Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Script-Based Malware: A New Attacker Trend on Internet Explorer

Summary: Unit 42 documented two script-based malware samples delivered through the same Internet Explorer exploit of CVE-2019-0752, a Scripting Engine Memory Corruption Vulnerability patched in April 2019 that allows remote code execution. The first, a JScript RAT downloaded from assurancetemporaireenligne[.]com on April 18, writes an encoded loader.jse into the AppData folder and a Run registry key for persistence, then connects to seemee[.]ddns[.]net to pull commands; the second, an AutoIT downloader observed April 30, 2020 from dark[.]crypterfile[.]com, checks for at least four logical processors before downloading and executing files.

What's compelling: The JScript RAT gives the attacker a cmd.php panel to execute commands, download files, reboot, or shut down the Windows host, and the loader deletes itself after dropping its encoded payload in a hidden folder, leaving little behind for responders to find.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Mentions
CVE-2019-0752
Related
CVE-2019-0752: Microsoft Internet Explorer Type Confusion Vulnerability Known Exploited Vulnerabilities · Feb 15, 2022