ESET InvisiMole
web-assets.esetstatic.com · Undated · Licence: not cleared; local research copy only
CVEs this report names
3 CVEs- CVE-2017-0144Microsoft SMBv1 Remote Code Execution VulnerabilityMicrosoft · SMBv1KEVRansomwarePublic exploitHigh · 8.8T1059Command and Scripting InterpreterT1210Exploitation of Remote Services3 reports99.2%Top 0.06%86.9priority
- CVE-2019-0708Microsoft Remote Desktop Services Remote Code Execution VulnerabilityMicrosoft · Remote Desktop ServicesKEVRansomwarePublic exploitCritical · 9.8T1133External Remote ServicesT1498Network Denial of Service2 reports>99.9%Top 0.01%86.0priority
- CVE-2007-5633Speedfan.sys in Alfredo Milani Comparetti SpeedFan 4.33, when used on Microsoft Windows Vista x64, allows local users…Public exploit1 report0.9%Top 39%58.3priority
Where it names them
CVE-2017-0144 Original (opens in a new tab) ↗
CVE-2017-0144, respectively) to spread within the network and deploy InvisiMole’s backdoors or downloaders.
CVE-2019-0708 Original (opens in a new tab) ↗
We have observed InvisiMole using the BlueKeep and EternalBlue vulnerabilities (CVE-2019-0708 and
CVE-2007-5633 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
WHITE 6.3 Speedfan exploit chain In the Speedfan exploit execution chain, InvisiMole uses the Bring Your Own Vulnerable Driver technique to load the speedfan.sys driver on the compromised system, and then exploit local privilege escalation vulnerability (CVE-2007-5633) to gain code execution in kernel
InvisiMole has exploited CVE-2007-5633 vulnerability in
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.