This innocent Windows 10 feature could be used to mask malware attacks
Researchers have discovered a new living-off-the-land binary (LOLBin) in Windows 10 that could be exploited to conceal malware attacks.
Numerous LOLBins are present in Windows 10, all of which serve a legitimate function. However, with the right privileges, hackers can abuse these binaries to bypass security facilities and conduct attacks without alerting the victim.
The new LOLBin (desktopimgdownldr.exe) was discovered by security firm SentinelOne and is usually responsible for the innocuous task of setting custom desktop and lockscreen backgrounds.
Found in the Windows 10 system32 folder, the binary can reportedly be used as a “stealthy downloader” – an alternative to widely known LOLBin certutil.exe.
Windows 10 malware
According to the SentinelOne report, desktopimgdownldr.exe is deployed as part of Personalization CSP, which allows administrators to set and lock a user’s background image.
While the binary would traditionally override the existing desktop image (thereby notifying the user to its activation), a hacker could sidestep this red flag by deleting the registry immediately after running the binary. This way, a malicious file could be delivered onto the system undetected.
Although the binary is designed to be run by privileged users only, standard users can also abuse a particular function to run the LOLBin without administrator status.
Further, when triggered by a standard user, the executable fails to alter the background image (because the user lacks the necessary authorization), leaving behind no other artifacts than the downloaded file.
To mitigate against the threat posed, SentinelOne advises security professionals update their watchlists and treat the newly discovered LOLBin as they would the widely exploited alternative certutil.exe.
TechRadar Pro has asked the firm to clarify whether a non-business user is likely to be affected by an attack of this kind – and what they could to protect themselves.