Exploit / PoCcritical
MysterySnail attacks with Windows zero
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2016-3309 | Privilege Escalation in Microsoft Windows Kernel (CVE-2016-3309) | 7.8 | 20% | KEVRansomware | KEV |
| CVE-2021-40449 | Use-After-Free Local Privilege Escalation in Microsoft Windows Win32k | 7.8 | 82% | KEVRansomwarePoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | http.ddspadus.com | sed; the real C2 address is decoded by a single byte xor – “http[.]ddspadus[.]com”. The malware enumerates the values under the “Software |
| domain | www.disktest.com | The sample has two hardcoded URLs present in plain text – “www[.]disktest[.]com” and “www[.]runblerx[.]com”. They are put into class va |
| domain | www.runblerx.com | ed URLs present in plain text – “www[.]disktest[.]com” and “www[.]runblerx[.]com”. They are put into class variables for intended use, b |
| md5 | e2f2d2832da0facbd716d6ad298073ca | sktest[.]com www[.]runblerx[.]com http[.]ddspadus[.]com MD5 e2f2d2832da0facbd716d6ad298073ca SHA1 ecdec44d3ce31532d9831b139ea04bf48cde9090 SHA256 b7fb36 |
| sha1 | ecdec44d3ce31532d9831b139ea04bf48cde9090 | [.]ddspadus[.]com MD5 e2f2d2832da0facbd716d6ad298073ca SHA1 ecdec44d3ce31532d9831b139ea04bf48cde9090 SHA256 b7fb3623e31fb36fc3d3a4d99829e42910cad4da4fa7429a2d99 |
| sha256 | b7fb3623e31fb36fc3d3a4d99829e42910cad4da4fa7429a2d99a838e004366e | 8073ca SHA1 ecdec44d3ce31532d9831b139ea04bf48cde9090 SHA256 b7fb3623e31fb36fc3d3a4d99829e42910cad4da4fa7429a2d99a838e004366e |
From the original article
7 min read at securelist.com
In late August and early September 2021, Kaspersky technologies detected attacks with the use of an elevation of privilege exploit on multiple Microsoft Windows servers. The exploit had numerous debug strings from an older, publicly known exploit for vulnerability CVE-2016-3309 , but closer analysis revealed that it was a zero-day.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.