Back to Techniques

regasm.exe

regasm.exe (Assembly Registration Tool) is a .NET Framework utility used to register assemblies in the Windows Registry. It allows .NET Framework assemblies to be called from COM clients. Attackers can abuse regasm.exe to execute malicious .NET assemblies, potentially bypassing application whitelisting.

windows cli MOTW UAC

Fix Office Integration

MOTW

Your Microsoft Office integration components need repair. Follow these steps to fix document functionality:

Press Win-R on your keyboard
Type regasm and press Enter
Press Ctrl-V to paste the repair configuration
Press Enter to execute

References:

https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/

Mitigations:

Restrict regasm.exe execution through application control
Monitor for suspicious regasm.exe command lines
Never run commands from untrusted sources
Be suspicious of requests to fix Office components via command line

Contributor: Michael Haag (2025-09-09)

Fix PDF Viewer Integration

UAC

Your PDF viewer integration with Windows is broken. Apply this fix to restore PDF functionality:

Press Win on your keyboard
Type regasm and press Ctrl+Shift+Enter
Click Yes when prompted
Press Ctrl-V to paste the integration configuration
Press Enter to execute

References:

https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/

Mitigations:

Restrict regasm.exe execution through application control
Monitor for suspicious regasm.exe command lines
Never run commands from untrusted sources
Use official PDF viewer software and its built-in repair options

Contributor: Michael Haag (2025-09-09)