Traps Prevents In-The-Wild VBScript Zero
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2018-8174 | Out-of-Bounds Write RCE in Microsoft Windows VBScript Engine | 7.5 | 88% | KEVRansomwarePoC ×2 | KEV |
| CVE-2018-8373 | Memory Corruption RCE in Microsoft Internet Explorer Scripting Engine | 7.5 | 62% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | windows-updater.net | ied. The exploit was served on a malicious web host: hxxp://windows-updater[.]net/realmuto/wood.php?who=1?????? which was linked to the Dar |
| url | http://windows-updater.net/dragon/config-donkey.php?inst=xxx&name=yyy | ation and downloads a secondary payload from the same host: hxxp://windows-updater[.]net/dragon/config-donkey.php?inst=xxx&name=yyy (9), decodes it and reflectively loads it (10). We were n |
| url | http://windows-updater.net/realmuto/wood.php?var=xxx&name=dr.john&q=yyy&d=z | an initial payload (DLL) from the same malicious web host ( hxxp://windows-updater[.]net/realmuto/wood.php?var=xxx&name=dr.john&q=yyy&d=z ) to a temporary file (3), decode it to another temporary |
| url | http://windows-updater.net/realmuto/wood.php?who=1?????? | es applied. The exploit was served on a malicious web host: hxxp://windows-updater[.]net/realmuto/wood.php?who=1?????? which was linked to the DarkHotel APT campaign by Qihoo 3 |
From the original article
2 min read at unit42.paloaltonetworks.com
On August 15, Trend Micro published a blog post detailing a high-risk vulnerability in the VBScript Engine of Microsoft Internet Explorer being exploited in-the-wild ( CVE-2018-8373 ). This vulnerability still affects endpoints running the latest versions of Internet Explorer and Windows which do not have the relevant patches applied. The exploit was served on a malicious web host: hxxp://windows-updater[.]
By Tomer Harpaz, Maor Dokhanian · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.