Exploit / PoChigh
CVE-2015
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2015-1701 | Local Privilege Escalation in Microsoft Windows Win32k.sys Kernel-Mode Driver | — | 56% | KEVRansomware | — KEV |
| CVE-2015-2545 | Malformed EPS Image RCE in Microsoft Office | — | 86% | KEV | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | dnsnews.dns05.com | o the following C2s: newsupdate.dynssl.com (103.61.136.120) dnsnews.dns05.com (118.193.12.252) The connection: The two hosts are dynamic |
| domain | newsupdate.dynssl.com | hell via cmd.exe The malware connects to the following C2s: newsupdate.dynssl.com (103.61.136.120) dnsnews.dns05.com (118.193.12.252) The con |
| ipv4 | 103.61.136.120 | lware connects to the following C2s: newsupdate.dynssl.com (103.61.136.120) dnsnews.dns05.com (118.193.12.252) The connection: The two |
| ipv4 | 118.193.12.252 | : newsupdate.dynssl.com (103.61.136.120) dnsnews.dns05.com (118.193.12.252) The connection: The two hosts are dynamic DNS subdomains, |
| ipv4 | 191.96.111.195 | 201]) DSFSI 24 th February India’s 10 Top Luxury Hotels.doc 191.96.111.195 via mout.gmx.com ([74.208.4.201]) Chumapost 29 th February |
| ipv4 | 43.227.113.129 | ) Chumapost 29 th February India’s 10 Top Luxury Hotels.doc 43.227.113.129 via mout.gmx.com ([74.208.4.200]) In the case of the Indian |
| ipv4 | 59.188.13.204 | User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: 59.188.13.204:9080 Content-Length: 112 Connection: Keep-Alive Cache-Contr |
| ipv4 | 74.208.4.200 | embassy in Denmark 2 nd February HQ List.doc mout.gmx.com ([74.208.4.200]) Indian embassy in Colombia 2 nd February HQ List.doc mout |
| ipv4 | 74.208.4.201 | mbassy in Colombia 2 nd February HQ List.doc mout.gmx.com ([74.208.4.201]) DSFSI 24 th February India’s 10 Top Luxury Hotels.doc 191 |
| md5 | 8052234dcd41a7d619acb0ec9636be0b | ploit drops and executes the Trojan program “svcmondr.exe” (8052234dcd41a7d619acb0ec9636be0b). This queries the registry: “HKEY_USERSSoftwareMicrosoftWi |
| md5 | 8fc628c9f43d42e2b77c2801518af2a5 | this specific sample were not changed from default. Finds “8FC628C9F43D42E2B77C2801518AF2A5” substring and decrypts it using AES CTR mode thrice using |
| md5 | 98c57aa9c7e3f90c4eb4afeba8128484 | oc” and a malicious EPS file inside. “1-3說明檔.doc” This EPS (98c57aa9c7e3f90c4eb4afeba8128484) is exploit CVE-2015-2545 and contains an encrypted binary |
| md5 | a90a329335fa0af64d8394b28e0f86c1 | oth use the same CVE-2015-2545 EPS exploit (image1.eps, MD5 a90a329335fa0af64d8394b28e0f86c1). Interestingly, as can be seen in their metadata, both fil |
From the original article
13 min read at securelist.com
CVE-2015-2545 is a vulnerability discovered in 2015 and corrected with Microsoft’s update MS15-099. The vulnerability affects Microsoft Office versions 2007 SP3, 2010 SP2, 2013 SP1 and 2013 RT SP1. The error enables an attacker to execute arbitrary code using a specially crafted EPS image file.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.