![]() ![]() WinRAR users should immediately update to the latest version.As quotes are removed from the end of the path, ShellExecuteExW executes “simple_image.jpg.It “ Removes quotes from the beginning and end of a path.” When we dig deep, we find that later, it calls PathUnquoteSpacesA API call, as per MSDN.In this case, an incorrect parameter is passed to the ShellExecuteExW function as the parameter contains a trailing space, and such a file does not exist on the disk.In this case, the correct parameter is passed to the ShellExecuteExW function as the file exists at this exact path.When we double-click on the image file, we can see the debugger is opened, and after a few clicks, we hit our breakpoint.We put a breakpoint on the ShellExecuteExW function to see what parameters are passed to it just after clicking the jpeg file.When we execute the rar file, we see the debugger getting attached to the winrar process so that we can do just-in-time debugging.To see what’s happening under the hood, we hook a debugger and launch WinRAR by manipulating the “image file Execution options” registry key.In Logs, when we dig deep, we can see Winrar searches for our filename with an *, which causes it to iterate over our bat file as it has the same name, which in turn gets executed.This is due to the same file names we have given, which makes WinRAR extract those in temp. In the case of a regular zip, only the clean image file is extracted to the temp folder, whereas in the case of a weaponized zip, even the files present inside the folder are extracted to the temp folder along with the clean image file. The above image shows that the first logical bug is how WinRAR is extracting files in the temp folder before executing them.We will compare how WinRAR behaves when we execute an image file from a weaponized zip vs.Here, we will analyze the issue causing WinRAR to execute the script instead of opening the image.Global Heatmap where this vulnerability is being seen in the wild( based on McAfee telemetry data) We can see successful tcp connection to threat actors C2.( ip 37120158229).AMD.exe Calls rundll32 on the clsid that is registered in the registry.Timeout is also called to slow down the activities of the infection chain.Here, we observe AMD.exe calls reg.exe on registry keys inside add.txt.AMD.exe extracts the encrypted dll file inside pc.txt and writes it in the romaing\nvidia folder.The default value of the InprocServer32 key is populated with the path to a malicious DLL named “Core.ocx”. As a result, a specific COM object with a unique CLSID is registered in the infected system. During registration, registry keys are imported from the “add.txt” file. The first control is responsible for registering a COM object in Windows.Inside add.txt, we find the registry keys it will try to manipulate.AMD.exe is a visual basic compiled file whose main job is to extract the dll hidden in a blob of data inside pc.txt and execute the ActiveX controls.We found a PE file, some ActiveX control objects, and two text files.Checking we find that it is a CAB SFX file.When we check the script, we see it launches cmd in the minimized state, then goes to the temp folder where WinRAR will extract the files, then tries to find the file, which is present inside the folder and executes it using wmic and then exits.The bat file also has the same name as the benign file outside the folder.When we look inside the folder, we see many files, but the most important file is highlighted, which is a bat file containing a malicious script.Also, note there is a trailing space at the end of the file and folder name (in yellow).This shows that it was weaponized after creating a regular zip by changing the bytes to make the file and folder name the same.This is interesting as Windows doesn’t allow files and folders to have the same name in the same path.We can also see that the threat actor can craft the archive so that folder and file names are the same.The image below shows that the archive is named trading_system, which hints that it is used to target traders.Our intelligence shows that this vulnerability is being exploited as early as April 2023. JPG file) and also a folder that has the same name as the harmless file, and the contents of the folder (which may include executable content) are processed during an attempt to access only the benign file. The issue occurs because a ZIP archive may include a benign file (such as an ordinary. It is related to an RCE vulnerability in WinRAR before version 6.23. On 23 August 2023, NIST disclosed a critical RCE vulnerability CVE-2023-38831.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |