The CVE-2017-8570 vulnerability of Microsoft Office allows a remote code execution vulnerability because it handles objects in memory. An attacker can execute arbitrary code on the system because of improper handling of objects in memory. By tricking a victim to open a weaponized document, the attacker could exploit this vulnerability to execute arbitrary code on the system with the privileges of the victim.

Some malicious Rich Text Format (RTF) documents used as malspam attachments leverage the vulnerability to install malicious payload on the machine of victims. These malspam and phishing emails use social engineering techniques such as fake product order requests and invoice documents to trick the victims to open the attachments. This vulnerability now serves as downloader to other high-profile malware such as Loki and Nanocore.

Behavior

• Downloads high-profile malware namely Loki and Nanocore
• Uses composite moniker in the RTF file to execute a Windows Script Component (WSC) file or scriptlet (.sct) on the victim’s machine
• Bypasses the Microsoft patch for CVE-2017-0199

Capabilities

• Download Routine

Impact

• Compromise system security - downloads and installs additional malware

Infection Routine

Sample Spam (Product Order Request)