services.exe
- File Path:
C:\Windows\system32\services.exe
- Description: Services and Controller app
Hashes
Type | Hash |
---|---|
MD5 | 1B8FD5BCAF4B90950D50AAC16B0DF9A3 |
SHA1 | FFB38669750CEC946E81F0114AABD1A2555A51E9 |
SHA256 | F14CBE42E4C29C57ACDF781388D387A01963075F255ABF57D8486D7842257500 |
SHA384 | 41B464052D287E33A8A994C339B60061C7DA591AACDB61AC0A60E7B300BCCA14DB743E90DF1049F5BC4038706E06C4A0 |
SHA512 | AEDC98B67C590D05C0F103865741B2F502D70B73EB7F6CA519C227B5FCFF28AF702831AC5CE02D78725E483A063CBEC71C4FF869EA18DDF07ABB1F56E9C30AD2 |
SSDEEP | 12288:n8mrmpMj8jAkkteIKuk91HcFsJOkK1tvX0o50RKEQA:n8m6ej3kweBuwiu4fNX0o50/ |
IMP | CDE9FC783A23D72BBCF6C4DDCC10ED87 |
PESHA1 | CC44E3501489CD9BA145E09D7E2662D06E5513B3 |
PE256 | 488F11922738FA01284294BDFCC784A50B435AB702F7F96D2D813BA96B1F01A0 |
Signature
- Status: Signature verified.
- Serial:
3300000266BD1580EFA75CD6D3000000000266
- Thumbprint:
A4341B9FD50FB9964283220A36A1EF6F6FAA7840
- Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
- Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
File Metadata
- Original Filename: services.exe.mui
- Product Name: Microsoft Windows Operating System
- Company Name: Microsoft Corporation
- File Version: 10.0.19041.1 (WinBuild.160101.0800)
- Product Version: 10.0.19041.1
- Language: English (United States)
- Legal Copyright: Microsoft Corporation. All rights reserved.
- Machine Type: 64-bit
File Scan
- VirusTotal Detections: 0/76
- VirusTotal Link: https://www.virustotal.com/gui/file/f14cbe42e4c29c57acdf781388d387a01963075f255abf57d8486d7842257500/detection
Possible Misuse
The following table contains possible examples of services.exe
being misused. While services.exe
is not inherently malicious, its legitimate functionality can be abused for malicious purposes.
Source | Source File | Example | License |
---|---|---|---|
sigma | file_event_win_creation_system_file.yml | - '\services.exe' |
DRL 1.0 |
sigma | image_load_wsman_provider_image_load.yml | - 'C:\Windows\System32\services.exe' |
DRL 1.0 |
sigma | proc_access_win_svchost_cred_dump.yml | - '*\services.exe' |
DRL 1.0 |
sigma | proc_creation_win_abusing_debug_privilege.yml | - '\services.exe' |
DRL 1.0 |
sigma | proc_creation_win_always_install_elevated_windows_installer.yml | ParentImage: 'C:\Windows\System32\services.exe' |
DRL 1.0 |
sigma | proc_creation_win_apt_hafnium.yml | - '\services.exe' |
DRL 1.0 |
sigma | proc_creation_win_hack_wce.yml | ParentImage\|endswith: '\services.exe' |
DRL 1.0 |
sigma | proc_creation_win_impacket_lateralization.yml | # parent is services.exe |
DRL 1.0 |
sigma | proc_creation_win_impacket_lateralization.yml | - '\services.exe' # smbexec |
DRL 1.0 |
sigma | proc_creation_win_meterpreter_or_cobaltstrike_getsystem_service_start.yml | ParentImage\|endswith: '\services.exe' |
DRL 1.0 |
sigma | proc_creation_win_proc_wrong_parent.yml | - '\services.exe' |
DRL 1.0 |
sigma | proc_creation_win_susp_execution_path_webserver.yml | - '\services.exe' |
DRL 1.0 |
sigma | proc_creation_win_susp_powershell_parent_process.yml | - '\services.exe' |
DRL 1.0 |
sigma | proc_creation_win_susp_service_dir.yml | - '\services.exe' |
DRL 1.0 |
sigma | proc_creation_win_susp_svchost.yml | - '\services.exe' |
DRL 1.0 |
sigma | proc_creation_win_system_exe_anomaly.yml | - '\services.exe' |
DRL 1.0 |
malware-ioc | misp-badiis.json | "description": "Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (<code>services.exe</code>) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as <code>sc.exe</code> and [Net](https://attack.mitre.org/software/S0039).\n\n[PsExec](https://attack.mitre.org/software/S0029) can also be used to execute commands or payloads via a temporary Windows service created through the service control manager API.(Citation: Russinovich Sysinternals)\n\nAdversaries may leverage these mechanisms to execute malicious content. This can be done by either executing a new or modified service. This technique is the execution used in conjunction with [Windows Service](https://attack.mitre.org/techniques/T1543/003) during service persistence or privilege escalation.", |
© ESET 2014-2018 |
atomic-red-team | T1569.002.md | <blockquote>Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (services.exe ) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as sc.exe and Net. |
MIT License. © 2018 Red Canary |
signature-base | apt_bronze_butler.yar | $s1 = “Services.exe” fullword ascii | CC BY-NC 4.0 |
signature-base | apt_win_plugx.yar | $x1 = “%WINDIR%\SYSTEM32\SERVICES.EXE” fullword wide | CC BY-NC 4.0 |
signature-base | spy_equation_fiveeyes.yar | $s0 = “SERVICES.EXE” fullword wide | CC BY-NC 4.0 |
MIT License. Copyright (c) 2020-2021 Strontic.