Internet Explorer Zero Day(CVE-2014-0322) Exploit Analysis (Feb 21, 2014)

Last week, we reported our Preliminary analysis of Internet Explorer Zero Day Exploit targeting CVE-2014-0322.
This article is a continuation of our analysis.
We also have a detailed writeup on Malware analysis of dropped Binaries.

Attack Flow

In the SWF de-compilation below, we can see another file, Erido.jpg downloaded which contains bytes that are used to drop malware after successfully exploiting the Vulnerability.

Here is the crash point which shows mshtml.dll,

The following sequence of functions is called in the context of IE which shows Exploit is successful.

Sqlrenew.txt dropped in Temp Folder

Stream.exe dropped in Temp Folder

The control shows to be executed from 0x1a1bXXXX address range and multiple WriteFile calls do respective file write operations.

We can see below that the module sqlrevew.txt is loaded. When the user exits IE, stream.exe is spawned as a Process.

Following is our Detection Coverage.

• IPS:6315 HTTP Client Shellcode Exploit 11a
• IPS:7454 HTTP Client Shellcode Exploit 35a
• GAV: CVE-2014-0322#swf (Exploit)
• GAV: CVE-2014-0322#html (Exploit)

Security News

The SonicWall Capture Labs Threat Research Team gathers, analyzes and vets cross-vector threat information from the SonicWall Capture Threat network, consisting of global devices and resources, including more than 1 million security sensors in nearly 200 countries and territories. The research team identifies, analyzes, and mitigates critical vulnerabilities and malware daily through in-depth research, which drives protection for all SonicWall customers. In addition to safeguarding networks globally, the research team supports the larger threat intelligence community by releasing weekly deep technical analyses of the most critical threats to small businesses, providing critical knowledge that defenders need to protect their networks.