elevation_service.exe
- File Path:
C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.125\elevation_service.exe - Description: Google Chrome
Hashes
| Type | Hash |
|---|---|
| MD5 | 93CC7632D51EC92D19E9F6C3CEC1E14E |
| SHA1 | B98EADB1898F702F53ECAC963A851587EB3E6EBB |
| SHA256 | 3ACB5939358B4209D8B443F215B325A3F48A5C4ADA992ABE4DDEF9C88B60ABBD |
| SHA384 | 97668B742C45B8DD2E672BD1189FAB3C0CC68A154593622251E549E6959AAE863C3E9A8B3E8873FC1F6F786E757089BA |
| SHA512 | 0390D2E274E4FDF36AD4C6017B79DE43AB497E3D0B6B098B137EBD37680D578D0984B4CD63064200D085D8886CE35BA96620E98039FD2799224BAFCA4E0816E8 |
| SSDEEP | 24576:Q5y7PSlMPVrw6BnRJERaRg51cj71FM8sY2qUO80fxTh9c42/:gy7UMPTJcRaK1cv1FM8srO8QT3cp |
Runtime Data
Usage (stderr):
[0815/134243.503:ERROR:service_main.cc(150)] Failed to connect to the service control manager: The service process could not connect to the service controller. (0x427)
Signature
- Status: Signature verified.
- Serial:
0C15BE4A15BB0903C901B1D6C265302F - Thumbprint:
CB7E84887F3C6015FE7EDFB4F8F36DF7DC10590E - Issuer: CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US
- Subject: CN=Google LLC, O=Google LLC, L=Mountain View, S=ca, C=US
File Metadata
- Original Filename: elevation_service.exe
- Product Name: Google Chrome
- Company Name: Google LLC
- File Version: 84.0.4147.125
- Product Version: 84.0.4147.125
- Language: English (United States)
- Legal Copyright: Copyright 2020 Google LLC. All rights reserved.
Possible Misuse
The following table contains possible examples of elevation_service.exe being misused. While elevation_service.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.
| Source | Source File | Example | License |
|---|---|---|---|
| sigma | file_event_win_cve_2021_41379_msi_lpe.yml | description: Detects signs of the exploitation of LPE CVE-2021-41379 that include an msiexec process that creates an elevation_service.exe file |
DRL 1.0 |
| sigma | file_event_win_cve_2021_41379_msi_lpe.yml | TargetFilename\|endswith: '\elevation_service.exe' |
DRL 1.0 |
| sigma | proc_creation_win_exploit_lpe_cve_2021_41379.yml | ParentImage\|endswith: '\elevation_service.exe' |
DRL 1.0 |
MIT License. Copyright (c) 2020-2021 Strontic.