Exploit / PoCcritical
Internet Explorer and Windows zero
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2018-8653 | Memory Corruption RCE in Microsoft Internet Explorer Scripting Engine | 7.5 | 30% | KEV | KEV |
| CVE-2019-0676 | Information Disclosure in Microsoft Internet Explorer via Improper Memory Handling | 6.5 | 8% | KEV | KEV |
| CVE-2019-1429 | Memory corruption RCE in Microsoft Internet Explorer scripting engine | 7.5 | 77% | KEVPoC | KEV |
| CVE-2020-0674 | Use-After-Free RCE in Microsoft Internet Explorer Scripting Engine | 7.5 | 87% | KEVPoC ×4 | KEV |
| CVE-2020-0986 | Windows Kernel Out-of-Bounds Write Enables Local Privilege Escalation (CVE-2020-0986) | 7.8 | 16% | KEV | KEV |
| CVE-2020-1380 | Memory Corruption RCE in Microsoft Internet Explorer Scripting Engine | 7.8 | 24% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | www.static-cdn1.com | ed PowerShell command that proceeds to download a file from www[.]static-cdn1[.]com/update.zip, saves it to the temporary folder as upgrade |
| md5 | 5877eaeca1fe8a3a15d6c8c5d7fa240b | 2CFFC18194107CC5BF76AECA7E87E9082FED64A535722AD4502A4D51199 5877EAECA1FE8A3A15D6C8C5D7FA240B 7577E42177ED7FC811DE4BC854EC226EB037F797C3B114E163940A86FD8 |
| md5 | b06f1f2d3c016d13307bc7ce47c90594 | ble was downloaded. IoCs www[.]static-cdn1[.]com/update.zip B06F1F2D3C016D13307BC7CE47C90594 D02632CFFC18194107CC5BF76AECA7E87E9082FED64A535722AD4502A4D |
| md5 | b72731b699922608ff3844ccc8fc36b4 | 42177ED7FC811DE4BC854EC226EB037F797C3B114E163940A86FD8B078B B72731B699922608FF3844CCC8FC36B4 7765F836D2D049127A25376165B1AC43CD109D8B9D8C5396B8DA91ADC61 |
| md5 | e01254d7af1d044e555032e1f78ff38f | 836D2D049127A25376165B1AC43CD109D8B9D8C5396B8DA91ADC61ECCB1 E01254D7AF1D044E555032E1F78FF38F 81D07CAE45CAF27CBB9A1717B08B3AB358B647397F08A6F9C7652D00DBF |
| sha256 | 7577e42177ed7fc811de4bc854ec226eb037f797c3b114e163940a86fd8b078b | FED64A535722AD4502A4D51199 5877EAECA1FE8A3A15D6C8C5D7FA240B 7577E42177ED7FC811DE4BC854EC226EB037F797C3B114E163940A86FD8B078B B72731B699922608FF3844CCC8FC36B4 7765F836D2D049127A25376165 |
| sha256 | 7765f836d2d049127a25376165b1ac43cd109d8b9d8c5396b8da91adc61eccb1 | 97C3B114E163940A86FD8B078B B72731B699922608FF3844CCC8FC36B4 7765F836D2D049127A25376165B1AC43CD109D8B9D8C5396B8DA91ADC61ECCB1 E01254D7AF1D044E555032E1F78FF38F 81D07CAE45CAF27CBB9A1717B0 |
| sha256 | 81d07cae45caf27cbb9a1717b08b3ab358b647397f08a6f9c7652d00dbf2ae24 | 8B9D8C5396B8DA91ADC61ECCB1 E01254D7AF1D044E555032E1F78FF38F 81D07CAE45CAF27CBB9A1717B08B3AB358B647397F08A6F9C7652D00DBF2AE24 |
| sha256 | d02632cffc18194107cc5bf76aeca7e87e9082fed64a535722ad4502a4d51199 | atic-cdn1[.]com/update.zip B06F1F2D3C016D13307BC7CE47C90594 D02632CFFC18194107CC5BF76AECA7E87E9082FED64A535722AD4502A4D51199 5877EAECA1FE8A3A15D6C8C5D7FA240B 7577E42177ED7FC811DE4BC854 |
From the original article
12 min read at securelist.com
In May 2020, Kaspersky technologies prevented an attack on a South Korean company by a malicious script for Internet Explorer. Closer analysis revealed that the attack used a previously unknown full chain that consisted of two zero-day exploits: a remote code execution exploit for Internet Explorer and an elevation of privilege exploit for Windows.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.