Monday, April 10, 2017

Office 0day goes mainstream

CVE-2017-0199 MS Office Exploit

On Friday April 7, 2017, McAfee posted that a new Office zero day affecting even the most recent versions of Windows and Office was found in the wild, FireEye released a blog post the next day confirming the zero day.

Using details from the 2 posts we were able to find 5 samples from the targeted attacks which use the "htmlfile" class ID 25336920-03f9-11cf-8fd0-00AA00686f13 to load remote content with trusted permissions.   The remote content which appears to be a RTF file with an embedded HTML-style [script language="VBScript"] exploit to download and run a remote executable using powershell.

More concerning, is the emergence of a mass-emailed campaign today (April 10, 2017). Malware Tracker discovered a large campaign using the exploit and common "Scan Data" themed emails. The emails contain a randomly named nnnnnnnn[1].doc rtf file which uses the zero day exploit in a barely modified form. We have observed 2 samples - a .doc, and a .pdf version which is still a rtf file sent to dozens of users in Australia and the US.

Microsoft previously advised that this htmlfile Class ID was high risk and how to disable it.

 Cryptam.com and QuickSand.io both detect this exploit and are free to use.

QuickSand.io malware sample of CVE-2017-0199.

Update: Microsoft has patched this exploit.