Exploit / PoCcritical
PuzzleMaker attacks with Chrome zero
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2021-21224+1 related CVE | Type Confusion RCE in Google Chrome/Chromium V8 JavaScript Engine | 8.8 | 84% | KEVPoC | KEV |
CVE-2021-31956+1 related CVE | Local Privilege Escalation via Out-of-Bounds Write in Microsoft Windows NTFS | 7.8 group max | 22% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | media-seoengine.com | shell module has a hardcoded URL of the C&C server inside (media-seoengine[.]com). All the communication between C&C server and client is |
| md5 | 09a5055db44fc1c9e3add608efff038c | ches. IoCs media-seoengine[.]com %SYSTEM%\WmiPrvMon.exe MD5 09A5055DB44FC1C9E3ADD608EFFF038C SHA-1 BFFA4462901B74DBFBFFAA3A3DB27DAA61211412 SHA-256 982F |
| md5 | d6b850c950379d5ee0f254f7164833e8 | 47C392B20C760FE36B200B541A0F841C8A9 %SYSTEM%\wmimon.dll MD5 D6B850C950379D5EE0F254F7164833E8 SHA-1 E63ED3B56A5F9A1EA5C92D3D2444196EA13BE94B SHA-256 8A17 |
| sha1 | bffa4462901b74dbfbffaa3a3db27daa61211412 | M%\WmiPrvMon.exe MD5 09A5055DB44FC1C9E3ADD608EFFF038C SHA-1 BFFA4462901B74DBFBFFAA3A3DB27DAA61211412 SHA-256 982F7C4700C75B81833D5D59AD29147C392B20C760FE36B200B |
| sha1 | e63ed3b56a5f9a1ea5c92d3d2444196ea13be94b | STEM%\wmimon.dll MD5 D6B850C950379D5EE0F254F7164833E8 SHA-1 E63ED3B56A5F9A1EA5C92D3D2444196EA13BE94B SHA-256 8A17279BA26C8FBE6966EA3300FDEFB1ADAE1B3ED68F76A7FC8 |
| sha256 | 8a17279ba26c8fbe6966ea3300fdefb1adae1b3ed68f76a7fc81413bd8c1a5f6 | 33E8 SHA-1 E63ED3B56A5F9A1EA5C92D3D2444196EA13BE94B SHA-256 8A17279BA26C8FBE6966EA3300FDEFB1ADAE1B3ED68F76A7FC81413BD8C1A5F6 |
| sha256 | 982f7c4700c75b81833d5d59ad29147c392b20c760fe36b200b541a0f841c8a9 | 038C SHA-1 BFFA4462901B74DBFBFFAA3A3DB27DAA61211412 SHA-256 982F7C4700C75B81833D5D59AD29147C392B20C760FE36B200B541A0F841C8A9 %SYSTEM%\wmimon.dll MD5 D6B850C950379D5EE0F254F7164833E8 SH |
| url | https://p{removed}/metrika_upload/index.php | overed so far were configured to use the same URL address – hxxps://p{removed}/metrika_upload/index.php – to download the encrypted malware dropper module. We beli |
From the original article
7 min read at securelist.com
On April 14-15, 2021, Kaspersky technologies detected a wave of highly targeted attacks against multiple companies. Closer analysis revealed that all these attacks exploited a chain of Google Chrome and Microsoft Windows zero-day exploits.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.