Forest Global Training Partners

Cyber Risks · Cisco Talos

Introduction to COM usage by Windows threats

Summary: Cisco Talos published an introduction to how Windows malware uses Component Object Model (COM), covering how binaries that use COM can be analyzed and giving examples of malware families and their COM usage. The post explains that COM classes are identified by CLSIDs and interfaces by IIDs, that registration data lives under HKEY_CLASSES_ROOT\CLSID and HKEY_CLASSES_ROOT\Interface, and that Distributed COM (DCOM) is documented in MITRE ATT&CK as technique T1021.003.

Key Takeaway: Malware is most commonly a COM client, and samples that call CoInitializeSecurity or CoSetProxyBlanket are often setting up the identity and authentication context needed for WMI, DCOM, or another out-of-process COM interface. Many malware families also assemble GUID structures dynamically on the stack before creating an object specifically to make analysis harder.

Read the original at Cisco Talos ↗

Topics
Malware
Related