Last week, we reported our Preliminary analysis of Internet Explorer Zero Day Exploit targeting CVE-2014-0322.
This article is a continuation of our analysis.
We also have a detailed writeup on Malware analysis of dropped Binaries.
In the SWF de-compilation below, we can see another file, Erido.jpg downloaded which contains bytes that are used to drop malware after successfully exploiting the Vulnerability.
Here is the crash point which shows mshtml.dll,
The following sequence of functions is called in the context of IE which shows Exploit is successful.
Sqlrenew.txt dropped in Temp Folder
Stream.exe dropped in Temp Folder
The control shows to be executed from 0x1a1bXXXX address range and multiple WriteFile calls do respective file write operations.
We can see below that the module sqlrevew.txt is loaded. When the user exits IE, stream.exe is spawned as a Process.
Following is our Detection Coverage.
- IPS:6315 HTTP Client Shellcode Exploit 11a
- IPS:7454 HTTP Client Shellcode Exploit 35a
- GAV: CVE-2014-0322#swf (Exploit)
- GAV: CVE-2014-0322#html (Exploit)