TrickBot Uses a New Windows 10 UAC Bypass to Launch Quietly

[silversurfer]

The TrickBot Trojan has switched to a new Windows 10 UAC bypass to execute itself with elevated privileges without showing a User Account Control prompt.
 
Windows uses a security mechanism called User Account Control (UAC) that will display a prompt every time a program is run with administrative privileges.
 
When these prompts are shown, they will ask logged in user if they wish to allow the program to makes changes, and if the program is suspicious or unrecognized, allows the user to prevent the program from running.

These UAC bypasses are found in legitimate Microsoft Windows programs that are used by the operating system to launch other programs. As they are not considered a high priority to Microsoft, it could be a while before discovered bypasses are fixed, if at all.
 
To avoid being detected, malware developers sometimes use a UAC bypass so that the malware runs with administrative privileges, but without displaying a UAC prompt and alerting the user.

Read more: https://www.bleepingcomputer.com/news/se...h-quietly/