Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary. [1]
Malicious usage of Regsvr32.exe may avoid triggering security tools that may not monitor execution of, and modules loaded by, the regsvr32.exe process because of allowlists or false positives from Windows using regsvr32.exe for normal operations. Regsvr32.exe can also be used to specifically bypass application control using functionality to load COM scriptlets to execute DLLs under user permissions. Since Regsvr32.exe is network and proxy aware, the scripts can be loaded by passing a uniform resource locator (URL) to file on an external Web server as an argument during invocation. This method makes no changes to the Registry as the COM object is not actually registered, only executed. [2] This variation of the technique is often referred to as a "Squiblydoo" attack and has been used in campaigns targeting governments. [3] [4]
Regsvr32.exe can also be leveraged to register a COM Object used to establish persistence via Component Object Model Hijacking. [3]
| ID | Name | Description |
|---|---|---|
| S0622 | AppleSeed | |
| G0073 | APT19 |
APT19 used Regsvr32 to bypass application control techniques.[6] |
| G0050 | APT32 |
APT32 created a Scheduled Task/Job that used regsvr32.exe to execute a COM scriptlet that dynamically downloaded a backdoor and injected it into memory. The group has also used regsvr32 to run their backdoor.[7][8][9] |
| S0373 | Astaroth | |
| G0108 | Blue Mockingbird |
Blue Mockingbird has executed custom-compiled XMRIG miner DLLs using regsvr32.exe.[11] |
| G0080 | Cobalt Group |
Cobalt Group has used regsvr32.exe to execute scripts.[12][13][14] |
| G0009 | Deep Panda |
Deep Panda has used regsvr32.exe to execute a server variant of Derusbi in victim networks.[15] |
| S0021 | Derusbi |
Derusbi variants have been seen that use Registry persistence to proxy execution through regsvr32.exe.[16] |
| S0554 | Egregor |
Egregor has used regsvr32.exe to execute malicious DLLs.[17] |
| S0568 | EVILNUM |
EVILNUM can run a remote scriptlet that drops a file and executes it via regsvr32.exe.[18] |
| S0087 | Hi-Zor |
Hi-Zor executes using regsvr32.exe called from the Registry Run Keys / Startup Folder persistence mechanism.[19] |
| G0100 | Inception |
Inception has ensured persistence at system boot by setting the value |
| S0250 | Koadic | |
| G0065 | Leviathan | |
| S0284 | More_eggs |
More_eggs has used regsvr32.exe to execute the malicious DLL.[23] |
| S0229 | Orz |
Some Orz versions have an embedded DLL known as MockDll that uses Process Hollowing and regsvr32 to execute another payload.[22] |
| S0650 | QakBot |
QakBot can use Regsvr32 to execute malicious DLLs.[24][25][26] |
| S0481 | Ragnar Locker |
Ragnar Locker has used regsvr32.exe to execute components of VirtualBox.[27] |
| S0270 | RogueRobin |
RogueRobin uses regsvr32.exe to run a .sct file for execution.[28] |
| G0127 | TA551 | |
| S0476 | Valak |
Valak has used |
| G0090 | WIRTE |
WIRTE has used Regsvr32.exe to trigger the execution of a malicious script.[31] |
| S0341 | Xbash |
| ID | Mitigation | Description |
|---|---|---|
| M1050 | Exploit Protection |
Microsoft's Enhanced Mitigation Experience Toolkit (EMET) Attack Surface Reduction (ASR) feature can be used to block regsvr32.exe from being used to bypass application control. [33] Identify and block potentially malicious software executed through regsvr32 functionality by using application control [34] tools, like Windows Defender Application Control[35], AppLocker, [36] [37] or Software Restriction Policies [38] where appropriate. [39] |
| ID | Data Source | Data Component |
|---|---|---|
| DS0017 | Command | Command Execution |
| DS0011 | Module | Module Load |
| DS0029 | Network Traffic | Network Connection Creation |
| DS0009 | Process | Process Creation |
Use process monitoring to monitor the execution and arguments of regsvr32.exe. Compare recent invocations of regsvr32.exe with prior history of known good arguments and loaded files to determine anomalous and potentially adversarial activity. Command arguments used before and after the regsvr32.exe invocation may also be useful in determining the origin and purpose of the script or DLL being loaded. [3]