Procedure examples

Pteranodon can use mshta.exe to execute an HTA file hosted on a remote server.

Lumma Stealer has used mshta.exe to execute additional content.

Xbash can use mshta for executing scripts.

NanHaiShu uses mshta.exe to load its program and files.

Metamorfo has used mshta.exe to execute a HTA payload.

Sibot has been executed via MSHTA application.

Revenge RAT uses mshta.exe to run malicious scripts on the system.

BabyShark has used mshta.exe to download and execute applications from a remote server.

POWERSTATS can use Mshta.exe to execute additional payloads on compromised hosts.

Covenant can create HTA files to install Grunt listeners.

Koadic can use mshta to serve additional payloads and to help schedule tasks for persistence.

RCSession has the ability to execute inside the msiexec.exe process.

Tsundere Botnet has been distributed via an MSI installer.

FlawedAmmyy has been installed via `msiexec.exe`.

Raspberry Robin uses msiexec.exe for post-installation communication to command and control infrastructure. Msiexec.exe is executed referencing a remote resource for second-stage payload retrieval and execution.

Mispadu has been installed via MSI installer.

IcedID can inject itself into a suspended msiexec.exe process to send beacons to C2 while appearing as a normal msi application. IcedID has also used msiexec.exe to deploy the IcedID loader.

Ragnar Locker has been delivered as an unsigned MSI package that was executed with msiexec.exe.

Javali has used the MSI installer to download and execute malicious payloads.

Latrodectus has called `msiexec` to install remotely-hosted MSI files.

Chaes has used .MSI files as an initial way to start the infection chain.

Metamorfo has used MsiExec.exe to automatically execute files.

RedLine Stealer has been installed via MSI Installer.

Grandoreiro can use MSI files to execute DLLs.

DEADEYE can use `msiexec.exe` for execution of malicious DLL.

Clop can use msiexec.exe to disable security tools on the system.

Melcoz can use MSI files with embedded VBScript for execution.

Maze has delivered components for its ransomware attacks using MSI files, some of which have been executed from the command-line using msiexec.

AppleJeus has been installed via MSI installer.

QakBot can use MSIExec to spawn multiple cmd.exe processes.

DOWNIISSA can create an instance of msiexec.exe and inject LODEINFO shellcode into the memory of the process.

LoudMiner used an MSI installer to install the virtualization software.

RemoteUtilities can use Msiexec to install a service.

Duqu has used msiexec to execute malicious Windows Installer packages. Additionally, a PROPERTY=VALUE pair containing a 56-bit encryption key has been used to decrypt the main payload from the installer packages.

Bumblebee can use `odbcconf.exe` to run DLLs on targeted hosts.

Raspberry Robin uses the Windows utility odbcconf.exe to execute malicious commands, using the regsvr flag to execute DLLs and bypass application control mechanisms that are not monitoring for odbcconf.exe abuse.

Agent Tesla has dropped RegAsm.exe onto systems for performing malicious activity.

Some Orz versions have an embedded DLL known as MockDll that uses Process Hollowing and regsvr32 to execute another payload.

TONESHELL has used regsvr32.exe to execute the windows `DLLRegisterServer` function.

AppleSeed can call regsvr32.exe for execution.

Emotet uses RegSvr32 to execute the DLL payload.

Squirrelwaffle has been executed using `regsvr32.exe`.

Raspberry Robin uses regsvr32.exe execution without any command line parameters for command and control requests to IP addresses associated with Tor nodes.

Ragnar Locker has used regsvr32.exe to execute components of VirtualBox.

Hi-Zor executes using regsvr32.exe called from the Registry Run Keys / Startup Folder persistence mechanism.

Xbash can use regsvr32 for executing scripts.

Saint Bot has used `regsvr32` to execute scripts.

EVILNUM can run a remote scriptlet that drops a file and executes it via regsvr32.exe.

Mori can use `regsvr32.exe` for DLL execution.

RogueRobin uses regsvr32.exe to run a .sct file for execution.