Hackers abuse Windows error reporting tool to deploy malware
Hackers are abusing the Windows Problem Reporting (WerFault.exe) error reporting tool for Windows to load malware into a compromised system's memory using a DLL sideloading technique . The use of this Windows executable is to stealthy infect devices without raising any alarms on the breached system by launching the malware through a legitimate Windows executable . The new campaign was spotted by K7 Security Labs , which could not identify the hackers , but they are believed to be based in China . Abusing WerFault.exe The malware campaign starts with the arrival of an email with an ISO attachment . When double-clicked , the ISO will mount itself as a new drive letter containing a legitimate copy of the Windows WerFault.exe executable, a DLL file ('faultrep.dll') , an XLS file ('File.xls') , and a shortcut file ('inventory & our specialties.lnk') . The victim starts the infection chain by clicking on the shortcut file , which uses 'scr...
