• ISSP

Intruders used CVE-2017-0199 vulnerability

The e-mail OriginalMessage.txt.msg contains an attachment with the malicious file Prezent_UA_2k_berezen_PRESS.ppsx, which is a 16-slide presentation on socio-political situation in Ukraine.


Example of a slide from the file Prezent_UA_2k_berezen_PRESS.ppsx

The malicious file is interesting because it does not contain any embedded malicious macros. Instead, the intruders have used the CVE-2017-0199 vulnerability, which allows generating a malicious PPSX-file and delivering payload to the victim without any complex configuration. The file slide1.xml.rels is used when exploiting. Files with a .rels extension are relationship files. These files contain information on how parts of various Microsoft Office documents fit together. This information is also called “relationship parts”. In case with this malicious presentation the hxxp://socis.cf/?file=wj5yuxmp.hmf address was written into the slide1.xml.rels file:


Content of the slide1.xml.rels file

If you click on hxxp://socis.cf/?file=wj5yuxmp.hmf, you will see a script that creates a malicious file in the %temp% directory and runs it. As at the time of analysis, this address is no longer available.


Indicators of Compromise

URLs:

hxxp://socis.cf/?file=wj5yuxmp.hmf

IP addresses:

185.176.43.94(Bulgaria)

Files:

Prezent_UA_2k_berezen_PRESS.ppsx

MD5: CAFB6B5795C26376289832CFFC3AEE94

76 views

CONTACT US

WE ARE HERE TO HELP

Please get in touch by completing the form or calling one of our offices listed below.  

arrow&v

Washington DC

1300 I Street NW

Suite 400E, Washington

District of Columbia, 20005

+1 202 749 8432

Kyiv

10/14 Radyscheva St., Kyiv

Ukraine, 03124

+380 44 594 8018

Tbilisi

33b Ilia Chavchavadze ave,

0179, Tbilisi, Georgia
+995 32 224 0366

Wrocław

1 Grabarska st., 50-079  Wrocław,

Poland

+48 71 747 8705

Almaty

808V, 165B Shevchenko St, 050009, Almaty,

Kazakhstan

+7 727 341 0024

k z @ i s s p . c o m

Vancouver

Suite 2600, Three Bentall Centre 
595 Burrard st., PO Box 49314 
Vancouver BC V7X 1L3 Canada

+1 289 968 4454

Toronto

Suite 2201, 250 Yonge St. 
Toronto, ON M5B 2L7 Canada
+1 647 361 5221        +1 800 573 0922 (toll-free)

i n f o @ i s s p . c o m

Copyright © 2020 ISSP. All rights reserved.