December 3, 2023
Severity High Analysis Summary A new and sophisticated Android malware, named FjordPhantom, has been disclosed by cybersecurity researchers. The malware targets users in Southeast Asian countries, […]
Rewterz Threat Alert – Office 365 Phishing Campaign Baits Employees with Pay Raises
November 4, 2019Rewterz Threat Advisory – Vulnerability in Microsoft Office for Mac Could Allow for Remote Code Execution
November 5, 2019Rewterz Threat Alert – Office 365 Phishing Campaign Baits Employees with Pay Raises
November 4, 2019Rewterz Threat Advisory – Vulnerability in Microsoft Office for Mac Could Allow for Remote Code Execution
November 5, 2019
Severity
High
Analysis Summary
Hawkeye is exploiting an 18-year-old vulnerability in Microsoft Office products using malicious office documents. The HawkEye malware kit and information-stealer has been spotted in a newfound slew of campaigns after a recent ownership change. It comes with special key-logging abilities and anti-detection features. The exploited flaw was discovered and manually fixed by Microsoft in 2017.
CVE-2017-11882
Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory, aka “Microsoft Office Memory Corruption Vulnerability”.
The threat group uses NirSoft utilities to collect credentials. The recent Rattlesnake attack on Pakistan Navy also exploited this vulnerability, indicating that users are still running unpatched versions of the affected products. The vulnerability was also exploited by the Cobalt hackers last year.
Impact
- Credential Theft
- Remote Code Execution
- Memory Corruption
- Information Theft
- Keylogging
Indicators of Compromise
Domain Name
chandelawestafricanltd[.]com
MD5
- 8533c945b368586fe1e08da4d80f83fc
- c4f61a2281c18db830cec5a54a9c2799
- 7573dd8b5409654e0da294851df8b29d
- 159d076b1e872dc3699081dac564c029
- 70c5197ea83262a1568673496fef01ce
- 44b2dd31e8f2db620f35507fa68ebd6a
- 2c72dcda462a940cc4f079528c39fa52
- 5a42bc20ce4c2cd22b039871fdf8d6f7
SH256
- ca691249fc974266ee192fc81d993db419770095497fa58913219c06bc58a368
- 4a79e69a9723f42b6a9c6650937bbd819cf1bbcddb568a158f8c0340b943e16f
- d002a44fe33daa2f36d42be9b60ba0d974ecc9d83c0dd6bd5fe89a91ae3abde4
- 58731429bd5104f9e978c51b11dccc6a8d0a1c02cc01b3b9998859acdf63fd13
- 1b2d88edb315682c56e11b08fef4043e01277dca325e0780aaa07aec93448581
- 577c6219426df48ec8a2f3979b8c716604bd9623c798bfd4d9879b440f8cf2db
- dcc9af2b8052158b8e3323a3b0b377a2024dd7e4498a0be7d9fc56fb5cf2f2a6
- 700933c9c1b4e12bdaf76921e85595eea68d5b479c0af6e6709e71edde5b57ff
SHA1
- 54726c1276e6b64ec137cb3a120af1eae429347c
Source IP
- 66[.]117[.]14[.]246
- 66[.]171[.]248[.]178
URL
hxxp[:]//chandelawestafricanltd[.]com/image/obo/obxi[.]exe
Remediation
- Block the threat indicators at their respective controls.
- Immediately update Microsoft Office products to latest patched versions.
- Do not download files attached in untrusted emails.