Procedure examples

LazyScripter has used `mshta.exe` to execute Koadic stagers.

Lazarus Group has used mshta.exe to execute HTML pages downloaded by initial access documents.

Earth Lusca has used `mshta.exe` to load an HTA script within a malicious .LNK file.

Inception has used malicious HTA files to drop and execute malware.

APT38 has used `msiexec.exe` to execute malicious files.

Machete has used msiexec to install the Machete malware.

ZIRCONIUM has used the msiexec.exe command-line utility to download and execute malicious MSI files.

TA505 has used msiexec to download and execute malicious Windows Installer files.

Molerats has used msiexec.exe to execute an MSI payload.

Rancor has used msiexec to download and execute malicious installer files over HTTP.

Cobalt Group has used odbcconf to proxy the execution of malicious DLL files.

Kimsuky has executed malware with regsvr32s.

APT32 created a Scheduled Task/Job that used regsvr32.exe to execute a COM scriptlet that dynamically downloaded a backdoor and injected it into memory. The group has also used regsvr32 to run their backdoor.

Leviathan has used regsvr32 for execution.

Blue Mockingbird has executed custom-compiled XMRIG miner DLLs using regsvr32.exe.

Storm-0501 has launched Cobalt Strike Beacon files using regsvr32.exe.

TA551 has used regsvr32.exe to load malicious DLLs.

Deep Panda has used regsvr32.exe to execute a server variant of Derusbi in victim networks.

Cobalt Group has used regsvr32.exe to execute scripts.

Inception has ensured persistence at system boot by setting the value regsvr32 %path%\ctfmonrn.dll /s.

WIRTE has used `regsvr32.exe` to trigger the execution of a malicious script.

APT19 used Regsvr32 to bypass application control techniques.

APT38 has used rundll32.exe to execute binaries, scripts, and Control Panel Item files and to execute code via proxy to avoid triggering security tools.

APT3 has a tool that can run DLLs.

Kimsuky has used `rundll32.exe` to execute malicious scripts and malware on a victim's network.

APT41 has used rundll32.exe to execute a loader.

APT32 malware has used rundll32.exe to execute an initial infection process.

HAFNIUM has used rundll32 to load malicious DLLs.

MuddyWater has used malware that leveraged rundll32.exe in a Registry Run key to execute a .dll.

Gamaredon Group malware has used rundll32 to launch additional malicious components.

FIN7 has used `rundll32.exe` to execute malware on a compromised network.

Sandworm Team used a backdoor which could execute a supplied DLL using rundll32.exe.

UNC3886 has used rundll32.exe to execute MiniDump for dumping LSASS process memory.

Carbanak installs VNC server software that executes through rundll32.

Aquatic Panda used rundll32.exe to proxy execution of a malicious DLL file identified as a keylogging binary.

Blue Mockingbird has executed custom-compiled XMRIG miner DLLs using rundll32.exe.

Storm-0501 has launched Cobalt Strike Beacon files with rundll32.exe.

TA505 has leveraged rundll32.exe to execute malicious DLLs.

RedCurl has used rundll32.exe to execute malicious files.

TA551 has used rundll32.exe to load malicious DLLs.

LazyScripter has used `rundll32.exe` to execute Koadic stagers.

APT28 executed CHOPSTICK by using rundll32 commands such as rundll32.exe “C:\Windows\twain_64.dll”. APT28 also executed a .dll for a first stage dropper using rundll32.exe. An APT28 loader Trojan saved a batch script that uses rundll32 to execute a DLL payload.

Lazarus Group has used rundll32 to execute malicious payloads on a compromised host.

CopyKittens uses rundll32 to load various tools on victims, including a lateral movement tool named Vminst, Cobalt Strike, and shellcode.

Wizard Spider has utilized `rundll32.exe` to deploy ransomware commands with the use of WebDAV.

Daggerfly proxied execution of malicious DLLs through a renamed rundll32.exe binary.

Magic Hound has used rundll32.exe to execute MiniDump from comsvcs.dll when dumping LSASS memory.

APT19 configured its payload to inject into the rundll32.exe.

Medusa Group has leveraged Microsoft Management Console (MMC) to facilitate lateral movement and to interact locally or remotely with victim devices using the command `mmc.exe compmgmt.msc /computer:{hostname/ip}`.

BlackByte has used tools such as AnyDesk in victim environments.