Estimated reading time: 4 minutes

No wonder malspam campaigns are a major medium to spread malware. Previously, we have written about such campaigns making use of MS Office malware such as malicious macro, CVE-2017-0199, CVE-2017-8759 and DDE-based attack. Recently, we have started observing various malspam campaigns exploiting the latest MS Office vulnerability CVE-2017-11882.

Let’s take a look at in-depth analysis of one such malspam campaign exploiting vulnerability ‘CVE-2017-11882’ in the wild.

Attack chain

 

Vulnerability (CVE-2017-11882) analysis

A remote code execution vulnerability (CVE-2017-11882) is triggered in the Microsoft Office Equation Editor (EQNEDT32.EXE) component. The attacker can successfully exploit a stack buffer overflow vulnerability in the equation editor component of MS Office and execute an arbitrary code. The root cause of this vulnerability is copy unbounded string of FONT name defined within a FONT record structure of Equation EditorOLE object data.

To exploit the vulnerability, attackers use specially crafted RTF files with doc extensions. This RTF file contains an embedded equation object class as shown in Fig 2.

 

OLE file which is embedded inside the crafted RTF has a stream name “Equation Native” having the following header:

Size	Description
WORD	Size of header(EQNOLEFILEHDR) == 28 (0x1C)
DWORD	Version
WORD	Clipboard format
DWORD	Size of (MTEF header + MTEF data)
DWORD	Reserved1
DWORD	Reserved2
DWORD	Reserved3
DWORD	Reserved4

 

MTEF is a Math Type equation format used by equation editor.

MTEF header have the following structure.

Size	Description
BYTE	MTEF version
BYTE	Generating platform
BYTE	Generating product
WORD	Product version and subversion

 

MTEF data consists of MTEF header followed by multiple records. These records can be of different types and sizes.

FONT record which is defined in MTEF data object receives crafted FONT name and triggers the vulnerability.

Following is the structure of MTEF data (FONT record).

Size	Description
BYTE	FONT tag
BYTE	Typeface number
BYTE	Typeface style
STRING	Font name
BYTE	Null terminated

 

If FONT NAME is greater than 32 bytes, it indicates the exploit attempts.

 

Exploit analysis

In this campaign, the initial attack vector uses spam emails with crafted RTF attachments with .doc extension.

Fig 3 shows the spam email used in this campaign.

 

MS Word runs the malicious attachment and attempts to exploit. After successful exploitation, Microsoft Equation Editor starts the mshta process.

Let’s dive into the assembly to know how it works.

The below figure is a snap that shows the stack buffer overflow scenario where 48 bytes of data gets copied into a local buffer which causes a buffer overflow and overwrites base pointer and returns address.

Fig 6 shows the address (0x00430C12) which gets overwritten into the return address.

The overwritten address is from EQUATION32.EXE and that instruction points to “WinExec” api as mentioned in Fig 7.

After successful exploitation, mshta process gets executed by WinExec which downloads and executes the malicious hta file. The hta file further acts as a downloader for an infostealer malware.

At Quick Heal Security Labs, we have seen different variants of this exploit using mshta.exe, cmd.exe, and powershell.exe being executed by WinExec for carrying out further activities.

 

File-less attacks

Below is a scenario where the exploit contains a code that directly executes a malware which is hosted on a public WebDav server. The payload is a typical network UNC path.

Fig 8 shows the different malware hosted on public WebDav server 185.45.195.7.

 

 

Obfuscation technique

To bypass signature-based detections, attackers used various obfuscation techniques in this campaign.

One of the obfuscation techniques used is shown below (fig 10).

RTF math control word “\mmath ” (math zone) is used as obfuscation in OLE embedded RTF file. Because of the use of \mmath control word, the string cmd.exe gets divided as “c” and “md.exe” which can simply evade the signature-based detection where the signature pattern can be used is cmd.exe.

 

Conclusion

To defend against such exploits, Microsoft has already implemented features like DEP and ASLR in their arsenal but attacker targeted eqnedt32.exe where both these features were disabled; so carrying out such attacks using readily available exploit POC’s becomes handy for attackers. From Microsoft Office 2007 Service Pack 3, all versions are vulnerable to this vulnerability. Microsoft has released a patch for this vulnerability so we recommend our users to apply the latest Microsoft update packages and keep their antivirus up to date.

 

Safety measures

• To stay away from such attacks, we recommend disabling Equation Editor 3.0 if it is not being used. For this, please refer to the below link:
  https://support.microsoft.com/en-in/help/4055535/how-to-disable-equation-editor-3-0
• We have also mentioned some phishing techniques to identify phishing emails in our previous blog post
  http://blogs.quickheal.com/quick-heal-thwarts-attempts-java-jrat-phishing-campaign-targeting-international-embassy-india/

 

Indicators of compromise:

1A74FD8314F303E96018002A9F73F1F1
F603D25DDF21A8B9C2FAE7C9DC118BE2
E64C7C14B4632E995C7922A81ABA5E15
hxxp://112.213.118[.]108:11882/
hxxp://104.254.99[.]77/x.txt
176.107.178.12
185.175.208.10

 

Subject Matter Experts

Aniruddha Dolas, Prashant Kadam | Quick Heal Security Labs