL
C:\WINDOWS\System32\KERNELBASE.dll
C:\WINDOWS\System32\msvcrt.dll
C:\WINDOWS\SYSTEM32\NCObjAPI.DLL
C:\WINDOWS\SYSTEM32\ntdll.dll
C:\WINDOWS\System32\RPCRT4.dll
C:\WINDOWS\System32\ucrtbase.dll
C:\WINDOWS\system32\wbem\FastProx.dll
C:\WINDOWS\system32\wbem\WmiPrvSE.exe
C:\WINDOWS\SYSTEM32\wbemcomn.dll

Signature

  • Status: Signature verified.
  • Serial: 33000002ED2C45E4C145CF48440000000002ED
  • Thumbprint: 312860D2047EB81F8F58C29FF19ECDB4C634CF6A
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: Wmiprvse.exe
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.22000.1 (WinBuild.160101.0800)
  • Product Version: 10.0.22000.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/73
  • VirusTotal Link: https://www.virustotal.com/gui/file/97d33b99aab79c32fe5a9cd134824ac1b2effb89956d0817590876deed282288/detection

Possible Misuse

The following table contains possible examples of WmiPrvSE.exe being misused. While WmiPrvSE.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma win_susp_lsass_dump_generic.yml - '\wmiprvse.exe' DRL 1.0
sigma win_susp_wmi_login.yml ProcessName\|endswith: '\WmiPrvSE.exe' DRL 1.0
sigma win_wmiprvse_wbemcomn_dll_hijack.yml title: T1047 Wmiprvse Wbemcomn DLL Hijack DRL 1.0
sigma win_alert_lsass_access.yml - 'C:\Windows\System32\wbem\WmiPrvSE.exe' DRL 1.0
sigma win_defender_psexec_wmi_asr.yml - '\wmiprvse.exe' DRL 1.0
sigma file_event_win_susp_adsi_cache_usage.yml - 'C:\Windows\System32\wbem\WmiPrvSE.exe' DRL 1.0
sigma file_event_win_wmiprvse_wbemcomn_dll_hijack.yml title: Wmiprvse Wbemcomn DLL Hijack DRL 1.0
sigma image_load_wmiprvse_wbemcomn_dll_hijack.yml title: Wmiprvse Wbemcomn DLL Hijack DRL 1.0
sigma image_load_wmiprvse_wbemcomn_dll_hijack.yml Image\|endswith: '\wmiprvse.exe' DRL 1.0
sigma image_load_wmi_module_load.yml description: Detects non wmiprvse loading WMI modules DRL 1.0
sigma image_load_wmi_module_load.yml - '\WmiPrvSE.exe' DRL 1.0
sigma image_load_wmi_persistence_commandline_event_consumer.yml Image: 'C:\Windows\System32\wbem\WmiPrvSE.exe' DRL 1.0
sigma pipe_created_alternate_powershell_hosts_pipe.yml - '\Windows\system32\wbem\wmiprvse.exe' DRL 1.0
sigma proc_access_win_cred_dump_lsass_access.yml - 'C:\WINDOWS\system32\wbem\wmiprvse.exe' DRL 1.0
sigma proc_access_win_cred_dump_lsass_access.yml # - '\wmiprvse.exe' DRL 1.0
sigma proc_access_win_susp_proc_access_lsass.yml SourceImage: 'C:\WINDOWS\system32\wbem\wmiprvse.exe' DRL 1.0
sigma proc_access_win_susp_proc_access_lsass.yml SourceImage: 'C:\Windows\sysWOW64\wbem\wmiprvse.exe' DRL 1.0
sigma proc_creation_win_apt_lazarus_activity_apr21.yml - 'C:\Windows\System32\wbem\wmiprvse.exe' DRL 1.0
sigma proc_creation_win_apt_ta505_dropper.yml description: Detects mshta loaded by wmiprvse as parent as used by TA505 malicious documents DRL 1.0
sigma proc_creation_win_apt_ta505_dropper.yml ParentImage\|endswith: '\wmiprvse.exe' DRL 1.0
sigma proc_creation_win_impacket_lateralization.yml # parent is wmiprvse.exe DRL 1.0
sigma proc_creation_win_impacket_lateralization.yml - '\wmiprvse.exe' # wmiexec DRL 1.0
sigma proc_creation_win_lolbins_with_wmiprvse_parent_process.yml title: Lolbins Process Creation with WmiPrvse DRL 1.0
sigma proc_creation_win_lolbins_with_wmiprvse_parent_process.yml description: This rule will monitor LOLBin process creations by wmiprvse. Add more LOLBins to rule logic if needed. DRL 1.0
sigma proc_creation_win_lolbins_with_wmiprvse_parent_process.yml ParentImage\|endswith: \wbem\WmiPrvSE.exe DRL 1.0
sigma proc_creation_win_shell_spawn_susp_program.yml - '\wmiprvse.exe' DRL 1.0
sigma proc_creation_win_susp_powershell_parent_process.yml - '\wmiprvse.exe' DRL 1.0
sigma proc_creation_win_wmiprvse_spawning_process.yml title: Wmiprvse Spawning Process DRL 1.0
sigma proc_creation_win_wmiprvse_spawning_process.yml description: Detects wmiprvse spawning processes DRL 1.0
sigma proc_creation_win_wmiprvse_spawning_process.yml ParentImage\|endswith: '\WmiPrvSe.exe' DRL 1.0
sigma proc_creation_win_wmiprvse_spawning_process.yml - '\WmiPrvSE.exe' DRL 1.0
sigma proc_creation_win_wmi_spwns_powershell.yml - '\wmiprvse.exe' DRL 1.0
malware-ioc nukesped_lazarus .WmiPrvse.exe``{:.highlight .language-cmhg} © ESET 2014-2018
malware-ioc nukesped_lazarus .Wmiprvse.exe``{:.highlight .language-cmhg} © ESET 2014-2018
atomic-red-team T1546.003.md WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges.</blockquote> MIT License. © 2018 Red Canary
signature-base crime_cn_campaign_njrat.yar $s4 = “WmiPrvSE.exe” fullword wide CC BY-NC 4.0
signature-base crime_cn_campaign_njrat.yar $a1 = “WmiPrvSE.exe” fullword wide CC BY-NC 4.0
signature-base crime_cn_campaign_njrat.yar $s2 = “Temporary Projects\WmiPrvSE\” ascii CC BY-NC 4.0
signature-base gen_cn_hacktools.yar $s8 = “wmiprvse.exe” fullword ascii CC BY-NC 4.0
signature-base gen_cn_hacktools.yar $s10 = “wmiprvse.exe” fullword ascii CC BY-NC 4.0
signature-base gen_cn_hacktools.yar $s8 = “wmiprvse.exe” ascii CC BY-NC 4.0
signature-base gen_cn_hacktools.yar $s5 = “wmiprvse.exe” fullword ascii CC BY-NC 4.0
signature-base gen_cn_hacktools.yar $s3 = “wmiprvse.exe” fullword ascii CC BY-NC 4.0
signature-base gen_cn_hacktools.yar $s6 = “wmiprvse.exe” fullword ascii CC BY-NC 4.0

MIT License. Copyright (c) 2020-2021 Strontic.