Internet Explorer Zero Day Exploit Analysis

February 21, 2014

Last week, we reported our Preliminary analysis of Internet Explorer Zero Day Exploit targeting CVE-2014-0322.
This article is a continuation of our analysis.
We also have a detailed writeup on Malware analysis of dropped Binaries.

Attack Flow

In the SWF de-compilation below, we can see another file, Erido.jpg downloaded which contains bytes that are used to drop malware after successfully exploiting the Vulnerability.

Here is the crash point which shows mshtml.dll,

The following sequence of functions is called in the context of IE which shows Exploit is successful.

Sqlrenew.txt dropped in Temp Folder

Stream.exe dropped in Temp Folder

The control shows to be executed from 0x1a1bXXXX address range and multiple WriteFile calls do respective file write operations.

We can see below that the module sqlrevew.txt is loaded. When the user exits IE, stream.exe is spawned as a Process.

Following is our Detection Coverage.

  • IPS:6315 HTTP Client Shellcode Exploit 11a
  • IPS:7454 HTTP Client Shellcode Exploit 35a
  • GAV: CVE-2014-0322#swf (Exploit)
  • GAV: CVE-2014-0322#html (Exploit)