itb-au logo
Story image

New email spam campaign ditches traditional Office macro infection tactic

19 Feb 2018

Researchers at Trustwave’s SpiderLabs Blog have spotted a wave of spam emails that use Microsoft Office documents to download password stealers without having to activate Macros.

Often malware will hide in infected Microsoft Office documents commonly attached to spam emails. That malware will be disguised as a downloader that is launched if a victim allows Macros in a malicious document.

This is a common sight in spam delivered from the Necurs botnet, however a new sample has ditched the macro approach entirely and instead uses a Microsoft Office vulnerability to steal details from victims.

Researchers have been tracking an email spam campaign that uses a four-stage infection process to deliver attachments and then a password stealer.

That password stealer can also steal credentials from email clients, FTP and browser clients.

According to researchers, the spam campaign uses a number of different subject lines, often variations of the following:

  • TNT STATEMENT OF ACCOUNT – {random numbers}.
  • Request for Quotation (RFQ) - <{random numbers}>
  • Telex Transfer Notification
  • SWIFT COPY FOR BALANCE PAYMENT

Researchers explain:

“Word documents with Office 2007 Open XML Formats are based on XML and ZIP archive technologies. Anyone can easily manipulate data in a Word 2007 file programmatically or manually. As shown below, the DOCX attachment contains an embedded OLE object that has external references. This 'feature' allows external access to remote OLE objects to be referenced in the document.xml.rels.”

If a victim opens the document, it triggers the download and execution of a remote document file in the form of a rich text file (RTF).

The RFT exploits the MS Equation Editor Tool and in turn downloads a MSHTA command line that leads to a remote HTA file. That HTA file eventually leads to VBScript with obfuscated code, and a PowerShell script that runs a remote binary file.

The binary file then executes the password stealer malware.

The entire process draws on a Microsoft Office vulnerability discovered in July 2017. The vulnerability, CVE-2017-11882, affects multiple Microsoft Office platforms including Microsoft Office 200 7 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016.

Attackers can run arbitrary code by failing to properly handle objects in memory, also known as a Microsoft Office Memory Corruption vulnerability.

“It's pretty unusual to find so many stages and vectors being used to download malware,” researchers comment.

“This approach can be very risky for the malware author. If any one stage fails, it will have a domino effect on the whole process. Another noticeable point is that the attack uses file types (DOCX, RTF and HTA), that are not often blocked by email or network gateways unlike the more obvious scripting languages like VBS, JScript or WSF.”

Link image
Revealed: Why CFOs need to embrace emerging tech
Financial technology is advancing rapidly, demanding that businesses advance with it or risk becoming irrelevant. Here's how CFOs can secure success by embracing future-shaping fintech.More
Link image
Free Webinar: Migrate to Office 365 fast and accelerate remote work with <span class="coloured">AvePoint</span>
The COVID-19 pandemic is a perfect example of why moving to the cloud is a necessity in today's climate. Learn why your organisation needs to migrate to Office 365 to ensure seamless remote work and business continuity in our free webinar on 21 May.More
Link image
Automation: The key to business excellence across the board
In 2020, businesses that don't invest in automation face serious risk of falling behind. If it exists in IT, there's a way to automate it - find out how with a free consultation.More
Story image
Alteryx unveils analytic process automation platform
The company says it’s putting automation in the hands of all workers, bringing new possibilities for personnel upskilling, business outcomes and workforce efficiencies.More
Story image
Seagate opens patents to help fight COVID-19
The company’s data storage innovations are now available as part of the Open COVID Pledge and ongoing efforts to combat COVID-19 around the world.More
Story image
Cloud tech inspires Kiwi supply chain firm to keep the world moving
It can be surreal to think technology can play a major role in helping organisations go global, but you don’t have to look far to find Kiwi companies that swear it’s true. More