Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 938449" data-attributes="member: 32260">Because this thread was rather speculative, I created the POC. Unfortunately (but fortunately for users), Microsoft recently patched most of UAC bypasses on Windows 10 (also fodhelper and cleanmgr), so I could not prepare the POC with UAC bypass. If one knows a working UAC bypass then please send me one and then I will create the new POC. I am not sure if the modified POCmight work because UAC bypass can make it more suspicious and can trigger Defender actions.The POC should be downloaded from email or URL, unpacked, and executed. The user has to allow elevation. It fully disables Defender on default settings and runs payload which is hidden in a password-protected archive (password is hardcoded). In my POC the payload file is named pld.exe (renamed powershell.exe). Defender cannot check this payload on access and the payload is run after deactivating Defender.In the POC folder, the Defender Control is included (dc.exe file with hidden attribute), so one can easily enable Defender.Please let me know If someone from MalwareHub wants to try this POC. After few days I will submit it to Microsoft.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" /></blockquote>

[QUOTE="Andy Ful, post: 938449, member: 32260"] Because this thread was rather speculative, I created the POC. Unfortunately (but fortunately for users), Microsoft recently patched most of UAC bypasses on Windows 10 (also fodhelper and cleanmgr), so I could not prepare the POC with UAC bypass. If one knows a working UAC bypass then please send me one and then I will create the new POC. I am not sure if the modified POCmight work because UAC bypass can make it more suspicious and can trigger Defender actions. The POC should be downloaded from email or URL, unpacked, and executed. The user has to allow elevation. It fully disables Defender on default settings and runs payload which is hidden in a password-protected archive (password is hardcoded). In my POC the payload file is named pld.exe (renamed powershell.exe). Defender cannot check this payload on access and the payload is run after deactivating Defender. In the POC folder, the Defender Control is included (dc.exe file with hidden attribute), so one can easily enable Defender. Please let me know If someone from MalwareHub wants to try this POC. After few days I will submit it to Microsoft.(y) [/QUOTE]

Verification