0

I've been seeing a few false positives from our AV Carbon Black pertaining to wordpad (wordpad.exe) use.

The alert I'd see is The application wordpad.exe injected code into another process. Upon doing some research, I didn't find anything malicious in the activity. In this case it was someone uploading a doc (confirmed by talking to user) to OneDrive.

However, we are getting a few of these false positives and I'd like to do away with them. Carbon Black has something called, Permissions. Essentially, if you say if wordpad.exe executes somewhere other than C:\Program Files\Windows NT\Accessories (this is where the .exe is located) then block it.

This doc states that if the .exe is run outside the actual path then it's bad. But can't it be bad as well if it's run from the actual path to mask itself as legitimate?

4
  • I removed the part about taking care of the false positive. My question still remains if wordpad.exe, executed from the actual path, can still be considered malicious or not.
    – Nina G
    Nov 30, 2021 at 21:40
  • Are you sure it's a false positive? The files under Program Files should all require administrator privileges to modify, so if it hasn't been modified then it will not be malicious.
    – user
    Nov 30, 2021 at 21:47
  • Seems to me like the question is, has your wordpad.exe been modified, or is your vendor's product buggy?
    – user10489
    Dec 1, 2021 at 0:00
  • I tried to further edit the question to make it not about a product's false positive, but I'm not sure what you actually want to know. Modified installed binaries can be malicious, yes.
    – schroeder
    Dec 1, 2021 at 11:18

1 Answer 1

2

Can they? Sure, there's nothing special (and it would take something quite special indeed) preventing malicious code from executing out of a specific directory. Trojan malware does this all the time; you run an installer "Setup_TaskbarKitten.exe" and it installs malware into your \Program Files directory, then runs it.

However, in the event that they do, your machine is already compromised. The reason is that the \Program Files directory is only writable by high-privilege accounts (Administrators and system maintenance accounts). There are a few locations in the file system with more restrictive access control by default, but it turns out that doesn't matter; Admin users (anybody with the privileges needed to write to \Program Files) can overwrite or ignore ACLs (access control lists) with only a little effort.

In other words, malware with the permissions necessary to drop a malicious file in \Program Files can easily gain enough privileges to completely take over the OS (or it has them already). Why replace the relatively obscure wordpad.exe file when you could instead replace a major OS component, such as a Windows Service binary that automatically runs with SYSTEM privileges every time the OS boots up?

Of course, you grant every "setup.exe" or similar program these necessary privileges every time you approve a UAC prompt... And sometimes even non-elevated programs can gain those permissions, if there's a local privilege escalation vulnerability on the machine (happens occasionally in first-party Microsoft software, happens all the <REDACTED> time in third-party software like drivers, support tools, and auto-updaters).


Since Wordpad in particular is a built-in application from Microsoft, the best bet for determining whether it's malicious is not to look at its location but at its digital signature. I don't know if your AV software can do that, though. The heuristic detection that the AV is using to flag it is behavior that is relatively uncommon in legitimate programs, but certainly not unheard of - tons of first-party Microsoft software does it, for example, including the built-in accessibility tools - although it is also definitely a common technique of malware.

2
  • Thank you. The doc thew me off because it suggested that as long as wordpad.exe was ran from its known location that it can't be malicious. From what you're saying, I should check the digital signature (hash) to determine if it's malicious. I guess my question is, wordpad.exe on my system has a specific SHA256 and is different for others on their system. How can you kill this false positive in this case? To me, it sounds like vainglory and the only way is to investigate on a case by case basis.
    – Nina G
    Dec 3, 2021 at 20:14
  • The problem with these tools is that they are trying to have in depth security. That's of course a good thing as well, but the chance of having false positives increases greatly if you start to suspect applications such as Word Pad. Yes, they could be hijacked, but if there is no indication of that, should you suspect code injection? May 1, 2022 at 12:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .