services.exe

  • File Path: C:\WINDOWS\system32\services.exe
  • Description: Services and Controller app

Hashes

Type Hash
MD5 8EF1B55ADE9CCC3C6D0E1EC8B2205F20
SHA1 2A1C3151F59B3399AF6C1D37274BC1DCEF94A422
SHA256 82D52B1FA2D566F974325533A0C9F1BC4E14D114225BA5C126480E5E6FD5EEC0
SHA384 2175AC7B0CEEDEA4B8164A9C27B9A68FE16559F1C36F604E5D4966C17062B22383DF66BF583CF8A1D58E510569715AB1
SHA512 3C1DB3B29EA4DE9DBB18B9EEB4D3BCDEBF3AE3DBD26269958CED0D73B874903BB9DB6A21E2DC135BDE48CB5D75C7540E1A4D754B81E599564D7D4566ECB0CD91
SSDEEP 12288:so80LSZ5AQup74zvfIkOqHISqsBwR0UxvRKD+Hdnad45Z3kX5o5cqe:N80ObOpEzhOqHI70EO+HIe3kX5o5cd
IMP 58ADBCF0D2E1C208107602D7BAFB511E
PESHA1 325B430B478C4167C60B1EE78D28FA5814969CB9
PE256 1D8EC0ED2ADD9642A87CFA8D2B77A7F864FD259A4B3423A6A391274254BCD124

Signature

  • Status: Signature verified.
  • Serial: 33000002ED2C45E4C145CF48440000000002ED
  • Thumbprint: 312860D2047EB81F8F58C29FF19ECDB4C634CF6A
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: services.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.22000.1 (WinBuild.160101.0800)
  • Product Version: 10.0.22000.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/73
  • VirusTotal Link: https://www.virustotal.com/gui/file/82d52b1fa2d566f974325533a0c9f1bc4e14d114225ba5c126480e5e6fd5eec0/detection

Possible Misuse

The following table contains possible examples of services.exe being misused. While services.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma file_event_win_creation_system_file.yml - '\services.exe' DRL 1.0
sigma image_load_wsman_provider_image_load.yml - 'C:\Windows\System32\services.exe' DRL 1.0
sigma proc_access_win_svchost_cred_dump.yml - '*\services.exe' DRL 1.0
sigma proc_creation_win_abusing_debug_privilege.yml - '\services.exe' DRL 1.0
sigma proc_creation_win_always_install_elevated_windows_installer.yml ParentImage: 'C:\Windows\System32\services.exe' DRL 1.0
sigma proc_creation_win_apt_hafnium.yml - '\services.exe' DRL 1.0
sigma proc_creation_win_hack_wce.yml ParentImage\|endswith: '\services.exe' DRL 1.0
sigma proc_creation_win_impacket_lateralization.yml # parent is services.exe DRL 1.0
sigma proc_creation_win_impacket_lateralization.yml - '\services.exe' # smbexec DRL 1.0
sigma proc_creation_win_meterpreter_or_cobaltstrike_getsystem_service_start.yml ParentImage\|endswith: '\services.exe' DRL 1.0
sigma proc_creation_win_proc_wrong_parent.yml - '\services.exe' DRL 1.0
sigma proc_creation_win_susp_execution_path_webserver.yml - '\services.exe' DRL 1.0
sigma proc_creation_win_susp_powershell_parent_process.yml - '\services.exe' DRL 1.0
sigma proc_creation_win_susp_service_dir.yml - '\services.exe' DRL 1.0
sigma proc_creation_win_susp_svchost.yml - '\services.exe' DRL 1.0
sigma proc_creation_win_system_exe_anomaly.yml - '\services.exe' DRL 1.0
malware-ioc misp-badiis.json "description": "Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (<code>services.exe</code>) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as <code>sc.exe</code> and [Net](https://attack.mitre.org/software/S0039).\n\n[PsExec](https://attack.mitre.org/software/S0029) can also be used to execute commands or payloads via a temporary Windows service created through the service control manager API.(Citation: Russinovich Sysinternals)\n\nAdversaries may leverage these mechanisms to execute malicious content. This can be done by either executing a new or modified service. This technique is the execution used in conjunction with [Windows Service](https://attack.mitre.org/techniques/T1543/003) during service persistence or privilege escalation.", © ESET 2014-2018
atomic-red-team T1569.002.md <blockquote>Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (services.exe) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as sc.exe and Net. MIT License. © 2018 Red Canary
signature-base apt_bronze_butler.yar $s1 = “Services.exe” fullword ascii CC BY-NC 4.0
signature-base apt_win_plugx.yar $x1 = “%WINDIR%\SYSTEM32\SERVICES.EXE” fullword wide CC BY-NC 4.0
signature-base spy_equation_fiveeyes.yar $s0 = “SERVICES.EXE” fullword wide CC BY-NC 4.0

MIT License. Copyright (c) 2020-2021 Strontic.