InstallUtil.exe

  • File Path: C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  • Description: .NET Framework installation utility
  • Comments: Flavor=Retail

Hashes

Type Hash
MD5 B3C141D48E14652BFFA508E1C6BDDC6B
SHA1 6ECFD55D91B2E725E1EFDE5678DE5E2332A0E971
SHA256 774ADCEF9CEBC4B12C2C10D0A05ED3D4F59F739DB38700E4A763085B8146137E
SHA384 4937D5E91A707B812A8864806F87DF11EC7748528CFA48800B54D2408E085B372BC1CD5E81ACBE156CCCB5960E0C7523
SHA512 4903758E0AB9FDC8AB019D86A5962FD5DBBCB2037DB1580709BCC38BA5B7AE951A160136DC5CB8A6050E3286CEAC0127DE4249168B4B762DF3E6733C8AC6540E
SSDEEP 384:utpFVymMsihB9VKS7xdgxYKJ9Yl6dnPU3SERztmbqCJstdMardz/JikPZ+LPZT3z:C5Ms2SqdCb6Iq8H5luWWa
PESHA1 F301A41D2B963E8AB5E3D39E7600B8B8DEE70615
PE256 0C0FC87547372B8ACFDF9F028D7B3303DE71EA84B0704A06F6B3658EE113C851

Runtime Data

Usage (stdout):

Microsoft (R) .NET Framework Installation utility Version 4.8.4161.0
Copyright (C) Microsoft Corporation.  All rights reserved.

Usage: InstallUtil [/u | /uninstall] [option [...]] assembly [[option [...]] assembly] [...]]

InstallUtil executes the installers in each given assembly.
If the /u or /uninstall switch is specified, it uninstalls
the assemblies, otherwise it installs them. Unlike other
options, /u applies to all assemblies, regardless of where it
appears on the command line.

Installation is done in a transactioned way: If one of the
assemblies fails to install, the installations of all other
assemblies are rolled back. Uninstall is not transactioned.

Options take the form /switch=[value]. Any option that occurs
before the name of an assembly will apply to that assembly's
installation. Options are cumulative but overridable - options
specified for one assembly will apply to the next as well unless
the option is specified with a new value. The default for all
options is empty or false unless otherwise specified.

Options recognized:

Options for installing any assembly:
/AssemblyName
 The assembly parameter will be interpreted as an assembly name (Name,
 Locale, PublicKeyToken, Version). The default is to interpret the
 assembly parameter as the filename of the assembly on disk.

/LogFile=[filename]
 File to write progress to. If empty, do not write log. Default
 is <assemblyname>.InstallLog

/LogToConsole={true|false}
 If false, suppresses output to the console.

/ShowCallStack
 If an exception occurs at any point during installation, the call
 stack will be printed to the log.

/InstallStateDir=[directoryname]
 Directory in which the .InstallState file will be stored. Default
 is the directory of the assembly.


Individual installers used within an assembly may recognize other
options. To learn about these options, run InstallUtil with the paths
of the assemblies on the command line along with the /? or /help option.

Loaded Modules:

Path
C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
C:\WINDOWS\System32\KERNEL32.dll
C:\WINDOWS\System32\KERNELBASE.dll
C:\WINDOWS\SYSTEM32\MSCOREE.DLL
C:\WINDOWS\SYSTEM32\ntdll.dll

Signature

  • Status: Signature verified.
  • Serial: 33000002ED2C45E4C145CF48440000000002ED
  • Thumbprint: 312860D2047EB81F8F58C29FF19ECDB4C634CF6A
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: InstallUtil.exe
  • Product Name: Microsoft .NET Framework
  • Company Name: Microsoft Corporation
  • File Version: 4.8.4161.0 built by: NET48REL1
  • Product Version: 4.8.4161.0
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/73
  • VirusTotal Link: https://www.virustotal.com/gui/file/774adcef9cebc4b12c2c10d0a05ed3d4f59f739db38700e4a763085b8146137e/detection

File Similarity (ssdeep match)

File Score
C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\StoreAdm.exe 68
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\System.Web.ApplicationServices.dll 46
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\System.Web.DynamicData.Design.dll 61
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe 63
C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe 63
C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe 65
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe 65
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe 66
C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe 66
C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe 65
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe 63
C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe 91
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe 88
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe 63
C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe 63
C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe 65
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe 65
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe 66
C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe 66
C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe 63
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe 63
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe 93

Possible Misuse

The following table contains possible examples of InstallUtil.exe being misused. While InstallUtil.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma sysmon_suspicious_remote_thread.yml - '\installutil.exe' DRL 1.0
sigma proc_creation_win_possible_applocker_bypass.yml - '\installutil.exe' DRL 1.0
sigma proc_creation_win_possible_applocker_bypass.yml - Using installutil to add features for .NET applications (primarily would occur in developer environments) DRL 1.0
sigma proc_creation_win_susp_instalutil.yml title: Suspicious Execution of InstallUtil Without Log DRL 1.0
sigma proc_creation_win_susp_instalutil.yml description: Uses the .NET InstallUtil.exe application in order to execute image without log DRL 1.0
sigma proc_creation_win_susp_instalutil.yml - https://docs.microsoft.com/en-us/dotnet/framework/tools/installutil-exe-installer-tool DRL 1.0
sigma proc_creation_win_susp_instalutil.yml Image\|endswith: \InstallUtil.exe DRL 1.0
LOLBAS Installutil.yml Name: Installutil.exe  
LOLBAS Installutil.yml - Command: InstallUtil.exe /logfile= /LogToConsole=false /U AllTheThings.dll  
LOLBAS Installutil.yml - Path: C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe  
LOLBAS Installutil.yml - Path: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe  
LOLBAS Installutil.yml - Path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe  
LOLBAS Installutil.yml - Path: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe  
LOLBAS Installutil.yml - Link: https://pentestlab.blog/2017/05/08/applocker-bypass-installutil/  
LOLBAS Installutil.yml - Link: https://docs.microsoft.com/en-us/dotnet/framework/tools/installutil-exe-installer-tool  
malware-ioc sparklinggoblin ==== InstallUtil-based .NET loader used to decrypt and load SideWalk © ESET 2014-2018
malware-ioc sparklinggoblin ==== InstallUtil-based .NET loader used to decrypt and load Cobalt Strike © ESET 2014-2018
malware-ioc sparklinggoblin \|T1218.004\|Signed Binary Proxy Execution: InstallUtil © ESET 2014-2018
atomic-red-team index.md - T1218.004 InstallUtil MIT License. © 2018 Red Canary
atomic-red-team index.md - Atomic Test #3: InstallUtil class constructor method call [windows] MIT License. © 2018 Red Canary
atomic-red-team index.md - Atomic Test #4: InstallUtil Install method call [windows] MIT License. © 2018 Red Canary
atomic-red-team index.md - Atomic Test #5: InstallUtil Uninstall method call - /U variant [windows] MIT License. © 2018 Red Canary
atomic-red-team index.md - Atomic Test #6: InstallUtil Uninstall method call - ‘/installtype=notransaction /action=uninstall’ variant [windows] MIT License. © 2018 Red Canary
atomic-red-team index.md - Atomic Test #7: InstallUtil HelpText method call [windows] MIT License. © 2018 Red Canary
atomic-red-team index.md - Atomic Test #8: InstallUtil evasive invocation [windows] MIT License. © 2018 Red Canary
atomic-red-team windows-index.md - T1218.004 InstallUtil MIT License. © 2018 Red Canary
atomic-red-team windows-index.md - Atomic Test #3: InstallUtil class constructor method call [windows] MIT License. © 2018 Red Canary
atomic-red-team windows-index.md - Atomic Test #4: InstallUtil Install method call [windows] MIT License. © 2018 Red Canary
atomic-red-team windows-index.md - Atomic Test #5: InstallUtil Uninstall method call - /U variant [windows] MIT License. © 2018 Red Canary
atomic-red-team windows-index.md - Atomic Test #6: InstallUtil Uninstall method call - ‘/installtype=notransaction /action=uninstall’ variant [windows] MIT License. © 2018 Red Canary
atomic-red-team windows-index.md - Atomic Test #7: InstallUtil HelpText method call [windows] MIT License. © 2018 Red Canary
atomic-red-team windows-index.md - Atomic Test #8: InstallUtil evasive invocation [windows] MIT License. © 2018 Red Canary
atomic-red-team matrix.md | | | Path Interception by Search Order Hijacking CONTRIBUTE A TEST | RC Scripts | InstallUtil | | | | | | | | MIT License. © 2018 Red Canary
atomic-red-team windows-matrix.md | | | Path Interception by Unquoted Path | Registry Run Keys / Startup Folder | InstallUtil | | | | | | | | MIT License. © 2018 Red Canary
atomic-red-team T1218.004.md # T1218.004 - InstallUtil MIT License. © 2018 Red Canary
atomic-red-team T1218.004.md <blockquote>Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. (Citation: MSDN InstallUtil) InstallUtil is digitally signed by Microsoft and located in the .NET directories on a Windows system: C:\Windows\Microsoft.NET\Framework\v\InstallUtil.exe</code> and C:\Windows\Microsoft.NET\Framework64\v\InstallUtil.exe</code>. MIT License. © 2018 Red Canary
atomic-red-team T1218.004.md InstallUtil may also be used to bypass application control through use of attributes within the binary that execute the class decorated with the attribute [System.ComponentModel.RunInstaller(true)]. (Citation: LOLBAS Installutil)</blockquote> MIT License. © 2018 Red Canary
atomic-red-team T1218.004.md - Atomic Test #3 - InstallUtil class constructor method call MIT License. © 2018 Red Canary
atomic-red-team T1218.004.md - Atomic Test #4 - InstallUtil Install method call MIT License. © 2018 Red Canary
atomic-red-team T1218.004.md - Atomic Test #5 - InstallUtil Uninstall method call - /U variant MIT License. © 2018 Red Canary
atomic-red-team T1218.004.md - Atomic Test #6 - InstallUtil Uninstall method call - ‘/installtype=notransaction /action=uninstall’ variant MIT License. © 2018 Red Canary
atomic-red-team T1218.004.md - Atomic Test #7 - InstallUtil HelpText method call MIT License. © 2018 Red Canary
atomic-red-team T1218.004.md - Atomic Test #8 - InstallUtil evasive invocation MIT License. © 2018 Red Canary
atomic-red-team T1218.004.md Executes the CheckIfInstallable class constructor runner instead of executing InstallUtil. Upon execution, the InstallUtil test harness will be executed. MIT License. © 2018 Red Canary
atomic-red-team T1218.004.md | invocation_method | the type of InstallUtil invocation variant - Executable, InstallHelper, or CheckIfInstallable | String | CheckIfInstallable| MIT License. © 2018 Red Canary
atomic-red-team T1218.004.md ##### Description: InstallUtil test harness script must be installed at specified location (#{test_harness}) MIT License. © 2018 Red Canary
atomic-red-team T1218.004.md Executes the InstallHelper class constructor runner instead of executing InstallUtil. Upon execution, no output will be displayed if the test MIT License. © 2018 Red Canary
atomic-red-team T1218.004.md | invocation_method | the type of InstallUtil invocation variant - Executable, InstallHelper, or CheckIfInstallable | String | InstallHelper| MIT License. © 2018 Red Canary
atomic-red-team T1218.004.md ## Atomic Test #3 - InstallUtil class constructor method call MIT License. © 2018 Red Canary
atomic-red-team T1218.004.md | invocation_method | the type of InstallUtil invocation variant - Executable, InstallHelper, or CheckIfInstallable | String | Executable| MIT License. © 2018 Red Canary
atomic-red-team T1218.004.md InstallUtil class constructor execution test failure. Installer assembly execution output did not match the expected output. MIT License. © 2018 Red Canary
atomic-red-team T1218.004.md ## Atomic Test #4 - InstallUtil Install method call MIT License. © 2018 Red Canary
atomic-red-team T1218.004.md InstallUtil Install method execution test failure. Installer assembly execution output did not match the expected output. MIT License. © 2018 Red Canary
atomic-red-team T1218.004.md ## Atomic Test #5 - InstallUtil Uninstall method call - /U variant MIT License. © 2018 Red Canary
atomic-red-team T1218.004.md InstallUtil Uninstall method execution test failure. Installer assembly execution output did not match the expected output. MIT License. © 2018 Red Canary
atomic-red-team T1218.004.md ## Atomic Test #6 - InstallUtil Uninstall method call - ‘/installtype=notransaction /action=uninstall’ variant MIT License. © 2018 Red Canary
atomic-red-team T1218.004.md ## Atomic Test #7 - InstallUtil HelpText method call MIT License. © 2018 Red Canary
atomic-red-team T1218.004.md Executes the Uninstall Method. Upon execution, help information will be displayed for InstallUtil. MIT License. © 2018 Red Canary
atomic-red-team T1218.004.md InstallUtil HelpText property execution test failure. Installer assembly execution output did not match the expected output. MIT License. © 2018 Red Canary
atomic-red-team T1218.004.md ## Atomic Test #8 - InstallUtil evasive invocation MIT License. © 2018 Red Canary
atomic-red-team T1218.004.md Executes an InstallUtil assembly by renaming InstallUtil.exe and using a nonstandard extension for the assembly. Upon execution, “Running a transacted installation.” MIT License. © 2018 Red Canary
atomic-red-team T1218.004.md Copy-Item -Path “$([System.Runtime.InteropServices.RuntimeEnvironment]::GetRuntimeDirectory())InstallUtil.exe” -Destination “$Env:windir\System32\Tasks\notepad.exe” MIT License. © 2018 Red Canary
atomic-red-team T1218.004.md Evasive Installutil invocation test failure. Installer assembly execution output did not match the expected output. MIT License. © 2018 Red Canary

MIT License. Copyright (c) 2020-2021 Strontic.