top of page

Intruders used CVE-2017-0199 vulnerability

Writer's picture: Roman SologubRoman Sologub

The e-mail OriginalMessage.txt.msg contains an attachment with the malicious file Prezent_UA_2k_berezen_PRESS.ppsx, which is a 16-slide presentation on socio-political situation in Ukraine.


Example of a slide from the file Prezent_UA_2k_berezen_PRESS.ppsx

The malicious file is interesting because it does not contain any embedded malicious macros. Instead, the intruders have used the CVE-2017-0199 vulnerability, which allows generating a malicious PPSX-file and delivering payload to the victim without any complex configuration. The file slide1.xml.rels is used when exploiting. Files with a .rels extension are relationship files. These files contain information on how parts of various Microsoft Office documents fit together. This information is also called “relationship parts”. In case with this malicious presentation the hxxp://socis.cf/?file=wj5yuxmp.hmf address was written into the slide1.xml.rels file:


Content of the slide1.xml.rels file

If you click on hxxp://socis.cf/?file=wj5yuxmp.hmf, you will see a script that creates a malicious file in the %temp% directory and runs it. As at the time of analysis, this address is no longer available.


Indicators of Compromise

URLs:

hxxp://socis.cf/?file=wj5yuxmp.hmf

IP addresses:

185.176.43.94(Bulgaria)

Files:

Prezent_UA_2k_berezen_PRESS.ppsx

MD5: CAFB6B5795C26376289832CFFC3AEE94

3 views0 comments

Recent Posts

See All

Comments


CONTACT US

WE ARE HERE TO HELP

Please get in touch by completing the form or calling one of our offices listed below.  

Your message has been sent successfully!

footer01.png

Washington DC

1300 I Street NW

Suite 400E, Washington

District of Columbia, 20005

+1 202 749 8432

Kyiv

10/14 Radyscheva St., Kyiv

Ukraine, 03124

+380 44 594 8018

Tbilisi

33b Ilia Chavchavadze ave,

0179, Tbilisi, Georgia
+995 32 224 0366

Wrocław

1 Grabarska st., 50-079  Wrocław,

Poland

+48 71 747 8705

Vancouver

Suite 2600, Three Bentall Centre 
595 Burrard st., PO Box 49314 
Vancouver BC V7X 1L3 Canada

+1 289 968 4454

c a @ i s s p . c o m

Toronto

Suite 2201, 250 Yonge St. 
Toronto, ON M5B 2L7 Canada
+1 647 361 5221       

+1 800 573 0922 (toll-free)

c a @ i s s p . c o m

Almaty

808V, 165B Shevchenko St, 050009, Almaty,

Kazakhstan

+7 727 341 0024

i n f o @ i s s p . c o m

Copyright © 2020 ISSP. All rights reserved.

bottom of page