Procedure examples

Earth Lusca has used `mshta.exe` to load an HTA script within a malicious .LNK file.

Inception has used malicious HTA files to drop and execute malware.

Pteranodon can use mshta.exe to execute an HTA file hosted on a remote server.

Lumma Stealer has used mshta.exe to execute additional content.

Xbash can use mshta for executing scripts.

NanHaiShu uses mshta.exe to load its program and files.

Metamorfo has used mshta.exe to execute a HTA payload.

Sibot has been executed via MSHTA application.

Revenge RAT uses mshta.exe to run malicious scripts on the system.

BabyShark has used mshta.exe to download and execute applications from a remote server.

POWERSTATS can use Mshta.exe to execute additional payloads on compromised hosts.

Covenant can create HTA files to install Grunt listeners.

Koadic can use mshta to serve additional payloads and to help schedule tasks for persistence.

Mustang Panda initial payloads downloaded a Windows Installer MSI file that in turn dropped follow-on files leading to installation of PlugX during RedDelta Modified PlugX Infection Chain Operations.

During the 3CX Supply Chain Attack, AppleJeus delivered components using a Windows Installer package (.msi). The MSI installer extracted several files and executed the 3CXDesktopApp.exe, which loaded the malicious library file ffmpeg.dll.

APT38 has used `msiexec.exe` to execute malicious files.

Machete has used msiexec to install the Machete malware.

ZIRCONIUM has used the msiexec.exe command-line utility to download and execute malicious MSI files.

TA505 has used msiexec to download and execute malicious Windows Installer files.

Molerats has used msiexec.exe to execute an MSI payload.

Rancor has used msiexec to download and execute malicious installer files over HTTP.

RCSession has the ability to execute inside the msiexec.exe process.

Tsundere Botnet has been distributed via an MSI installer.

FlawedAmmyy has been installed via `msiexec.exe`.

Raspberry Robin uses msiexec.exe for post-installation communication to command and control infrastructure. Msiexec.exe is executed referencing a remote resource for second-stage payload retrieval and execution.

Mispadu has been installed via MSI installer.

IcedID can inject itself into a suspended msiexec.exe process to send beacons to C2 while appearing as a normal msi application. IcedID has also used msiexec.exe to deploy the IcedID loader.

Ragnar Locker has been delivered as an unsigned MSI package that was executed with msiexec.exe.

Javali has used the MSI installer to download and execute malicious payloads.

Latrodectus has called `msiexec` to install remotely-hosted MSI files.

Chaes has used .MSI files as an initial way to start the infection chain.

Metamorfo has used MsiExec.exe to automatically execute files.

RedLine Stealer has been installed via MSI Installer.

Grandoreiro can use MSI files to execute DLLs.

DEADEYE can use `msiexec.exe` for execution of malicious DLL.

Clop can use msiexec.exe to disable security tools on the system.

Melcoz can use MSI files with embedded VBScript for execution.

Maze has delivered components for its ransomware attacks using MSI files, some of which have been executed from the command-line using msiexec.

AppleJeus has been installed via MSI installer.

QakBot can use MSIExec to spawn multiple cmd.exe processes.

DOWNIISSA can create an instance of msiexec.exe and inject LODEINFO shellcode into the memory of the process.

LoudMiner used an MSI installer to install the virtualization software.

RemoteUtilities can use Msiexec to install a service.

Duqu has used msiexec to execute malicious Windows Installer packages. Additionally, a PROPERTY=VALUE pair containing a 56-bit encryption key has been used to decrypt the main payload from the installer packages.

Cobalt Group has used odbcconf to proxy the execution of malicious DLL files.

Bumblebee can use `odbcconf.exe` to run DLLs on targeted hosts.

Raspberry Robin uses the Windows utility odbcconf.exe to execute malicious commands, using the regsvr flag to execute DLLs and bypass application control mechanisms that are not monitoring for odbcconf.exe abuse.

Agent Tesla has dropped RegAsm.exe onto systems for performing malicious activity.

During Operation Dream Job, Lazarus Group used `regsvr32` to execute malware.

During C0015, the threat actors employed code that used `regsvr32` for execution.