COM Hijacking

Created the Saturday 23 March 2019. Updated 2 months ago.

COM hijacking is a technique used by adversaries to insert malicious code into the Windows operating system through the Microsoft Component Object Model (COM).

COM is a system that allows software components to interact with each other, and adversaries can abuse this system to execute their own code in place of legitimate software. To achieve this, they alter references and relationships in the COM system by modifying the Windows Registry. Specifically, they replace a reference to a legitimate system component with a reference to their own malicious code.

When the legitimate component is executed through normal system operation, the adversary's code is executed instead. This can provide a means for the adversary to achieve persistence, as they can choose to hijack objects that are used frequently enough to maintain a consistent level of persistence. However, they must be careful not to break noticeable functionality within the system, as this could cause system instability and potentially lead to detection.

Technique Identifier

U1212

Technique Tags

Microsoft Component Object Model (COM) software components interaction Windows operating system persistence

Featured Windows API's

Below, you will find a list of the most commonly used Windows API's that are currently utilized by malware authors for current evasion technique. This list is meant to provide an overview of the API's that are commonly used for this purpose. If there are any API's that you feel should be included on this list, please do not hesitate to contact us. We will be happy to update the list and provide any additional information or documentation that may be helpful.

Code Snippets

Description

This code opens the relevant key in the Windows Registry and modifies the value to point to the path of the malicious executable. When the COM object is used, it will execute the malicious code instead of the legitimate system component.

#include <Windows.h>
#include <atlbase.h>

int main()
{
    // Modify the Windows Registry to replace the reference to a legitimate system component with the path to the malicious executable
    HKEY hKey;
    LONG lResult = RegOpenKeyEx(HKEY_LOCAL_MACHINE, "SOFTWARE\\Classes\\MyCOMObject", 0, KEY_WRITE, &hKey);
    if (lResult == ERROR_SUCCESS)
    {
        RegSetValueEx(hKey, "", 0, REG_SZ, (BYTE*)"C:\\MaliciousCode.exe", sizeof("C:\\MaliciousCode.exe"));
        RegCloseKey(hKey);
    }

    // Use the COM object as normal
    CComPtr<IMyCOMObject> pMyCOMObject;
    HRESULT hr = pMyCOMObject.CoCreateInstance(__uuidof(MyCOMObject));
    if (SUCCEEDED(hr))
    {
        // When the COM object is executed, the malicious code will be run instead of the legitimate system component
        pMyCOMObject->DoSomething();
    }

    return 0;
}

Additional Resources

External Links

The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.

How to hunt: Detecting persistence and evasion with the COM | Elastic Blog