CVE-2017-0199: In the Wild Attacks Leveraging HTA HandlerFireEye recently detected malicious Microsoft Office RTF documents
that leverage CVE-2017-0199, a previously undisclosed vulnerability.
This vulnerability allows a malicious actor to download and execute a
Visual Basic script containing PowerShell commands when a user opens a
document containing an embedded exploit. FireEye has observed Office
documents exploiting CVE-2017-0199 that download and execute malware
payloads from different well-known malware families.
FireEye shared the details of the vulnerability with Microsoft and
has been coordinating public disclosure timed with the release of a
patch by Microsoft to address the vulnerability, which can be found here.
The vulnerability bypassed most mitigations prior to patch
availability; however, FireEye email and network products detected the
malicious documents. FireEye recommends that Microsoft Office users
apply the href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0199">patch
from Microsoft.
Attack Scenario
The attack occurs in the following manner:
- A threat actor emails a Microsoft Word document to a targeted
user with an embedded OLE2 embedded link object - When the
user opens the document, winword.exe issues a HTTP request to a
remote server to retrieve a malicious HTA file - The file
returned by the server is a fake RTF file with an embedded malicious
script - Winword.exe looks up the file handler for
application/hta through a COM object, which causes the Microsoft HTA
application (mshta.exe) to load and execute the malicious
script
In the two documents that FireEye observed prior to the href="https://www.fireeye.com/blog/threat-research/2017/04/acknowledgement_ofa.html">initial
blog acknowledging these attacks, malicious scripts terminated the
winword.exe processes, downloaded additional payloads, and loaded
decoy documents. The original winword.exe process was terminated to
conceal a user prompt generated by the OLE2link. Figure 1 shows this prompt.
Figure 1: User prompt hidden by the Visual Basic script
Document 1 - (MD5: 5ebfd13250dd0408e3de594e419f9e01)
The first malicious document identified by FireEye had three stages.
An embedded OLE2 link object causes winword.exe to reach out to the
following URL to download the stage one malicious HTA file:
http[:]//46.102.152[.]129/template.doc
Once downloaded, the malicious HTA file is processed by the
“application/hta” handler. The highlighted line in Figure 2 shows the
first download occurring, followed by the additional malicious payloads.
Figure 2: Live attack scenario
Once downloaded, the template file was stored in the user’s
temporary internet files with the name template[?].hta, where [?] is
determined at run time.
The Logic Bug
Mshta.exe is responsible for handling the Content-Type
“application/hta,” parsing the content, and executing the script.
Figure 3 shows winword.exe querying registry value of CLSID for the
“application/hta” handler.
Figure 3: Winword query registry value
Winword.exe makes a request to the DCOMLaunch service, which in turn
causes the svchost.exe process hosting DCOMLaunch to execute
mshta.exe. Mshta.exe then executes the script embedded in the
malicious HTA document. Figure 4 shows the deobfuscated VBScript from
the first stage download.
Figure 4: First document, stage one VBScript
The script shown in Figure 4 performs the following malicious actions:
- Terminates the winword.exe process with taskkill.exe to hide
the prompt shown in Figure 1. - Downloads a VBScript file
from http[:]//www.modani[.]com/media/wysiwyg/ww.vbs and saving it to
%appdata%\Microsoft\Windows\maintenance.vbs - Downloads a decoy
document from http[:]//www.modani[.]com/media/wysiwyg/questions.doc
and saving it to %temp%\document.doc - Cleans up the Word
Resiliency keys for Word versions 15.0 and 16.0 so that Microsoft
Word will restart normally - Executes the malicious stage two
VBScript: %appdata%\Microsoft\Windows\maintenance.vbs - Opens
the decoy document, %temp%\document.doc, to hide the malicious
activity from the user
Once executed, the downloaded stage two VBScript
(ww.vbs/maintenance.vbs) performs the following actions:
- Writes an embedded obfuscated script to
%TMP%/eoobvfwiglhiliqougukgm.js - Executes the script
The obfuscated eoobvfwiglhiliqougukgm.js script performs the
following actions when executed:
- Attempts to delete itself from the system
- Attempts to
download http[:]//www.modani[.]com/media/wysiwyg/wood.exe (at most
44 times), and save the file to
%TMP%\dcihprianeeyirdeuceulx.exe - Executes
%TMP%\dcihprianeeyirdeuceulx.exe
Figure 5 shows the process execution chain of events.
Figure 5: Process creation events
The final payload utilized in this malware is a newer variant of the
LATENTBOT malware family. Additional details of the updates to this
malware follow the Document 2 walkthrough.
MD5 | | valign="top">Size
| valign="top">Name
| valign="top">Description
| valign="top">5ebfd13250dd0408e3de594e419f9e01
width="53" valign="top">37,523
| valign="top">hire_form.doc
| valign="top">Malicious document
| valign="top">fb475f0d8c8e9bf1bc360211179d8a28
width="53" valign="top">27,429
| valign="top">template.doc/template[?].hta
width="73" valign="top">Malicious HTA file
| valign="top">984658e34e634d56423797858a711846
width="53" valign="top">5,704
| valign="top">ww.vbs/maintenance.vbs
| valign="top">Stage two VBScript
| valign="top">73bf8647920eacc7cc377b3602a7ee7a
width="53" valign="top">13,386
| valign="top">questions.doc/document.doc
width="73" valign="top">Decoy document
| valign="top">11fb87888bbb4dcea4891ab856ac1c52
width="53" valign="top">5,292
| valign="top">eoobvfwiglhiliqougukgm.js
width="73" valign="top">Malicious script
a1faa23a3ef8cef372f5f74aed82d2de |
388,096 | | valign="top">wood.exe/ dcihprianeeyirdeuceulx.exe
Final payload |
| valign="top">15e51cdbd938545c9af47806984b1667
width="53" valign="top">414,720
| valign="top">wood.exe/ dcihprianeeyirdeuceulx.exe
Updated final payload |
Table 1: First document file metadata
The LATENTBOT Payload
The payload associated with the first document is an updated version
of the href="https://www.fireeye.com/blog/threat-research/2015/12/latentbot_trace_me.html">LATENTBOT
malware family. LATENTBOT is a highly-obfuscated BOT that has
been in the wild since 2013.
The newer version of the LATENTBOT has different injection
mechanisms for Windows XP (x86) and Windows 7 operating systems:
Attrib.exe patching – The bot calls Attrib.exe, patches the
entry in memory, and inserts a JMP instruction to transfer control
to the mapped section. To map the section in the address space of
atrrib.exe it uses ZwMapViewOfSection().
Svchost code Injection – Attrib.exe starts the svchost.exe
process in suspended mode, creates space, and allocates code by
calling ZwMapViewOfSection().
Control transfer – It then uses SetThreadContext() to modify
the OEP of the primary thread, which will be executed in the remote
process to trigger code execution.
Browser injection – A similar process is used to inject the
final payload into the default web browser with the help of
NtMapVIewOfSection().
In Windows 7 or later operating systems, the bot does not use
attrib.exe. Rather, it injects code into svchost.exe followed by
launching the default browser with malicious payload by leveraging NtMapViewOfSection().
This variant then connects to the following command and control (C2) server:
Upon successful communication with the C2 server, LATENTBOT
generates a beacon. One of the decrypted beacons are as follows with
an updated version number of 5015:
At the time of analysis, the C2 server was offline. The bot comes
with a highly modular plugin architecture and has been associated with
the “Pony” campaigns as an infostealer.
As of April 10, 2017, the malware hosted at
www.modani[.]com/media/wysiwyg/wood.exe has been updated and the C2
server has been moved to: 217.12.203[.]100.
Document 2 - (MD5: C10DABB05A38EDD8A9A0DDDA1C9AF10E)
The second malicious document identified by FireEye consisted of two
malicious stages. The initial stage reached out to the following URL
to download the stage one malicious HTA file:
http[:]//95.141.38[.]110/mo/dnr/tmp/template.doc
This file is downloaded into the user’s temporary internet files
directory with the name template[?].hta, where [?] is determined at
runtime. Once downloaded, winword.exe utilizes mshta.exe to parse the
file. mshta.exe parses through file finding <script>
</script> tags and executes the contained script. Figure 6 shows
the deobfuscated script.
Figure 6: Second document, first stage VBScript
Figure 6 shows the following malicious actions:
- Terminate the winword.exe process with taskkill.exe to hide
the prompt shown in Figure 1 - Download an executable from
http[:]//95.141.38[.]110/mo/dnr/copy.jpg, saving it to
'%appdata%\Microsoft\Windows\Start
Menu\Programs\Startup\winword.exe' - Download a document from
http[:]//95.141.38[.]110/mo/dnr/docu.doc, saving it to
%temp%\document.doc - Clean up the Word Resiliency keys for
Word versions 15.0 and 16.0, so that Microsoft Word will restart
normally - Execute the malicious payload at
'%appdata%\Microsoft\Windows\Start
Menu\Programs\Startup\winword.exe' - Open the decoy document,
%temp%\document.doc, to hide the malicious activity from the
user
Examination of the malicious payload revealed that it is a variant
of the dropper for what Microsoft calls href="http://download.microsoft.com/download/E/B/0/EB0F50CC-989C-4B66-B7F6-68CD3DC90DE3/Microsoft_Security_Intelligence_Report_Volume_21_English.pdf">WingBird,
which has similar characteristics as FinFisher. The malware is heavily
obfuscated with several anti-analysis measures, including a custom VM
to slow analysis. A href="https://artemonsecurity.blogspot.com/2017/01/wingbird-rootkit-analysis.html">blog
post by "Artem" covers a payload driver of WingBird.
The blog author briefly mentions the protection techniques of the
dropper, which match this sample.
MD5 | | valign="top">Size
| valign="top">Name
| valign="top">Description
| valign="top">c10dabb05a38edd8a9a0ddda1c9af10e
width="57" valign="top">70,269
| valign="top">СПУТНИК РАЗВЕДЧИКА.doc
width="82" valign="top">Malicious document
| valign="top">9dec125f006f787a3f8ad464d480eed1
width="57" valign="top">27,500
| valign="top">template.doc
| valign="top">Malicious HTA file
| valign="top">acde6fb59ed431000107c8e8ca1b7266
width="57" valign="top">1,312,768
| valign="top">copy.jpg/winword.exe
| valign="top">Final payload
| valign="top">e01982913fbc22188b83f5f9fadc1c17
width="57" valign="top">6,220,783
| valign="top">docu.doc/document.doc
| valign="top">Decoy document
Table 2: Second document metadata
Conclusion
FireEye observed CVE-2017-0199, a vulnerability in Microsoft Word
that allows an attacker to execute a malicious Visual Basic script.
The CVE-2017-0199 vulnerability is a logic bug and bypasses most
mitigations. Upon execution of the malicious script, it downloads and
executes malicious payloads, as well as displays decoy documents to
the user. The two documents achieve execution of their malicious
payloads, with one containing LATENTBOT and the other containing
WingBird/FinFisher. The malicious document contained only a link to
the attacker controlled server, showing the advantage of FireEye’s MVX
engine to detect multi-stage attacks. Further campaigns leveraging
this attack have been observed prior to patch availability, but are
not covered in this blog.
We recommend that Microsoft Office users apply the href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0199">patch
as soon as possible.
Acknowledgement
Thank you to Michael Matonis, Dhanesh Kizhakkinan, Yogesh Londhe,
Swapnil Patil, Joshua Triplett, and Tyler Dean from FLARE Team,
FireEye Labs Team, and FireEye iSIGHT Intelligence for their
contributions to this blog. Thank you as well to everyone who worked
with us at the Microsoft Security Response Center (MSRC).
Source:
CVE-2017-0199: In the Wild Attacks Leveraging HTA Handler
