• Hi there and welcome to PC Help Forum (PCHF), a more effective way to get the Tech Support you need!
    We have Experts in all areas of Tech, including Malware Removal, Crash Fixing and BSOD's , Microsoft Windows, Computer DIY and PC Hardware, Networking, Gaming, Tablets and iPads, General and Specific Software Support and so much more.

    Why not Click Here To Sign Up and start enjoying great FREE Tech Support.

    This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

This innocent Windows 10 feature could be used to mask malware attacks


PCHF Tech News
Jan 10, 2015
Researchers have discovered a new living-off-the-land binary (LOLBin) in Windows 10 that could be exploited to conceal malware attacks.

Numerous LOLBins are present in Windows 10, all of which serve a legitimate function. However, with the right privileges, hackers can abuse these binaries to bypass security facilities and conduct attacks without alerting the victim.

The new LOLBin (desktopimgdownldr.exe) was discovered by security firm SentinelOne and is usually responsible for the innocuous task of setting custom desktop and lockscreen backgrounds.

Found in the Windows 10 system32 folder, the binary can reportedly be used as a “stealthy downloader” - an alternative to widely known LOLBin certutil.exe.

Windows 10 malware

According to the SentinelOne report, desktopimgdownldr.exe is deployed as part of Personalization CSP, which allows administrators to set and lock a user’s background image.

While the binary would traditionally override the existing desktop image (thereby notifying the user to its activation), a hacker could sidestep this red flag by deleting the registry immediately after running the binary. This way, a malicious file could be delivered onto the system undetected.

Although the binary is designed to be run by privileged users only, standard users can also abuse a particular function to run the LOLBin without administrator status.

Further, when triggered by a standard user, the executable fails to alter the background image (because the user lacks the necessary authorization), leaving behind no other artifacts than the downloaded file.

To mitigate against the threat posed, SentinelOne advises security professionals update their watchlists and treat the newly discovered LOLBin as they would the widely exploited alternative certutil.exe.

TechRadar Pro has asked the firm to clarify whether a non-business user is likely to be affected by an attack of this kind - and what they could to protect themselves.

Continue reading...