Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 940588" data-attributes="member: 32260">Finally, I completed the POC by adding UAC bypass (but not for MAX UAC setting) based on autoelevation of Microsoft trusted executable. All known bypasses were patched by Microsoft recently or detected by Defender, so I did some research and modified one bypass discovered in the last year. The POC with UAC bypass worked well when initiated by the AutoIt script. The DLL hijacking was successful and then UAC was bypassed. Defender suspended the POC twice for 10 seconds to check the executables in the cloud, but in the end, the POC disabled Defender and executed the payload.Next, I compiled the AutoIt script and put all executables in one EXE installer (made by NSIS). After execution, the new executables were suspended for 10 seconds and behavior-based modules detected them in the cloud as Trojan:Win32/Fuerboos.B!cl and Trojan:Win32/Wacatac.B!ml.This example shows the difference between the home-made tests and in-the-wild samples.If I will have some time, then maybe&nbsp; I will try to replace the initial AutoIt script with BAT script.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" /></blockquote>

[QUOTE="Andy Ful, post: 940588, member: 32260"] Finally, I completed the POC by adding UAC bypass (but not for MAX UAC setting) based on autoelevation of Microsoft trusted executable. All known bypasses were patched by Microsoft recently or detected by Defender, so I did some research and modified one bypass discovered in the last year. The POC with UAC bypass worked well when initiated by the [COLOR=rgb(0, 168, 133)][B]AutoIt script[/B][/COLOR]. The DLL hijacking was successful and then UAC was bypassed. Defender suspended the POC twice for 10 seconds to check the executables in the cloud, but in the end, the POC disabled Defender and executed the payload. Next, I compiled the [B][COLOR=rgb(0, 168, 133)]AutoIt script[/COLOR][/B] and put all executables in [B][COLOR=rgb(0, 168, 133)]one EXE installer[/COLOR][/B] (made by NSIS). After execution, the new executables were suspended for 10 seconds and behavior-based modules detected them in the cloud as Trojan:Win32/Fuerboos.B!cl and Trojan:Win32/Wacatac.B!ml. This example shows the difference between the home-made tests and in-the-wild samples. If I will have some time, then maybe I will try to replace the initial AutoIt script with BAT script.(y) [/QUOTE]

Verification