Procedure examples

RCSession has the ability to execute inside the msiexec.exe process.

Tsundere Botnet has been distributed via an MSI installer.

FlawedAmmyy has been installed via `msiexec.exe`.

Raspberry Robin uses msiexec.exe for post-installation communication to command and control infrastructure. Msiexec.exe is executed referencing a remote resource for second-stage payload retrieval and execution.

Mispadu has been installed via MSI installer.

IcedID can inject itself into a suspended msiexec.exe process to send beacons to C2 while appearing as a normal msi application. IcedID has also used msiexec.exe to deploy the IcedID loader.

Ragnar Locker has been delivered as an unsigned MSI package that was executed with msiexec.exe.

Javali has used the MSI installer to download and execute malicious payloads.

Latrodectus has called `msiexec` to install remotely-hosted MSI files.

Chaes has used .MSI files as an initial way to start the infection chain.

Metamorfo has used MsiExec.exe to automatically execute files.

RedLine Stealer has been installed via MSI Installer.

Grandoreiro can use MSI files to execute DLLs.

DEADEYE can use `msiexec.exe` for execution of malicious DLL.

Clop can use msiexec.exe to disable security tools on the system.

Melcoz can use MSI files with embedded VBScript for execution.

Maze has delivered components for its ransomware attacks using MSI files, some of which have been executed from the command-line using msiexec.

AppleJeus has been installed via MSI installer.

QakBot can use MSIExec to spawn multiple cmd.exe processes.

DOWNIISSA can create an instance of msiexec.exe and inject LODEINFO shellcode into the memory of the process.

LoudMiner used an MSI installer to install the virtualization software.

RemoteUtilities can use Msiexec to install a service.

Duqu has used msiexec to execute malicious Windows Installer packages. Additionally, a PROPERTY=VALUE pair containing a 56-bit encryption key has been used to decrypt the main payload from the installer packages.