Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

System Binary Proxy Execution: Утилита Regsvr32

Other sub-techniques of System Binary Proxy Execution (13)

ID	Название
.001	CHM-файл
.002	Панель управления
.003	Установщик профилей диспетчера подключений (CMSTP)
.004	Утилита InstallUtil
.005	Утилита mshta
.007	Утилита msiexec
.008	Утилита odbcconf
.009	Утилиты Regsvcs и Regasm
.010	Утилита Regsvr32
.011	Rundll32
.012	Verclsid
.013	Mavinject
.014	MMC

Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft. (Citation: Microsoft Regsvr32) Malicious usage of Regsvr32.exe may avoid triggering security tools that may not monitor execution of, and modules loaded by, the regsvr32.exe process because of allowlists or false positives from Windows using regsvr32.exe for normal operations. Regsvr32.exe can also be used to specifically bypass application control using functionality to load COM scriptlets to execute DLLs under user permissions. Since Regsvr32.exe is network and proxy aware, the scripts can be loaded by passing a uniform resource locator (URL) to file on an external Web server as an argument during invocation. This method makes no changes to the Registry as the COM object is not actually registered, only executed. (Citation: LOLBAS Regsvr32) This variation of the technique is often referred to as a "Squiblydoo" and has been used in campaigns targeting governments. (Citation: Carbon Black Squiblydoo Apr 2016) (Citation: FireEye Regsvr32 Targeting Mongolian Gov) Regsvr32.exe can also be leveraged to register a COM Object used to establish persistence via Component Object Model Hijacking. (Citation: Carbon Black Squiblydoo Apr 2016)

ID: T1218.010

Относится к технике: T1218

Тактика(-и): Defense Evasion

Платформы: Windows

Требуемые разрешения: Administrator, User

Источники данных: Command: Command Execution, Module: Module Load, Network Traffic: Network Connection Creation, Process: Process Creation

Версия: 2.0

Дата создания: 23 Jan 2020

Последнее изменение: 11 Mar 2022

Название	Описание
Примеры процедур
Saint Bot	Saint Bot has used `regsvr32` to execute scripts.(Citation: Malwarebytes Saint Bot April 2021)(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
QakBot	QakBot can use Regsvr32 to execute malicious DLLs.(Citation: Red Canary Qbot)(Citation: Cyberint Qakbot May 2021)(Citation: ATT QakBot April 2021)
TA551	TA551 has used regsvr32.exe to load malicious DLLs.(Citation: Unit 42 Valak July 2020)
Orz	Some Orz versions have an embedded DLL known as MockDll that uses Process Hollowing and regsvr32 to execute another payload.(Citation: Proofpoint Leviathan Oct 2017)
Koadic	Koadic can use Regsvr32 to execute additional payloads.(Citation: Github Koadic)
Valak	Valak has used `regsvr32.exe` to launch malicious DLLs.(Citation: Cybereason Valak May 2020)(Citation: Unit 42 Valak July 2020)
Squirrelwaffle	Squirrelwaffle has been executed using `regsvr32.exe`.(Citation: ZScaler Squirrelwaffle Sep 2021)
Mori	Mori can use `regsvr32.exe` for DLL execution.(Citation: DHS CISA AA22-055A MuddyWater February 2022)
Astaroth	Astaroth can be loaded through regsvr32.exe.(Citation: Cybereason Astaroth Feb 2019)
Derusbi	Derusbi variants have been seen that use Registry persistence to proxy execution through regsvr32.exe.(Citation: ThreatGeek Derusbi Converge)
Deep Panda	Deep Panda has used regsvr32.exe to execute a server variant of Derusbi in victim networks.(Citation: RSA Shell Crew)
RogueRobin	RogueRobin uses regsvr32.exe to run a .sct file for execution.(Citation: Unit42 DarkHydrus Jan 2019)
Cobalt Group	Cobalt Group has used regsvr32.exe to execute scripts.(Citation: Talos Cobalt Group July 2018)(Citation: Morphisec Cobalt Gang Oct 2018)(Citation: TrendMicro Cobalt Group Nov 2017)
Ragnar Locker	Ragnar Locker has used regsvr32.exe to execute components of VirtualBox.(Citation: Sophos Ragnar May 2020)
Blue Mockingbird	Blue Mockingbird has executed custom-compiled XMRIG miner DLLs using regsvr32.exe.(Citation: RedCanary Mockingbird May 2020)
HermeticWizard	HermeticWizard has used `regsvr32.exe /s /i` to execute malicious payloads.(Citation: ESET Hermetic Wizard March 2022)
Egregor	Egregor has used regsvr32.exe to execute malicious DLLs.(Citation: JoeSecurity Egregor 2020)
	During C0015, the threat actors employed code that used `regsvr32` for execution.(Citation: DFIR Conti Bazar Nov 2021)
Leviathan	Leviathan has used regsvr32 for execution.(Citation: Proofpoint Leviathan Oct 2017)
Kimsuky	Kimsuky has executed malware with `regsvr32s`.(Citation: KISA Operation Muzabi)
Lazarus Group	Lazarus Group has used rgsvr32 to execute custom malware.(Citation: ESET Lazarus Jun 2020)
Inception	Inception has ensured persistence at system boot by setting the value `regsvr32 %path%\ctfmonrn.dll /s`.(Citation: Kaspersky Cloud Atlas December 2014)
WIRTE	WIRTE has used `regsvr32.exe` to trigger the execution of a malicious script.(Citation: Lab52 WIRTE Apr 2019)
More_eggs	More_eggs has used regsvr32.exe to execute the malicious DLL.(Citation: Security Intelligence More Eggs Aug 2019)
APT32	APT32 created a Scheduled Task/Job that used regsvr32.exe to execute a COM scriptlet that dynamically downloaded a backdoor and injected it into memory. The group has also used regsvr32 to run their backdoor.(Citation: ESET OceanLotus Mar 2019)(Citation: FireEye APT32 May 2017)(Citation: Cybereason Cobalt Kitty 2017)
EVILNUM	EVILNUM can run a remote scriptlet that drops a file and executes it via regsvr32.exe.(Citation: ESET EvilNum July 2020)
Hi-Zor	Hi-Zor executes using regsvr32.exe called from the Registry Run Keys / Startup Folder persistence mechanism.(Citation: Fidelis INOCNATION)
AppleSeed	AppleSeed can call regsvr32.exe for execution.(Citation: Malwarebytes Kimsuky June 2021)
Xbash	Xbash can use regsvr32 for executing scripts.(Citation: Unit42 Xbash Sept 2018)
APT19	APT19 used Regsvr32 to bypass application control techniques.(Citation: FireEye APT19)

Контрмера	Описание
Контрмеры
Exploit Protection	Use capabilities to detect and block conditions that may lead to or be indicative of a software exploit occurring.

Обнаружение

Use process monitoring to monitor the execution and arguments of regsvr32.exe. Compare recent invocations of regsvr32.exe with prior history of known good arguments and loaded files to determine anomalous and potentially adversarial activity. Command arguments used before and after the regsvr32.exe invocation may also be useful in determining the origin and purpose of the script or DLL being loaded. (Citation: Carbon Black Squiblydoo Apr 2016)

Ссылки

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.