Hackers Replace Windows Narrator to Get SYSTEM Level Access

guest · Sep 25, 2019

Hackers Replace Windows Narrator to Get SYSTEM Level Access
September 25, 2019
https://www.bleepingcomputer.com/ne...-windows-narrator-to-get-system-level-access/

Chinese hackers are replacing the legitimate Narrator app on targeted Windows systems with a trojanized version that gives them remote access with privileges of the most powerful account on the operating system.
Adversaries already on the system can modify them to spawn a Command Prompt (cmd.exe) window with elevated permissions on the remote desktop login screen.
New approach for old technique
While this type of attack is not new, the Chinese hackers have a new approach, security researchers from BlackBerry Cylance say in a report today.

In this attack, though, the fake Narrator takes the place of the legitimate program and launches it with a hidden overlapped window that waits for specific key combinations to be entered.

"When the correct passphrase has been typed the malware will display a dialog that allows the attacker to specify the path to a file to execute." - Cylance
Click to expand...

Getting initial access
To get the fake Narrator running on the remote desktop login screen the hackers first compromise the system with a custom version of the open-source PcShare backdoor.

They rely on DLL side-loading, memory injection, and misdirection tactics to ensure a stealthy operation.
Getting the backdoor on the target system is done with the help of the legitimate “NVIDIA Smart Maximise Helper Host” application, which is part of the NVIDIA graphics drivers.
Click to expand...

Cylance: PcShare Backdoor Attacks Targeting Windows Users with FakeNarrator Malware

Log in or Sign up

Hackers Replace Windows Narrator to Get SYSTEM Level Access

guest Guest

Log in or Sign up

Hackers Replace Windows Narrator to Get SYSTEM Level Access

guest Guest

Useful Searches