value:  Egregor has used regsvr32.exe to execute malicious DLLs. ;; EVILNUM can run a remote scriptlet that drops a file and executes it via regsvr32.exe. ;; Hi-Zor executes using regsvr32.exe called from the Registry Run Keys / Startup Folder persistence mechanism. ;; Inception has ensured persistence at system boot by setting the value regsvr32 %path%\ctfmonrn.dll /s. ;; Koadic can use Regsvr32 to execute additional payloads. ;; Leviathan has used regsvr32 for execution. ;; More_eggs has used regsvr32.exe to execute the malicious DLL. ;; Some Orz versions have an embedded DLL known as MockDll that uses Process Hollowing and regsvr32 to execute another payload. ;; Ragnar Locker has used regsvr32.exe to execute components of VirtualBox. ;; RogueRobin uses regsvr32.exe to run a .sct file for execution. ;; TA551 has used regsvr32.exe to load malicious DLLs. ;; Valak has used regsvr32.exe to launch malicious DLLs. ;; WIRTE has used Regsvr32.exe to trigger the execution of a malicious script. ;; Xbash can use regsvr32 for executing scripts.
name: Signed Binary Proxy Execution: Regsvr32