Microsoft Spam Campaign Advisory for CVE-2017-11882

Microsoft has issued an advisory regarding new spam campaign leveraging CVE-2017-11882 in order to drop a malicious payload. Although this vulnerability was patched in November 2017, this CVE remains extremely popular with attackers due to the ease of exploitation. This most recent campaign is leveraging this vulnerability to execute malicious Powershell commands, and drop a backdoor. This campaign appears to be targeting Eastern European countries, given the languages used in the malicious emails.

Recommendations

• Enable the Cyber Attack Chatter rule and configure it to listen for chatter related to this CVE
• Apply the November 2017 Patch Tuesday security update for this CVE if not done already
• Remain alert to potential phishing attacks through email and social media

Details

CVE 2017-11882 is a remote code execution vulnerability in the Equation Editor functionality of Microsoft Office. This feature is typically used to embed and run complex equations as Object Linking and Embedding (OLE) objects, however, it lacks many of the security features of modern Office. Objects embedded with this method are run outside of Office, which makes it easy to exploit and attractive to attackers. This vulnerability is often used to automatically execute commands of an attacker’s choosing upon opening of a malicious Office or RTF file, although a patch was released in 2017.

Microsoft has issued a new advisory regarding a campaign they have observed to be exploiting this CVE. In this particular campaign, this vulnerability is being used to execute malicious Powershell commands hosted on Pastebin, and drop a backdoor on the victim machine. Malicious Office documents exploiting this CVE are attached to emails.

Email observed by Microsoft, associated with this campaign

Another email observed by Microsoft, associated with this campaign

Droppers:

ffb19eb696cc1c11b426d2c2b3ec801ba39b74d6b1772cd6fff09fecd596dd75
0bddc023f2c6c6befa1d12b1b3eaa86caa6119fd7d234d01f95bc72cc56a5eb9

Payloads:

816917f687595167f03365df571b225c36d47ec7566b10e1101575c1b30905b3
712a857b17778c6439f374ef8c02f03536f20131cbb49d7483c14b854156eada