value:  Maze has delivered components for its ransomware attacks using MSI files some of which have been executed from the command-line using msiexec. ;; Melcoz can use MSI files with embedded VBScript for execution. ;; Metamorfo has used MsiExec.exe to automatically execute files. ;; Molerats has used msiexec.exe to execute an MSI payload. ;; Ragnar Locker has been delivered as an unsigned MSI package that was executed with msiexec.exe. ;; Rancor has used msiexec to download and execute malicious installer files over HTTP. ;; RemoteUtilities can use Msiexec to install a service. ;; TA505 has used msiexec to download and execute malicious Windows Installer files. ;; ZIRCONIUM has used the msiexec.exe command-line utility to download and execute malicious MSI files.
name: Signed Binary Proxy Execution: Msiexec