• Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Press Release
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert – Office 365 Phishing Campaign Baits Employees with Pay Raises
November 4, 2019
Rewterz Threat Advisory – Vulnerability in Microsoft Office for Mac Could Allow for Remote Code Execution
November 5, 2019

Rewterz Threat Alert – Hawkeye Keylogger too Exploits CVE-2017-11882 after Rattlesnake

November 4, 2019

Severity

High

Analysis Summary

Hawkeye is exploiting an 18-year-old vulnerability in Microsoft Office products using malicious office documents. The HawkEye malware kit and information-stealer has been spotted in a newfound slew of campaigns after a recent ownership change. It comes with special key-logging abilities and anti-detection features. The exploited flaw was discovered and manually fixed by Microsoft in 2017. 

CVE-2017-11882 

Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory, aka “Microsoft Office Memory Corruption Vulnerability”. 

The threat group uses NirSoft utilities to collect credentials. The recent Rattlesnake attack on Pakistan Navy also exploited this vulnerability, indicating that users are still running unpatched versions of the affected products. The vulnerability was also exploited by the Cobalt hackers last year.

Impact

  • Credential Theft
  • Remote Code Execution
  • Memory Corruption
  • Information Theft
  • Keylogging

Indicators of Compromise

Domain Name

chandelawestafricanltd[.]com

MD5

  • 8533c945b368586fe1e08da4d80f83fc
  • c4f61a2281c18db830cec5a54a9c2799
  • 7573dd8b5409654e0da294851df8b29d
  • 159d076b1e872dc3699081dac564c029
  • 70c5197ea83262a1568673496fef01ce
  • 44b2dd31e8f2db620f35507fa68ebd6a
  • 2c72dcda462a940cc4f079528c39fa52
  • 5a42bc20ce4c2cd22b039871fdf8d6f7

SH256

  • ca691249fc974266ee192fc81d993db419770095497fa58913219c06bc58a368
  • 4a79e69a9723f42b6a9c6650937bbd819cf1bbcddb568a158f8c0340b943e16f
  • d002a44fe33daa2f36d42be9b60ba0d974ecc9d83c0dd6bd5fe89a91ae3abde4
  • 58731429bd5104f9e978c51b11dccc6a8d0a1c02cc01b3b9998859acdf63fd13
  • 1b2d88edb315682c56e11b08fef4043e01277dca325e0780aaa07aec93448581
  • 577c6219426df48ec8a2f3979b8c716604bd9623c798bfd4d9879b440f8cf2db
  • dcc9af2b8052158b8e3323a3b0b377a2024dd7e4498a0be7d9fc56fb5cf2f2a6
  • 700933c9c1b4e12bdaf76921e85595eea68d5b479c0af6e6709e71edde5b57ff

SHA1

  • 54726c1276e6b64ec137cb3a120af1eae429347c

Source IP

  • 66[.]117[.]14[.]246
  • 66[.]171[.]248[.]178

URL

hxxp[:]//chandelawestafricanltd[.]com/image/obo/obxi[.]exe

Remediation

  • Block the threat indicators at their respective controls.
  • Immediately update Microsoft Office products to latest patched versions.
  • Do not download files attached in untrusted emails.
  • Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.