WmiPrvSE.exe

  • File Path: C:\Windows\system32\wbem\WmiPrvSE.exe
  • Description: WMI Provider Host

Hashes

Type Hash
MD5 A138504BE4FA90963D07BC1E277E874D
SHA1 6BD539A3AB1F70081C9D99B9404826D757ADC934
SHA256 6F2499D3A5B0EBF18DEDC0B4EF0BFA2D72289BF593DE53CA845E7C708F8F2098
SHA384 6EDCBD66E83FAF997E581B33B94647ED85977C32216182F7DF4139B456E2C81CF71EB0F335F6219C6E702814ED9DC815
SHA512 64EF30A6E9BE5EFF4997E016D1C991D634B54E2B0C25C801CA7208A82F2EC0CC2BE636621F9807045A21E1509DFEAE29ADFEAEE96377643B6C3A4707D4775E26
SSDEEP 12288:Grb0v1hvPk9uyoNAPx5HnvRjnTWUEGlzxm8:vLPkRrjnTWAl9
IMP B71CB3AC5C352BEC857C940CBC95F0F3
PESHA1 340F2EC60463ED45228E73012B898A3CC769AA25
PE256 99A59D8B9C5A34DB601F1B8ED1DCE09196B7223CD7AC7F7E0A1CB15FEA336E7C

Runtime Data

Open Handles:

Path Type
(R-D) C:\Windows\System32\en-US\user32.dll.mui File
(RW-) C:\Users\user\Documents File
\BaseNamedObjects__ComCatalogCache__ Section
\BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 Section
\BaseNamedObjects\NLS_CodePage_437_3_2_0_0 Section
\Sessions\1\Windows\Theme1703657751 Section
\Windows\Theme1455388728 Section

Loaded Modules:

Path
C:\Windows\System32\advapi32.dll
C:\Windows\System32\combase.dll
C:\Windows\System32\GDI32.dll
C:\Windows\System32\gdi32full.dll
C:\Windows\System32\IMM32.DLL
C:\Windows\System32\KERNEL32.DLL
C:\Windows\System32\KERNELBASE.dll
C:\Windows\System32\MSCTF.dll
C:\Windows\System32\msvcp_win.dll
C:\Windows\System32\msvcrt.dll
C:\Windows\SYSTEM32\NCObjAPI.DLL
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\System32\OLEAUT32.dll
C:\Windows\System32\RPCRT4.dll
C:\Windows\System32\sechost.dll
C:\Windows\System32\ucrtbase.dll
C:\Windows\System32\user32.dll
C:\Windows\system32\uxtheme.dll
C:\Windows\system32\wbem\FastProx.dll
C:\Windows\system32\wbem\WmiPrvSE.exe
C:\Windows\SYSTEM32\wbemcomn.dll
C:\Windows\System32\win32u.dll

Signature

  • Status: Signature verified.
  • Serial: 330000026551AE1BBD005CBFBD000000000265
  • Thumbprint: E168609353F30FF2373157B4EB8CD519D07A2BFF
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: Wmiprvse.exe
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/66
  • VirusTotal Link: https://www.virustotal.com/gui/file/6f2499d3a5b0ebf18dedc0b4ef0bfa2d72289bf593de53ca845e7c708f8f2098/detection/

Possible Misuse

The following table contains possible examples of WmiPrvSE.exe being misused. While WmiPrvSE.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma win_susp_lsass_dump_generic.yml - '\wmiprvse.exe' DRL 1.0
sigma win_susp_wmi_login.yml ProcessName: "*\\WmiPrvSE.exe" DRL 1.0
sigma sysmon_wmi_module_load.yml description: Detects non wmiprvse loading WMI modules DRL 1.0
sigma sysmon_wmi_module_load.yml - '\WmiPrvSe.exe' DRL 1.0
sigma sysmon_wmi_persistence_commandline_event_consumer.yml Image: 'C:\Windows\System32\wbem\WmiPrvSE.exe' DRL 1.0
sigma win_defender_psexec_wmi_asr.yml - '\wmiprvse.exe' DRL 1.0
sigma sysmon_cred_dump_lsass_access.yml - '\wmiprvse.exe' DRL 1.0
sigma win_apt_ta505_dropper.yml description: Detects mshta loaded by wmiprvse as parent as used by TA505 malicious documents DRL 1.0
sigma win_apt_ta505_dropper.yml ParentImage\|endswith: '\wmiprvse.exe' DRL 1.0
sigma win_impacket_lateralization.yml # parent is wmiprvse.exe DRL 1.0
sigma win_impacket_lateralization.yml - '*\wmiprvse.exe' # wmiexec DRL 1.0
sigma win_shell_spawn_susp_program.yml - '*\wmiprvse.exe' DRL 1.0
sigma win_susp_powershell_parent_process.yml - '\wmiprvse.exe' DRL 1.0
sigma win_wmiprvse_spawning_process.yml title: Wmiprvse Spawning Process DRL 1.0
sigma win_wmiprvse_spawning_process.yml description: Detects wmiprvse spawning processes DRL 1.0
sigma win_wmiprvse_spawning_process.yml ParentImage\|endswith: '\WmiPrvSe.exe' DRL 1.0
sigma win_wmiprvse_spawning_process.yml - '\WmiPrvSE.exe' DRL 1.0
sigma win_wmi_spwns_powershell.yml - '*\wmiprvse.exe' DRL 1.0
sigma sysmon_raw_disk_access_using_illegitimate_tools.yml - '\wmiprvse.exe' DRL 1.0
malware-ioc nukesped_lazarus .WmiPrvse.exe``{:.highlight .language-cmhg} © ESET 2014-2018
malware-ioc nukesped_lazarus .Wmiprvse.exe``{:.highlight .language-cmhg} © ESET 2014-2018
atomic-red-team hta.md ## MSHTA - Wmiprvse Spawning CMD MIT License. © 2018 Red Canary
atomic-red-team hta.md Using COM objects, mshta runs with no child processes. Wmiprvse spawns and executes cmd -> calc. MIT License. © 2018 Red Canary
atomic-red-team hta.md // Child of wmiprvse MIT License. © 2018 Red Canary
atomic-red-team Office_Macro_COM.md Wmiprvse.exe->cmd->powershell. MIT License. © 2018 Red Canary
atomic-red-team T1546.003.md WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges.</blockquote> MIT License. © 2018 Red Canary
signature-base crime_cn_campaign_njrat.yar $s4 = “WmiPrvSE.exe” fullword wide CC BY-NC 4.0
signature-base crime_cn_campaign_njrat.yar $a1 = “WmiPrvSE.exe” fullword wide CC BY-NC 4.0
signature-base crime_cn_campaign_njrat.yar $s2 = “Temporary Projects\WmiPrvSE\” ascii CC BY-NC 4.0
signature-base gen_cn_hacktools.yar $s8 = “wmiprvse.exe” fullword ascii CC BY-NC 4.0
signature-base gen_cn_hacktools.yar $s10 = “wmiprvse.exe” fullword ascii CC BY-NC 4.0
signature-base gen_cn_hacktools.yar $s8 = “wmiprvse.exe” ascii CC BY-NC 4.0
signature-base gen_cn_hacktools.yar $s5 = “wmiprvse.exe” fullword ascii CC BY-NC 4.0
signature-base gen_cn_hacktools.yar $s3 = “wmiprvse.exe” fullword ascii CC BY-NC 4.0
signature-base gen_cn_hacktools.yar $s6 = “wmiprvse.exe” fullword ascii CC BY-NC 4.0

MIT License. Copyright (c) 2020-2021 Strontic.