Analyzing Microsoft Zero-Day Exploit (CVE-2021-40444)

In this video we are looking at the brand new zero-day exploit for CVE-2021-40444, we understand the attack chain and deobfuscate some exploit code.

Samples:

00:00 Intro
00:46 Dynamic analysis
08:37 Static analysis
10:58 Deobfuscation
19:00 Analyzing exploit
22:52 Infection chain
27:45 Final payload
31:30 Summary

#cve-2021-40444 #zeroday #malware #infosec #reverseengineering

[itsnee]

Straight to the point, Awesome analysis!

[clipper]

Great analysis. Looking forward for more!

[mysteryhogs]

good explanation, nice audio quality and analysis sharing the Deobfuscation code and where to download the sample malware is cool as well! Information Sharing!

[garaldo]

Excellent work on simplifying the analysis!

[anandsinghdhouni]

Very Nicely Explained.. Thanks for Sharing Sir

[Ltbnary]

Omg. Please show us how you animate yourself in that south park style.

[_CryptoCat]

what an awesome demonstration, nicely done! 😻

[eagle]

Excellent! Could you do some more vid on zero-day exploits!

[duckie]

this is quality content :)
can you post some resource for reading about structure and rendering of docx files

[kanamung]

Holy Cr*p, how did you synchronize your ANIMATED mouth correctly to the SPEECH? (Sorry, the explanation of the attack chain is also good :) )

[roboedar]

Wow. Nice! Thank you. By the way, what do you use for making the talking avatar in your videos?

[dano]

Great video, how did you manage to compile file to call out?

[chhatrapalsinhzala]

Can you please show how to reproduce this ?

[xxehacker]

Sir please make a video on how to exploit Open port services using CVE 🙂.

[kwiuekf]

Sorry, I'm learning how to analyze cve now.
And I choose cve-2021-40444 as my first practice, but i have trouble with building environment.
I downloaded sample from you provided link above in my Win10 VM but I couldn't open .
It show me that I can't unzip this file.
Could you tell me how to do?
Thanks!!!!
Your video help me a lot!

[lakshmikumar]

Please can you share for payload generating?

[hakim]

Hi, thanks for the great video!
Can you please tell me how did you menage to make your ubuntu machine intercept the windows's box http connections, any blog, link or anything that may help is appreciated, thanks.

[jamiekomodo]

Was there something that was in the script to prevent you from commenting out the check function or even just the shift part of it?

[sharebt]

my boy have an Bulgarian or (Eastern European) accent :)

[youtubee]

why send and configure a payload like a reverse tcp when you can hidden with a crypter a simple trojan that works much better and have the full control of device?