services.exe

  • File Path: C:\Windows\system32\services.exe
  • Description: Services and Controller app

Hashes

Type Hash
MD5 C9998B1FBD08EC9E2F2914BA7718F297
SHA1 0A973F5ED0BB697CBE46D7D016629061667D83B6
SHA256 41E785FF78C698C860BE93F6F1F0A2369F8932D186D7D5E5BF97C0AF4C6C466C
SHA384 1B1B4B25D3FE685CC55BD6F147C406E56645C5BF4F33D46EF2E1327C7DE2BF3F1166F72AF865C5634B2702E560A0CCBB
SHA512 A53099D8D4BADF7323166C17A54715102CE8C4E0C2AB617BC5D16FF5CF5DCAAC476A53DEABEB508372E2691A2B053150CCC1C37F6FB98534D96F33A3DEC06C3D
SSDEEP 12288:+cXbArul82LFb9UC8BDBbkWT/dRhozMoqLX/ocgbIZ:+R5cFbH8Nr7ThjjLX/ocg8Z

Signature

  • Status: Signature verified.
  • Serial: 330000026551AE1BBD005CBFBD000000000265
  • Thumbprint: E168609353F30FF2373157B4EB8CD519D07A2BFF
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: services.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.

Possible Misuse

The following table contains possible examples of services.exe being misused. While services.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma file_event_win_creation_system_file.yml - '\services.exe' DRL 1.0
sigma image_load_wsman_provider_image_load.yml - 'C:\Windows\System32\services.exe' DRL 1.0
sigma proc_access_win_svchost_cred_dump.yml - '*\services.exe' DRL 1.0
sigma proc_creation_win_abusing_debug_privilege.yml - '\services.exe' DRL 1.0
sigma proc_creation_win_always_install_elevated_windows_installer.yml ParentImage: 'C:\Windows\System32\services.exe' DRL 1.0
sigma proc_creation_win_apt_hafnium.yml - '\services.exe' DRL 1.0
sigma proc_creation_win_hack_wce.yml ParentImage\|endswith: '\services.exe' DRL 1.0
sigma proc_creation_win_impacket_lateralization.yml # parent is services.exe DRL 1.0
sigma proc_creation_win_impacket_lateralization.yml - '\services.exe' # smbexec DRL 1.0
sigma proc_creation_win_meterpreter_or_cobaltstrike_getsystem_service_start.yml ParentImage\|endswith: '\services.exe' DRL 1.0
sigma proc_creation_win_proc_wrong_parent.yml - '\services.exe' DRL 1.0
sigma proc_creation_win_susp_execution_path_webserver.yml - '\services.exe' DRL 1.0
sigma proc_creation_win_susp_powershell_parent_process.yml - '\services.exe' DRL 1.0
sigma proc_creation_win_susp_service_dir.yml - '\services.exe' DRL 1.0
sigma proc_creation_win_susp_svchost.yml - '\services.exe' DRL 1.0
sigma proc_creation_win_system_exe_anomaly.yml - '\services.exe' DRL 1.0
malware-ioc misp-badiis.json "description": "Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (<code>services.exe</code>) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as <code>sc.exe</code> and [Net](https://attack.mitre.org/software/S0039).\n\n[PsExec](https://attack.mitre.org/software/S0029) can also be used to execute commands or payloads via a temporary Windows service created through the service control manager API.(Citation: Russinovich Sysinternals)\n\nAdversaries may leverage these mechanisms to execute malicious content. This can be done by either executing a new or modified service. This technique is the execution used in conjunction with [Windows Service](https://attack.mitre.org/techniques/T1543/003) during service persistence or privilege escalation.", © ESET 2014-2018
atomic-red-team T1569.002.md <blockquote>Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (services.exe) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as sc.exe and Net. MIT License. © 2018 Red Canary
signature-base apt_bronze_butler.yar $s1 = “Services.exe” fullword ascii CC BY-NC 4.0
signature-base apt_win_plugx.yar $x1 = “%WINDIR%\SYSTEM32\SERVICES.EXE” fullword wide CC BY-NC 4.0
signature-base spy_equation_fiveeyes.yar $s0 = “SERVICES.EXE” fullword wide CC BY-NC 4.0

MIT License. Copyright (c) 2020-2021 Strontic.