There was vulnerability of RAR, and was used to extract malware to startup folder without user’s knowledge. The malware was distributed in pirate copy of “Ariana_Grande-thank_u,next(2019)[320].rar”
When a vulnerable version of WinRAR is used to extract the contents of this archive, a malicious program is extracted to Startup folder behind the scenes. User Access Control (UAC) is bypassed, so no alert is displayed to the user. The next time the system restarts, the malware (exe file) is run.
My question is, why is UAC bypassed and how it is possible? How is it possible when you use user account? Isn’t it Microsoft bug?
This is now what I asked about. I dont have this file. I am just asking here.
“User Access Control (UAC) is bypassed after the payload gets executed, so no alert is displayed to the user. The next time the system restarts, the malware is run.”