Vulnerabilitycritical

UPS: Observations on CVE-2015-3113, Prior Zero

Palo Alto Unit 42by Richard WartellNov 1, 2018 · 09:48 UTC (Nov 1, 2018)12 min read3 · 1 read

Read at unit42.paloaltonetworks.com

Analyze CVE-2015-3113 with Vani AIImpact, affected versions, exploitation, mitigations and detection

CVEs: CVE-2015-3113 CVE-2014-1776 CVE-2014-6332

Tags: cve-2015-3113 cve-2014-1776 cve-2014-6332 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2014-1776	Use-After-Free Memory Corruption RCE in Microsoft Internet Explorer	—	83%	KEV	— KEV Jan 28, 2022
CVE-2014-6332	Remote Code Execution via Array Bounds Flaw in Microsoft Windows OLE Automation	—	95%	KEV	— KEV Mar 25, 2022
CVE-2015-3113	Heap-Based Buffer Overflow RCE in Adobe Flash Player	—	100%	KEV	— KEV Apr 13, 2022

Indicators of compromise

auto-extracted · verify before use · export allAll

Type	Indicator	Context
md5	1a4b710621ef2e69b1f7790ae9b7a288	8608343B177DF348657295578312EB49 ieupd.dll PE.DLL X86 86016 1A4B710621EF2E69B1F7790AE9B7A288 05:27:14 08:48:13 12AE4A7072C95EAE0E433570B1D563C3D39FE3239
md5	1b0e6ba299a522a3b3b02015a3536f6f	5333 {CVE-2015-3113 payload} (Pirpi.2015) PE.DLL X86 150528 1B0E6BA299A522A3B3B02015A3536F6F 06:07:15 01:51:27 0649A3DD632CDE57BC2E97B814BE81A7F45454FED
md5	4ca97ff9d72b422589266aa7b532d6e6	F03725BDDD1D59D0CD32D8EBAD81F IePorxyv.dll PE.DLL X86 81920 4CA97FF9D72B422589266AA7B532D6E6 04:29:14 00:32:43 4F677060D25A5E448BE986759FED5A325CD83F64D
md5	8849538ef1c3471640230605c2623c67	mpile Time SHA256 {FireEye Report Sample} PE.EXE X86 102400 8849538EF1C3471640230605C2623C67 09:25:14 09:09:59 854C6BA97B4BD01246AC6EF9258135D2337E69386
md5	b48e578f030a7b5bb93a3e9d6d1e2a83	pile Time SHA256 IePorxyv.dll (Pirpi.2014) PE.DLL X86 86016 B48E578F030A7B5BB93A3E9D6D1E2A83 04:29:14 00:44:04 81BD203EF3924BF497E8824ED5F224561487258FF
md5	f4884c0458176aac848a911683d3def5	FE3239816C04426C8E64A49BBE7D7 IePorxyv.dll PE.DLL X86 86016 F4884C0458176AAC848A911683D3DEF5 04:29:14 00:45:45 8C64D673CB84F76124FDBDC76941396647FF03725
md5	fa3578c2abe3f37ddda76ee40c5a1608	337E6938676421131B6793ABF339FA94 msupd.dll PE.DLL X86 81920 FA3578C2ABE3F37DDDA76EE40C5A1608 09:10:14 04:54:09 CE7ACAE4CDB53C2FB526624855FC8E008608343B1
sha256	0649a3dd632cde57bc2e97b814be81a7f45454fed2a73800de476aa75cdbe8cd	6 150528 1B0E6BA299A522A3B3B02015A3536F6F 06:07:15 01:51:27 0649A3DD632CDE57BC2E97B814BE81A7F45454FED2A73800DE476AA75CDBE8CD Table 1. File Details of Pirpi.2014 and Pirpi.2015 Samples
sha256	12ae4a7072c95eae0e433570b1d563c3d39fe3239816c04426c8e64a49bbe7d7	86 86016 1A4B710621EF2E69B1F7790AE9B7A288 05:27:14 08:48:13 12AE4A7072C95EAE0E433570B1D563C3D39FE3239816C04426C8E64A49BBE7D7 IePorxyv.dll PE.DLL X86 86016 F4884C0458176AAC848A911683D3D
sha256	4f677060d25a5e448be986759fed5a325cd83f64d9fef13fb51b18d1d0eb0f52	86 81920 4CA97FF9D72B422589266AA7B532D6E6 04:29:14 00:32:43 4F677060D25A5E448BE986759FED5A325CD83F64D9FEF13FB51B18D1D0EB0F52 Table 3. Details of Pirpi Samples from FireEye Reports and
sha256	81bd203ef3924bf497e8824ed5f224561487258ff3d8ee55f1e0907155fd5333	86 86016 B48E578F030A7B5BB93A3E9D6D1E2A83 04:29:14 00:44:04 81BD203EF3924BF497E8824ED5F224561487258FF3D8EE55F1E0907155FD5333 {CVE-2015-3113 payload} (Pirpi.2015) PE.DLL X86 150528 1B0E
sha256	854c6ba97b4bd01246ac6ef9258135d2337e6938676421131b6793abf339fa94	6 102400 8849538EF1C3471640230605C2623C67 09:25:14 09:09:59 854C6BA97B4BD01246AC6EF9258135D2337E6938676421131B6793ABF339FA94 msupd.dll PE.DLL X86 81920 FA3578C2ABE3F37DDDA76EE40C5A1608
sha256	8c64d673cb84f76124fdbdc76941396647ff03725bddd1d59d0cd32d8ebad81f	86 86016 F4884C0458176AAC848A911683D3DEF5 04:29:14 00:45:45 8C64D673CB84F76124FDBDC76941396647FF03725BDDD1D59D0CD32D8EBAD81F IePorxyv.dll PE.DLL X86 81920 4CA97FF9D72B422589266AA7B532D
sha256	ce7acae4cdb53c2fb526624855fc8e008608343b177df348657295578312eb49	86 81920 FA3578C2ABE3F37DDDA76EE40C5A1608 09:10:14 04:54:09 CE7ACAE4CDB53C2FB526624855FC8E008608343B177DF348657295578312EB49 ieupd.dll PE.DLL X86 86016 1A4B710621EF2E69B1F7790AE9B7A288

From the original article

12 min read at unit42.paloaltonetworks.com

A June 23 FireEye blog post titled “Operation Clandestine Wolf” discussed a cyber espionage group, known as APT3, that had been exploiting a zero-day vulnerability in Adobe Flash. Unit 42 also tracks the APT3 group using the name UPS, which is an intrusion set with Chinese origins that is known for having early access to zero-day vulnerabilities and delivering a backdoor called Pirpi.

Palo Alto Unit 42

By Richard Wartell · unit42.paloaltonetworks.com

Read the full article at Palo Alto Unit 42

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.