Summary
Microsoft Office Memory Corruption Vulnerability (CVE-2017-11882) is a remote code execution vulnerability which can enable an attacker to execute arbitrary code on the compromised machine. The vulnerability resides on a MS Office component called Equation Editor, an out-of-process COM server hosted by eqnedt32.exe, which was compiled on November 2009 and still being used in supported versions of MS Office without further recompilation. This vulnerability was patched by Microsoft on November 14, 2017 however it’s still being actively used in attacks. Malwares that utilize this exploit usually arrives via malspam campaign as a weaponized Microsoft Office document. The targeted platforms are MS Office 2007, 2010, 2013, and 2016 (including Office 360).
In line with the current events, COVID-19 themed or fake shipping documents, quotation or invoice malspam and phishing mails are used to trick the victim to open the malicious attachment. These attachments are documents such as Word, Excel, and Rich Text Format (RTF) files to leverage the vulnerability and download malware payload on the compromised machine. This vulnerability serves as a downloader for infostealer malware such as FAREIT, LOKI or NEGASTEAL.
Behaviour
- Downloads information stealer malware such as FAREIT, LOKI or NEGASTEAL
- Uses Equation Editor to download and execute the malware payload
Capabilities
Impact
- Compromise system security - downloads and installs additional malwares
Additional Threat Reference Information
Infection Chain
MITRE ATT&CK Matrix
| BEHAVIOR | TACTIC | TECHNIQUE |
|---|
| Arrives as an Invoice document attachment | Initial Access | T1193 Spearphishing Attachment |
| File is obfuscated with several invalid control words and whitespaces | Defense Evasion | T1027 Obfuscated Files or Information |
| Takes advantage of CVE-2017-11882 exploit upon opening of the document | Execution | T1203 Exploitation for Client Execution |
| Uses eqnedt32.exe to execute arbitrary code | Lateral Movement, Execution | T1175 Component Object Model and Distributed COM |
| Downloads and execute malware payload to compromised machine | Command and Control, Lateral Movement | T1105 Remote File Copy |
