From Slashdot

MS Word Zero-Day Exploit Found

Posted by Zonk on Friday May 19, @02:37PM
from the don't-do-any-work-today dept.
subbers writes "A zero-day flaw in Microsoft Word program is being used in an active exploit by sophisticated hackers in China and Taiwan, according to warnings from anti-virus researchers. The exploit arrives as an ordinary Microsoft Word document attachment to an e-mail and drops a backdoor with rootkit features when the document is opened and the previously unknown vulnerability is triggered. From the article: 'The e-mail was written to look like an internal e-mail, including signature. It was addressed by name to the intended victim and not detected by the anti-virus software.'"
Slashdot Link: http://it.slashdot.org/it/06/05/19/1718203.shtml

Also in ISC:

ISC Link: http://isc.sans.org/diary.php?storyid=1346

Annnd from FSecure (from the ISC text):

Summary

Ginwui is a fully-featured backdoor with rootkit features. This backdoor was distributed inside a document file with a shell-code that dropped the backdoor's file to a hard drive and activated it.

Detailed Description

The shell-code in the Word document decrypts and drops the backdoor's file as CSRSE.EXE to the temporary folder and activates it.

After being run the dropped file in its turn extracts and drops another file to a system. This file is dropped as WINGUIS.DLL to Windows System folder and its DoHook function is activated by the dropper. The dropper then deletes itself from a system.

The dropped DLL file is the main backdoor component. It traps several functions and modifies information that is passed to a user. As a result the backdoor's file, startup key in the Registry and process are not visible to a user.

The backdoor creates a startup key for its file in the Registry:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs" = "%WinSysDir%\winguis.dll"

where %WinSysDir% represents Windows System folder which by default has the C:\Windows\System32\ name.

Being active the backdoor connects to specified address in order to receive commands from a hacker. The backdoor allows a hacker to do any of the following on an infected computer:

-> create, read, write, delete and search for files and directories
-> access and modify the Registry
-> manipulate services
-> tart and kill processes
-> take screenshots
-> enumerate open windows
-> create its own application window
-> get information about infected computer
-> lock, restart or shutdown Windows
-> create a pipe and read files from it

start a remote command shell
enumerate network resources

The backdoor also creates 3 empty SYS files in the \drivers\ subfolder of Windows System folder.

...
..
.

Write-up: Alexey Podrezov, May 19, 2006

Technical Details: Alexey Podrezov, May 19, 2006
FSecure Link: http://www.f-secure.com/v-descs/ginwui_a.shtml

I'm sure there will be more to follow on this...