Protection Against Exploitation
First and foremost, it is always highly recommended that users apply the vendor's patches when they become available.
In addition to the vendor patch(s) that should be applied, Trend Micro has released some supplementary detection protection that may help provide additional protection and detection of known malicious components associated with these attacks on systems that have not already been compromised or against further attempted attacks.
Using Trend Micro Products for Investigation
Trend Micro Vision One™
Trend Micro Vision One customers benefit from XDR detection capabilities of the underlying products such as Apex One. In addition, depending on their data collection time range, Trend Micro Vision One customers may be able to sweep for IOCs retrospectively to identify if there was potential activity in this range to help in investigation.
Threat Intelligence Sweeping
Indicators for this exploits against this vulnerability are now included in the Threat Intelligence Sweeping function of Trend Micro Vision One. Customers who have this enabled will now have the presence of the IOCs related to these threats added to their daily telemetry scans.
Preventative Rules, Filters & Detection
Trend Micro Malware Detection Patterns (VSAPI, Predictive Learning, Behavioral Monitoring and WRS) for Endpoint, Servers, Mail & Gateway (e.g. Apex One, Deep Security w/Anti-malware, etc.)
Malicious file samples associated with known exploits of this vulnerability are detected as:
| IoC Type | SHA1 | VSAPI Detection | Predictive Learning | Pattern Number (VSAPI) |
|---|---|---|---|---|
| Payload (CAB) | 56a8d4f7009caf32c9e28f3df945a7826315254c | Trojan.Win64.COBEACON.SUZ | 16.953.00 | |
| Exploited Doc | 1a528a5964cd18d8ce7a47e69e30ef1163407233 | Trojan.W97M.CVE202140444.A | 16.955.00 | |
| Exploited Doc | d05fc61894cb7652dce69edd6e4cf7e4e639754a | Trojan.W97M.CVE202140444.A | 16.955.00 | |
| Exploited Doc | f43ebedb86db817b208aebdf88e08163f239b832 | Trojan.W97M.CVE202140444.A | 16.955.00 | |
| Exploited Doc | 53b31e513d8e23e30b7f133d4504ca7429f0e1fe | Trojan.W97M.CVE202140444.A | 16.955.00 | |
| Downloaded JS | e5f2089d95fd713ca3d4787fe53c0ec036135e92 | Trojan.JS.TIVEX.A | 16.955.00 | |
| Payload (DLL) | 6c10d7d88606ac1afd30b4e61bf232329a276cdc | Backdoor.Win64.COBEACON.OSLJAU | TROJ.Win32.TRX.XXPE50FLM011 | 16.955.00 |
| Exploited Doc | 9bec2182cc5b41fe8783bb7ab6e577bac5c19f04 | Trojan.W97M.CVE202140444.A | 16.955.00 | |
| Exploited Doc | 34fe60eedf640ec11742ca9822b4fee48031e19b | Trojan.W97M.CVE202140444.A | 16.955.00 | |
| Payload (DLL) | e5f9b523cbe9ebd76fcfd47706254a94ede29c1d | Backdoor.Win64.COBEACON.OSLJAU | Troj.Win32.TRX.XXPE50FFF048 | 16.957.00 |
| Payload (CAB) | 9156a06acd3c61cffb2738b521c27ad863e98feb | Backdoor.Win64.COBEACON.OSLJAU | 16.957.00 |
In addition, the following associated URLs being being blocked via Web Reputation Services (WRS):
| URL | Category |
|---|---|
| hxxp://hidusi[.]com/ | Malware Accomplice |
| hxxp://hidusi[.]com/e273caf2ca371919/mountain[.]html | Malware Accomplice |
| hxxp://hidusi[.]com/94cc140dcee6068a/help[.]html | Malware Accomplice |
| hxxp://hidusi[.]com/e8c76295a5f9acb7/side[.]html | Malware Accomplice |
| hxxp://hidusi[.]com/e8c76295a5f9acb7/ministry[.]cab | Malware Accomplice |
| hxxps://joxinu[.]com | C&C Server |
| hxxps://joxinu[.]com/hr[.]html | C&C Server |
| hxxps://dodefoh[.]com | C&C Server |
| hxxps://dodefoh[.]com/ml[.]html | C&C Server |
| hxxp://pawevi[.]com/e32c8df2cf6b7a16/specify.html | C&C Server |
| hxxp://sagoge[.]com/ | Malware Accomplice |
| hxxps://comecal[.]com/ | Malware Accomplice |
| hxxps://rexagi[.]com/ | Malware Accomplice |
| hxxp://sagoge[.]com/get_load | Malware Accomplice |
| hxxps://comecal[.]com/static-directory/templates[.]gif | Malware Accomplice |
| hxxps://comecal[.]com/ml[.]js?restart=false | Malware Accomplice |
| hxxps://comecal[.]com/avatars | Malware Accomplice |
| hxxps://rexagi[.]com:443/avatars | Malware Accomplice |
| hxxps://rexagi[.]com/ml[.]js?restart=false | Malware Accomplice |
| hxxps://macuwuf[.]com | Malware Accomplice |
| hxxps://macuwuf[.]com/get_load | Malware Accomplice |
Trend Micro is closely monitoring and conducting additional research on these attacks and will update this article with additional information and protections as they become available.