⁨‌ㅤ⁩

The video demonstrates a UAC bypass technique used in the "Fickle Stealer" malware campaign, where attackers exploit Windows path parsing to evade user consent prompts. The technique involves creating fake directories with trailing spaces and abusing the WMI Management Console (MMC) to execute malicious payloads without UAC approval. 0:49

Key Takeaways:
• The attack uses a "mock trusted directories" method by creating fake paths like C:\Windows (with trailing space) to trick Windows into treating the file as trusted 1:57.
• A fake WMI Management MMC file with an ActiveX control is used to open a local web server (HTTP 8080), which then downloads and configures the Fickle Stealer 7:04.
• The technique relies on Windows' path parsing behavior, where trailing spaces are trimmed, leading to the real C:\Windows\System32\WmiManagement.msc being bypassed 10:11.
• However, modern Windows updates (October 2023 patches) block execution from UNC-like paths (e.g., \\?\C:\Windows ), rendering the bypass ineffective 17:25.

Despite a detailed recreation, the UAC bypass fails due to Windows security patches that prevent execution from untrusted network paths, indicating the method is no longer viable in current environments. 19:35

Sources:

• 0:49 Overview of Fickle Stealer and its attack chain.
• 1:57 Description of the mock trusted directories method.
• 7:04 Explanation of the fake MMC file and HTTP server setup.
• 10:11(https://www.youtube.com/watch?v=OMTLsslHSN0&t=611