General discussion

  • Creator
    Topic
  • #4147083

    Why is regsvr32.exe being used by spoolsv.exe?

    Locked

    by vandenburg777 ·

    We have security software that stopped c:\windows\system32\spoolsv.exe from using c:\windows\syswow64\regsvr32.exe. I am trying to determine of this activity is legitimate and am suspicious because before July 12 there was no incidents of this happening in our environment at all and is only happening on 22 of our 250 workstations, but those are scattered among all offices. Usually the user is associated to NT AUTHORITY\SYSTEM but sometimes it is the actual user. All workstations are for the most part the same setup.

    • This topic was modified 9 months, 1 week ago by Avatar photorproffitt.

All Comments

  • Author
    Replies
    • #4147132
      Avatar photo

      Re: regsvr32.exe

      by kees_b ·

      In reply to Why is regsvr32.exe being used by spoolsv.exe?

      I have no doubt that it’s legitimate that a Microsoft program calls another Microsoft program. Ask your account manager why it does.

      • #4147144

        Reply To: Why is regsvr32.exe being used by spoolsv.exe?

        by vandenburg777 ·

        In reply to Re: regsvr32.exe

        Hopefully someone technical can explain the behavior so I’m confident that whitelisting this is okay. We use ThreatLocker and if it was very common activity I’m sure they would have already defined it as part of the built in rules.

    • #4147147
      Avatar photo

      Are your systems patched up for PrintNightmare ?

      by rproffitt ·

      In reply to Why is regsvr32.exe being used by spoolsv.exe?

      I’d check that out fast.

      • #4147154

        Reply To: Why is regsvr32.exe being used by spoolsv.exe?

        by vandenburg777 ·

        In reply to Are your systems patched up for PrintNightmare ?

        That is a very good thought. I did look into PrintNightmare earlier today and I noticed that MS finished patching for that in 2021. We are religious about patching so I believe we’re good on that one.

    • #4157093

      Information about regsvr32.exe

      by Harisamer214 ·

      In reply to Why is regsvr32.exe being used by spoolsv.exe?

      To determine if the activity is legitimate, you can try the following:

      1. Check the event logs for any errors or warnings related to spoolsv.exe or regsvr32.exe.
      2. Look for any suspicious files or processes on the affected computers.
      3. Use a malware scanner to scan the affected computers for malware.
      4. If you are still unsure whether the activity is legitimate, you can contact your security vendor for assistance.

      I hope this helps!

    • #4182536

      Reply To: Why is regsvr32.exe being used by spoolsv.exe?

      by inspirecrazeceo ·

      In reply to Why is regsvr32.exe being used by spoolsv.exe?

      The use of regsvr32.exe by spoolsv.exe is not a standard or legitimate behavior, and it could be indicative of a potential security issue. spoolsv.exe is the Windows Print Spooler service responsible for managing print jobs, while regsvr32.exe is a utility for registering and unregistering DLL files. The combination of these two processes might suggest an abnormal activity.

      Here are some possible explanations for this unusual behavior:

      1. **Malware or Malicious Activity:** It’s possible that malware or a malicious script has compromised the spoolsv.exe process to use regsvr32.exe for registering DLLs as part of its malicious activities.

      2. **Compromised System:** The instances where the user is associated with NT AUTHORITY\SYSTEM might suggest an elevated privilege compromise on those systems. This could potentially be a sign of a more serious security breach.

      3. **Scheduled Tasks or Third-Party Software:** Some legitimate applications or scheduled tasks might use regsvr32.exe for legitimate purposes, but it’s highly unusual for spoolsv.exe to trigger this behavior. You should check for any recently installed software or scheduled tasks that might be related.

Viewing 3 reply threads