FireEye recently detected malicious Microsoft Office RTF documents that leverage CVE-2017-0199, a previously undisclosed vulnerability. This vulnerability allows a malicious actor to download and execute a Visual Basic script containing PowerShell commands when a user opens a document containing an embedded exploit. FireEye has observed Office documents exploiting CVE-2017-0199 that download and execute malware payloads from different well-known malware families.
FireEye shared the details of the vulnerability with Microsoft and has been coordinating public disclosure timed with the release of a patch by Microsoft to address the vulnerability, which can be found here.
The vulnerability bypassed most mitigations prior to patch availability; however, FireEye email and network products detected the malicious documents. FireEye recommends that Microsoft Office users apply the patch from Microsoft .Attack Scenario
The attack occurs in the following manner:A threat actor emails a Microsoft Word document to a targeted user with an embedded OLE2 embedded link object When the user opens the document, winword.exe issues a HTTP request to a remote server to retrieve a malicious HTA file The file returned by the server is a fake RTF file with an embedded malicious script Winword.exe looks up the file handler for application/hta through a COM object, which causes the Microsoft HTA application (mshta.exe) to load and execute the malicious script
In the two documents that FireEye observed prior to theinitial blog acknowledging these attacks, malicious scripts terminated the winword.exe processes, downloaded additional payloads, and loaded decoy documents. The original winword.exe process was terminated to conceal a user prompt generated by the OLE2link. Figure 1 shows this prompt.
Figure 1: User prompt hidden by the Visual Basic scriptDocument 1 - (MD5: 5ebfd13250dd0408e3de594e419f9e01)
The first malicious document identified by FireEye had three stages. An embedded OLE2 link object causes winword.exe to reach out to the following URL to download the stage one malicious HTA file:http[:]//46.102.152[.]129/template.doc
Once downloaded, the malicious HTA file is processed by the “application/hta” handler. The highlighted line in Figure 2 shows the first download occurring, followed by the additional malicious payloads.
Figure 2: Live attack scenarioOnce downloaded, the template file was stored in the user’s temporary internet files with the name template[?].hta, where [?] is determined at run time. The Logic Bug
Mshta.exe is responsible for handling the Content-Type “application/hta,” parsing the content, and executing the script. Figure 3 shows winword.exe querying registry value of CLSID for the “application/hta” handler.
Figure 3: Winword query registry value
Winword.exe makes a request to the DCOMLaunch service, which in turn causes the svchost.exe process hosting DCOMLaunch to execute mshta.exe. Mshta.exe then executes the script embedded in the malicious HTA document. Figure 4 shows the deobfuscated VBScript from the first stage download.
Figure 4: First document, stage one VBScript
The script shown in Figure 4 performs the following malicious actions:Terminates the winword.exe process with taskkill.exe to hide the prompt shown in Figure 1. Downloads a VBScript file from http[:]//www.modani[.]com/media/wysiwyg/ww.vbs and saving it to %appdata%\Microsoft\windows\maintenance.vbs Downloads a decoy document from http[:]//www.modani[.]com/media/wysiwyg/questions.doc and saving it to %temp%\document.doc Cleans up the Word Resiliency keys for Word versions 15.0 and 16.0 so that Microsoft Word will restart normally Executes the malicious stage two VBScript: %appdata%\Microsoft\Windows\maintenance.vbs Opens the decoy document, %temp%\document.doc, to hide the malicious activity from the user
Once executed, the downloaded stage two VBScript (ww.vbs/maintenance.vbs) performs the following actions:Writes an embedded obfuscated script to %TMP%/eoobvfwiglhiliqougukgm.js Executes the script
The obfuscated eoobvfwiglhiliqougukgm.js script performs the following actions when executed:Attempts to delete itself from the system Attempts to download http[:]//www.modani[.]com/media/wysiwyg/wood.exe (at most 44 times), and save the file to %TMP%\dcihprianeeyirdeuceulx.exe Executes %TMP%\dcihprianeeyirdeuceulx.exe
Figure 5 shows the process execution chain of events.
Figure 5: Process creation events
The final payload utilized in this malware is a newer variant of the LATENTBOT malware family. Additional details of the updates to this malware follow the Document 2 walkthrough.
Malicious HTA file
Stage two VBScript
Updated final payload
Table 1: First document file metadataThe LATENTBOT Payload The payload