This innocent Windows 10 feature could be used to mask malware attacks
New Windows 10 LOLBin could bypass security and act as a ‘stealthy downloader’
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Researchers have discovered a new living-off-the-land binary (LOLBin) inWindows 10that could be exploited to concealmalwareattacks.
Numerous LOLBins are present inWindows 10, all of which serve a legitimate function. However, with the right privileges, hackers can abuse these binaries to bypass security facilities and conduct attacks without alerting the victim.
The new LOLBin (desktopimgdownldr.exe) was discovered by security firm SentinelOne and is usually responsible for the innocuous task of setting custom desktop and lockscreen backgrounds.
Found in the Windows 10 system32 folder, the binary can reportedly be used as a “stealthy downloader” - an alternative to widely known LOLBin certutil.exe.
Windows 10 malware
According to the SentinelOnereport, desktopimgdownldr.exe is deployed as part of Personalization CSP, which allows administrators to set and lock a user’s background image.
While the binary would traditionally override the existing desktop image (thereby notifying the user to its activation), a hacker could sidestep this red flag by deleting the registry immediately after running the binary. This way, a malicious file could be delivered onto the system undetected.
Although the binary is designed to be run by privileged users only, standard users can also abuse a particular function to run the LOLBin without administrator status.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Further, when triggered by a standard user, the executable fails to alter the background image (because the user lacks the necessary authorization), leaving behind no other artifacts than the downloaded file.
To mitigate against the threat posed, SentinelOne advises security professionals update their watchlists and treat the newly discovered LOLBin as they would the widely exploited alternative certutil.exe.
TechRadar Prohas asked the firm to clarify whether a non-business user is likely to be affected by an attack of this kind - and what they could to protect themselves.
Joel Khalili is the News and Features Editor at TechRadar Pro, covering cybersecurity, data privacy, cloud, AI, blockchain, internet infrastructure, 5G, data storage and computing. He’s responsible for curating our news content, as well as commissioning and producing features on the technologies that are transforming the way the world does business.
A new form of macOS malware is being used by devious North Korean hackers
Scammers are using fake copyright infringement claims to hack businesses
How to turn off Meta AI
