Procedure examples

TrickBot used COM to setup scheduled task for persistence.

Bumblebee can use a COM object to execute queries to gather system information.

Ursnif droppers have used COM objects to execute the malware's full executable payload.

STATICPLUGIN has utilized Windows COM Installer Object to download an MSI package containing files masqueraded as a BMP file.

InvisiMole can use the ITaskService, ITaskDefinition and ITaskSettings COM interfaces to schedule a task.

CLAIMLOADER has leveraged Component Object Model (COM) objects to create a scheduled task using `ITaskService` interface.

Neoichor can use the Internet Explorer (IE) COM interface to connect and receive commands from C2.

Raspberry Robin creates an elevated COM object for CMLuaUtil and uses this to set a registry value that points to the malicious LNK file during execution.

RustyWater has used a WScript.Shell COM object to execute the CertificationKit.ini file.

DarkTortilla has used the `WshShortcut` COM object to create a .lnk shortcut file in the Windows startup folder.

Latrodectus can use the Windows Component Object Model (COM) to set scheduled tasks.

Milan can use a COM component to generate scheduled tasks.

Ramsay can use the Windows COM API to schedule tasks and maintain persistence.

FunnyDream can use com objects identified with `CLSID_ShellLink`(`IShellLink` and `IPersistFile`) and `WScript.Shell`(`RegWrite` method) to enable persistence mechanisms.

POWERSTATS can use DCOM (targeting the 127.0.0.1 loopback address) to execute additional payloads on compromised hosts.

Gelsemium can use the `IARPUinstallerStringLauncher` COM interface are part of its UAC bypass process.

HermeticWizard can execute files on remote machines using DCOM.

SILENTTRINITY can insert malicious shellcode into Excel.exe using a `Microsoft.Office.Interop` object.