COM Hijacking

Secondary Categories: 02-Malware 02-Persistence

---

Description:

A Component Object Model was introduced in Windows 3.11 and is an object-oriented system meant to create binary software components that can interact with each other. This technology allows you to reuse items without knowing how they were made internally.

When a software needs to load a COM object, it uses the Windows API CoCreateInstance to construct an uninitialized object instance of a specific class, with the CLSID (class identifier) as one of the needed parameters. When a program calls CoCreateInstance with a particular CLSID valu, the operating system consults the registry to discover which binary contains the requested COM code

As seen in the photo above you can see that the A1DB7B5E-D0EA-4FE0-93C4-314505788272 CLSID subfolder InProcServer32 has the default registry entry for TaskflowDataEngine.dll.

Depending on how the program is run it could be in one of the following subfolders:

• InprocServer/InprocServer32
• LocalServer/LocalServer32
• TreatAs
• ProgID

and the top level folder in the registry would be in

• HKEY_CURRENT_USER\Software\Classes\<CLSID>
• HKEY_LOCAL_MACHINE\Software\Classes\<CLSID>

Discovery

In order to find COM keys that could be used to hijack you can use Procmon and use the following filters:

Also still good to add: _Exclude if path starts with HKLM

When loading a COM object the HKEY Current User (HKCU) is examined first when trying to load COM objects, giving preference to user-specified COM objects. Then the COM object is looked up in HKEY CLASSES ROOT (HCKR) which is really just HKLM

Example

In the example below firefox.exe looks up COM object with the CLSID A6FF50C0-56C0-71CA-5732-BED303A59628. If we search for this CLSID in the HKCU registry we can see that its not found, but it is found in the HCKR registry.

We can then export this entry and modify it to include our malicious DLL

The code being executed:

/*
evil.cpp
simple DLL for DLL inject to process
author: @cocomelonc
https://cocomelonc.github.io/tutorial/2021/09/20/malware-injection-2.html
*/
 
#include <windows.h>
#pragma comment (lib, "user32.lib")
 
BOOL APIENTRY DllMain(HMODULE hModule,  DWORD  nReason, LPVOID lpReserved) {
  switch (nReason) {
  case DLL_PROCESS_ATTACH:
    MessageBox(
      NULL,
      "Meow from evil.dll!",
      "=^..^=",
      MB_OK
    );
    break;
  case DLL_PROCESS_DETACH:
    break;
  case DLL_THREAD_ATTACH:
    break;
  case DLL_THREAD_DETACH:
    break;
  }
  return TRUE;
}

Compiling DLL:

x86_64-w64-mingw32-g++ -shared -o evil.dll evil.cpp -fpermissive

Now with our registry export file modified and a working malicious DLL we can then import it into the registry

Now that this is done we can close firefox and re run it and see our malicious DLL is ran

Extra

Note that once our DLL is ran by firefox we can use process hacker to get the PID. The PID for the message box is 9272, but if we just view the firefox process and its child process we can see that PID 9272 is not there.

---

Resources:

Title	URL
COM DLL Hijacking	https://cocomelonc.github.io/tutorial/2022/05/02/malware-pers-3.html

Also Check Out:

• Component Object Model (COM)