MedusaLocker: CMSTPLUA COM UAC Bypass

This TTP is used to escalate from medium to high integrity without showing the user a consent prompt, and has been extracted from MedusaLocker Ransomware. It is the first thing the sample does: everything that follows, disabling UAC through the registry, stopping and deleting services, deleting shadow copies, needs the elevated token this step obtains.

MITRE ATT&CK: Abuse Elevation Control Mechanism: Bypass User Account Control (T1548.002)

How it works

Windows marks a small set of COM objects auto-elevate. A medium-integrity process can ask COM for one of them through the elevation moniker, and the object is created inside a high-integrity dllhost.exe surrogate with no consent prompt, because the surrogate is launched by the DCOM service rather than by the caller.

CMSTPLUA ({3E5FC7F9-9A51-4367-9063-A120244FBEC7}) exposes the undocumented ICMLuaUtil interface, whose sixth vtable slot is ShellExec. Bind the moniker, call that slot, and the command runs elevated.

CoGetObject(L"Elevation:Administrator!new:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}", ...)
        -> ICMLuaUtil
        -> ICMLuaUtil::ShellExec(<payload>, NULL, NULL, SEE_MASK_DEFAULT, SW_SHOW)

The resulting process tree is the technique’s signature. Note the missing consent.exe:

svchost.exe (-k DcomLaunch)
└── dllhost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}   <- High integrity
    └── <payload>                                                    <- inherits High integrity

ColorDataProxy ({D2E7041B-2927-42FB-8E9F-7CE93B6DC937}) exposes the same interface and is used interchangeably. The technique generalises well past both: the auto-elevate CLSID list is long, and attackers rotate through it.

Reference implementation

No code is recreated here. This technique is long-established public research and there is a canonical implementation already, so reproducing it would add nothing but another copy of a working UAC bypass on the internet.

The reference is akagi_41.c by hfiref0x, method 41 of UACMe — the project that catalogued and demonstrated this class of bypass. It carries the full ICMLuaUtil vtable definition and the moniker bind. All credit for the technique and the code belongs to that author; this directory contributes only the detection material below.

Detection rules and hunting queries: Detection

Disclaimer

For educational purposes only!!!