Malware Dev

Parent Process ID Spoofing

2023
bordergate

Modern EDR solutions track process parent-child relationships to determine if suspicious activity is taking place. For instance, Microsoft Word launching cmd.exe would likely trigger an alarm.

When calling CreateProcess, it’s possible to set the attribute PROC_THREAD_ATTRIBUTE_PARENT_PROCESS to define the parent process. This attribute is part of the STARTUPINFOEXA structure. This is documented behaviour;

The lpValue parameter is a pointer to a handle to a process to use instead of the calling process as the parent for the process being created. The process to use must have the PROCESS_CREATE_PROCESS access right.

Modifying the Parent Process ID Value

To change the PPID of process, the following steps need to happen;

Call InitializeProcThreadAttributeList once to get the size of storing a single attribute.

    InitializeProcThreadAttributeList(NULL, 1, 0, &attributeSize);

Allocate some memory to store the attribute (based on the size received in InitializeProcThreadAttributeList), with HeapAlloc.

    startupInfo.lpAttributeList = (LPPROC_THREAD_ATTRIBUTE_LIST)HeapAlloc(GetProcessHeap(), 0, attributeSize);

Call InitializeProcThreadAttributeList again with our allocated memory.

    InitializeProcThreadAttributeList(startupInfo.lpAttributeList, 1, 0, &attributeSize);

Get a handle to our target parent process using OpenProcess.

    HANDLE parentProcessHandle = OpenProcess(PROCESS_CREATE_PROCESS, false, targetParent);

Call UpdateProcThreadAttribute to with our newly allocated attribute, setting the lpValue parameter to our parent process handle. This will ensure our attribute has the parent process ID of the target.

    UpdateProcThreadAttribute(startupInfo.lpAttributeList, 0, PROC_THREAD_ATTRIBUTE_PARENT_PROCESS, &parentProcessHandle, sizeof(HANDLE), NULL, NULL);

Start our new process using CreateProcess with an STARTUPINFOEX structure. The EXTENDED_STARTUPINFO_PRESENT process creation flag needs to be set for the attribute to be read.

    CreateProcessA(NULL, (LPSTR)"notepad", NULL, NULL, FALSE, EXTENDED_STARTUPINFO_PRESENT, NULL, NULL, &startupInfo.StartupInfo, &processInfo);

C++ PPID Spoofing Code

#include <windows.h>
#include <iostream>
#include <TlHelp32.h>


DWORD GetParent(const char* pName) {
    PROCESSENTRY32 pEntry;
    HANDLE snapshot;
    pEntry.dwSize = sizeof(PROCESSENTRY32);
    snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
 
    if (Process32First(snapshot, &pEntry) == TRUE) {
        while (Process32Next(snapshot, &pEntry) == TRUE) {
            if (_stricmp(pEntry.szExeFile, pName) == 0) {
                return pEntry.th32ProcessID;
            }
        }
    }
    CloseHandle(snapshot);
    return 0;
}

int main()
{
    STARTUPINFOEXA startupInfo;
    PROCESS_INFORMATION processInfo;
    SIZE_T attributeSize;
    ZeroMemory(&startupInfo, sizeof(STARTUPINFOEXA));
  
    // Set the target process
    // DWORD targetParent = 9416;

    // Get the parent PID
    DWORD targetParent = GetParent((LPSTR)"msedge.exe");
    printf("Parent ID : %d\n", targetParent);

    // Initialize the attribute list with a count of one. Store the size in attributeSize.
    InitializeProcThreadAttributeList(NULL, 1, 0, &attributeSize);
    
    // Allocate a buffer with the required size
    startupInfo.lpAttributeList = (LPPROC_THREAD_ATTRIBUTE_LIST)HeapAlloc(GetProcessHeap(), 0, attributeSize);
    printf("Attribute size: %d\n", attributeSize);

    // Call InitializeProcThreadAttributeList again with our buffer and the size parameter
    InitializeProcThreadAttributeList(startupInfo.lpAttributeList, 1, 0, &attributeSize);

    // Get a handle to the parent process (PROCESS_CREATE_PROCESS access mask)
    HANDLE parentProcessHandle = OpenProcess(PROCESS_CREATE_PROCESS, false, targetParent);

    // Update the attribute list with the parent process handle
    UpdateProcThreadAttribute(startupInfo.lpAttributeList, 0, PROC_THREAD_ATTRIBUTE_PARENT_PROCESS, &parentProcessHandle, sizeof(HANDLE), NULL, NULL);

    startupInfo.StartupInfo.cb = sizeof(STARTUPINFOEXA);
    // Start the process...
    CreateProcessA(NULL, (LPSTR)"notepad", NULL, NULL, FALSE, EXTENDED_STARTUPINFO_PRESENT, NULL, NULL, &startupInfo.StartupInfo, &processInfo);
 
    printf("New process ID : %d\n", processInfo.dwProcessId);
    return 0;
}

The executable can be compiled with;

cl ppid_spoof.cpp /Z7

We can then examine what’s going on with WinDBG. Breaking on the CreateProcess call;

0:000> bp kernelbase!CreateProcessA
0:000> g
Breakpoint 0 hit
eax=00000001 ebx=010ed000 ecx=012ff898 edx=012ff850 esi=01526378 edi=01527a28
eip=75d99df0 esp=012ff824 ebp=012ff8b4 iopl=0         nv up ei pl nz na po nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000202
KERNELBASE!CreateProcessA:
75d99df0 8bff            mov     edi,edi

0:000> dd esp
012ff824  00d9733a 00000000 00df8258 00000000
012ff834  00000000 00000000 00080000 00000000
012ff844  00000000 012ff850 012ff898 00000048
012ff854  00000000 00000000 00000000 00000000
012ff864  00000000 00000000 00000000 00000000
012ff874  00000000 00000000 00000000 00000000
012ff884  00000000 00000000 00000000 00000000
012ff894  015276d0 75cd530e 012ff8b8 012ff8b8

0:000> da 00df8258
00df8258  "notepad"

0:000> dt STARTUPINFOEXA 012ff850
ppid_spoof!STARTUPINFOEXA
   +0x000 StartupInfo      : _STARTUPINFOA
   +0x044 lpAttributeList  : 0x015276d0 _PROC_THREAD_ATTRIBUTE_LIST
0:000> dx -r1 (*((ppid_spoof!_STARTUPINFOA *)012ff850))
(*((ppid_spoof!_STARTUPINFOA *)012ff850))                 [Type: _STARTUPINFOA]
    [+0x000] cb               : 0x48 [Type: unsigned long]
    [+0x004] lpReserved       : 0x0 [Type: char *]
    [+0x008] lpDesktop        : 0x0 [Type: char *]
    [+0x00c] lpTitle          : 0x0 [Type: char *]
    [+0x010] dwX              : 0x0 [Type: unsigned long]
    [+0x014] dwY              : 0x0 [Type: unsigned long]
    [+0x018] dwXSize          : 0x0 [Type: unsigned long]
    [+0x01c] dwYSize          : 0x0 [Type: unsigned long]
    [+0x020] dwXCountChars    : 0x0 [Type: unsigned long]
    [+0x024] dwYCountChars    : 0x0 [Type: unsigned long]
    [+0x028] dwFillAttribute  : 0x0 [Type: unsigned long]
    [+0x02c] dwFlags          : 0x0 [Type: unsigned long]
    [+0x030] wShowWindow      : 0x0 [Type: unsigned short]
    [+0x032] cbReserved2      : 0x0 [Type: unsigned short]
    [+0x034] lpReserved2      : 0x0 [Type: unsigned char *]
    [+0x038] hStdInput        : 0x0 [Type: void *]
    [+0x03c] hStdOutput       : 0x0 [Type: void *]
    [+0x040] hStdError        : 0x0 [Type: void *]
0:000> dx -r1 ((ppid_spoof!_PROC_THREAD_ATTRIBUTE_LIST *)0x15276d0)
((ppid_spoof!_PROC_THREAD_ATTRIBUTE_LIST *)0x15276d0)                 : 0x15276d0 [Type: _PROC_THREAD_ATTRIBUTE_LIST *]

The STARTUPINFOA data structure is unpopulated apart from it’s size. The other parameters are optional.

Unfortunately the DT command appears unable to parse the _PROC_THREAD_ATTRIBUTE_LIST, but manually traversing it we can see the new parent process ID;

0:000> dd 0x15276d0
015276d0  00000001 00000001 00000001 baadf00d
015276e0  00000000 00020000 00000004 012ff8a8  < 012ff8a8 = Attribute1
015276f0  abababab abababab 00000000 00000000
01527700  22dc6639 00004fc6 01529000 015236b8
01527710  feeefeee feeefeee feeefeee feeefeee
01527720  feeefeee feeefeee feeefeee feeefeee
01527730  feeefeee feeefeee feeefeee feeefeee
01527740  feeefeee feeefeee feeefeee feeefeee

0:000> dd 012ff8a8
012ff8a8  00000054 0000207c 00000020 012ff8fc  < 0000207c = 8316n (msedge.exe process ID)
012ff8b8  00d97644 00000001 01526378 01527a28
012ff8c8  5857c5d8 00d91136 00d91136 010ed000
012ff8d8  00000000 00000000 00000000 012ff8c8
012ff8e8  00000000 012ff954 00d98b40 5998238c
012ff8f8  00000000 012ff90c 76b77d59 010ed000
012ff908  76b77d40 012ff964 77d9b79b 010ed000
012ff918  35ab15fb 00000000 00000000 010ed000

Once the code has been executed, you should see notepad opening under the parent process of Microsoft Edge;

Viewing Parent Process ID’s in C#

Processes can be queried in C# using Process.GetProcesses. Unfortunately, this can’t be used to determine the PPID. As such, a WMI query is then run to resolve this information. 

using System;
using System.Diagnostics;
using System.Management;

namespace GetProcesses
{
    internal class Program
    {
        static void Main(string[] args)
        {
            int PPID;
            Process[] processes = Process.GetProcesses();
            
            Array.ForEach(processes, (process) =>
            {
                try
                {
                    PPID = GetParentProcess(process.Id);
                    Console.WriteLine("Process: {0} ID: {1} PPID: {2}", process.ProcessName, process.Id, PPID);
                }
                catch 
                { 
                    Console.WriteLine("Error Finding PPID: " + process.ProcessName + " " + process.Id); 
                }
            });
            Console.ReadKey();
        }

        private static int GetParentProcess(int Id)
        {
            int parentPid = 0;
            using (ManagementObject mo = new ManagementObject("win32_process.handle='" + Id.ToString() + "'"))
            {
                mo.Get();
                parentPid = Convert.ToInt32(mo["ParentProcessId"]);
            }
            return parentPid;
        }

    }
}

C# PPID Spoofing Code

PPID Spoofing in C# can be performed using P/Invoke.

using System;
using System.Diagnostics;
using System.Runtime.InteropServices;

namespace PPIDSpoofing
{
    internal class Program
    {

        static void Main(string[] args)
        {
            Win32.PROCESS_INFORMATION processInfo = new Win32.PROCESS_INFORMATION();
            Win32.STARTUPINFOEX startUpInfoEx = new Win32.STARTUPINFOEX();
            IntPtr lpValueProc = IntPtr.Zero;
            IntPtr lpAttributeListSize = IntPtr.Zero;

            string parentCmd = "notepad";
            string command = @"C:\Windows\System32\cmd.exe";
 
            Win32.InitializeProcThreadAttributeList(IntPtr.Zero, 1, 0, ref lpAttributeListSize);
            startUpInfoEx.lpAttributeList = Marshal.AllocHGlobal(lpAttributeListSize);
            Win32.InitializeProcThreadAttributeList(startUpInfoEx.lpAttributeList, 1, 0, ref lpAttributeListSize);

            // Get a handle to the process we want to set as parent
            Process[] proc = Process.GetProcessesByName(parentCmd);
            IntPtr parent = Win32.OpenProcess(0x00C0, false, proc[0].Id);


            lpValueProc = Marshal.AllocHGlobal(IntPtr.Size);
            Marshal.WriteIntPtr(lpValueProc, parent);
            Win32.UpdateProcThreadAttribute(startUpInfoEx.lpAttributeList, 0, (IntPtr)0x20000, lpValueProc, (IntPtr)IntPtr.Size, IntPtr.Zero, IntPtr.Zero);

            //Start our process
            Console.WriteLine("Starting " + command);
            Win32.CreateProcess(command, null, IntPtr.Zero, IntPtr.Zero, true, 0x80010, IntPtr.Zero, null, ref startUpInfoEx, out processInfo);
        }

        class Win32
        {
            [DllImport("kernel32.dll")]
            [return: MarshalAs(UnmanagedType.Bool)]
            public static extern bool CreateProcess(string lpApplicationName, string lpCommandLine, IntPtr lpProcessAttributes, IntPtr lpThreadAttributes, bool bInheritHandles, uint dwCreationFlags, IntPtr lpEnvironment, string lpCurrentDirectory, [In] ref STARTUPINFOEX lpStartupInfo, out PROCESS_INFORMATION lpProcessInformation);

            [DllImport("kernel32.dll", SetLastError = true)]
            public static extern IntPtr OpenProcess(int processAccess, bool bInheritHandle, int processId);

            [DllImport("kernel32.dll", SetLastError = true)]
            [return: MarshalAs(UnmanagedType.Bool)]
            public static extern bool UpdateProcThreadAttribute(IntPtr lpAttributeList, uint dwFlags, IntPtr Attribute, IntPtr lpValue, IntPtr cbSize, IntPtr lpPreviousValue, IntPtr lpReturnSize);

            [DllImport("kernel32.dll", SetLastError = true)]
            [return: MarshalAs(UnmanagedType.Bool)]
            public static extern bool InitializeProcThreadAttributeList(IntPtr lpAttributeList, int dwAttributeCount, int dwFlags, ref IntPtr lpSize);

            [StructLayout(LayoutKind.Sequential)]
            internal struct PROCESS_INFORMATION
            {
                public IntPtr hProcess;
                public IntPtr hThread;
                public int dwProcessId;
                public int dwThreadId;
            }

            [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Ansi)]
            public struct STARTUPINFO
            {
                public Int32 cb;
                public IntPtr lpReserved;
                public IntPtr lpDesktop;
                public IntPtr lpTitle;
                public Int32 dwX;
                public Int32 dwY;
                public Int32 dwXSize;
                public Int32 dwYSize;
                public Int32 dwXCountChars;
                public Int32 dwYCountChars;
                public Int32 dwFillAttribute;
                public Int32 dwFlags;
                public Int16 wShowWindow;
                public Int16 cbReserved2;
                public IntPtr lpReserved2;
                public IntPtr hStdInput;
                public IntPtr hStdOutput;
                public IntPtr hStdError;
            }

            [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
            public struct STARTUPINFOEX
            {
                public STARTUPINFO StartupInfo;
                public IntPtr lpAttributeList;
            }
        }

    }
}

Detection

Whilst tools like process monitor may be fooled by alterations to the PROC_THREAD_ATTRIBUTE_PARENT_PROCESS attribute, the real parent PID value can still be determined using either via Kernel callbacks, or Event Tracing for Windows.

Using ProcMonXv2 which looks at ETW events, we can see that ppid_spoof.exe is actually the process spawning notepad.exe;

Related Posts

Malware Dev

LLVM Obfuscation

2024
bordergate
Malware Dev

Encoding Shellcode as IP Addresses

2024
bordergate
Malware Dev

Function Name Hashing

2024
bordergate
Malware Dev

Module Stomping

2024
bordergate