services.exe

  • File Path: C:\Windows\system32\services.exe
  • Description: Services and Controller app

Hashes

Type Hash
MD5 DB896369FB58241ADF28515E3765C514
SHA1 617A0A0BAAB180541DB739C4A6851D784943C317
SHA256 A2E369DF26C88015FE1F97C7542D6023B5B1E4830C25F94819507EE5BCB1DFCC
SHA384 E725F9E26419C4708AFEA2350A3D3EDF0B968DAF1FDAE6F12822BD08F6305E74779A3B06688392BF31CB6A1182A69D7D
SHA512 C47F469E3ED2D358C51E8B804A6E1DB37C6B33543919BEE938279902D01D44F171E132C29D2A36EC3B4369E1441F597993E727CE2F2D087A4AB384ACE345C959
SSDEEP 12288:EBcEZkiKFRQVcO09OEIXXfHx0q6BgQP/pA9cY2l1JlmruvjXT2C57p3XewSH9uLi:OcAkiKFscODvnfH+OQXyaY2lPT6gFXen
IMP 7D2820FC8CAF521DC2058168B480D204
PESHA1 65C5931468115B27320CE4297D64CAA8AC8F706B
PE256 A03CD7126C83845A879E153B45DE6553E2160BE1E57D4BF32B416608FC99104F

Signature

  • Status: Signature verified.
  • Serial: 3300000266BD1580EFA75CD6D3000000000266
  • Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: services.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.17763.1 (WinBuild.160101.0800)
  • Product Version: 10.0.17763.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/70
  • VirusTotal Link: https://www.virustotal.com/gui/file/a2e369df26c88015fe1f97c7542d6023b5b1e4830c25f94819507ee5bcb1dfcc/detection/

Possible Misuse

The following table contains possible examples of services.exe being misused. While services.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma file_event_win_creation_system_file.yml - '\services.exe' DRL 1.0
sigma image_load_wsman_provider_image_load.yml - 'C:\Windows\System32\services.exe' DRL 1.0
sigma proc_access_win_svchost_cred_dump.yml - '*\services.exe' DRL 1.0
sigma proc_creation_win_abusing_debug_privilege.yml - '\services.exe' DRL 1.0
sigma proc_creation_win_always_install_elevated_windows_installer.yml ParentImage: 'C:\Windows\System32\services.exe' DRL 1.0
sigma proc_creation_win_apt_hafnium.yml - '\services.exe' DRL 1.0
sigma proc_creation_win_hack_wce.yml ParentImage\|endswith: '\services.exe' DRL 1.0
sigma proc_creation_win_impacket_lateralization.yml # parent is services.exe DRL 1.0
sigma proc_creation_win_impacket_lateralization.yml - '\services.exe' # smbexec DRL 1.0
sigma proc_creation_win_meterpreter_or_cobaltstrike_getsystem_service_start.yml ParentImage\|endswith: '\services.exe' DRL 1.0
sigma proc_creation_win_proc_wrong_parent.yml - '\services.exe' DRL 1.0
sigma proc_creation_win_susp_execution_path_webserver.yml - '\services.exe' DRL 1.0
sigma proc_creation_win_susp_powershell_parent_process.yml - '\services.exe' DRL 1.0
sigma proc_creation_win_susp_service_dir.yml - '\services.exe' DRL 1.0
sigma proc_creation_win_susp_svchost.yml - '\services.exe' DRL 1.0
sigma proc_creation_win_system_exe_anomaly.yml - '\services.exe' DRL 1.0
malware-ioc misp-badiis.json "description": "Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (<code>services.exe</code>) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as <code>sc.exe</code> and [Net](https://attack.mitre.org/software/S0039).\n\n[PsExec](https://attack.mitre.org/software/S0029) can also be used to execute commands or payloads via a temporary Windows service created through the service control manager API.(Citation: Russinovich Sysinternals)\n\nAdversaries may leverage these mechanisms to execute malicious content. This can be done by either executing a new or modified service. This technique is the execution used in conjunction with [Windows Service](https://attack.mitre.org/techniques/T1543/003) during service persistence or privilege escalation.", © ESET 2014-2018
atomic-red-team T1569.002.md <blockquote>Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (services.exe) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as sc.exe and Net. MIT License. © 2018 Red Canary
signature-base apt_bronze_butler.yar $s1 = “Services.exe” fullword ascii CC BY-NC 4.0
signature-base apt_win_plugx.yar $x1 = “%WINDIR%\SYSTEM32\SERVICES.EXE” fullword wide CC BY-NC 4.0
signature-base spy_equation_fiveeyes.yar $s0 = “SERVICES.EXE” fullword wide CC BY-NC 4.0

MIT License. Copyright (c) 2020-2021 Strontic.