Multi-Stage Word Attack Infects Users Without Using Macros (infection with password stealer)

[LASER_oneXM]

Spam distributors are using a new technique to infect users with malware, and while this attack relies on having users open Word documents, it does not involve users having to allow the execution of macro scripts.

This new macro-less technique is currently under active exploitation, being detected by Trustwave SpiderLabs researchers in an ongoing malware campaign.

The company says crooks are using this multi-phase, no-macros technique to infect users with a password stealer. Currently, evidence suggests only one group is using this novel trick, albeit this will surely be adopted by others.

New technique's exploitation chain
The actual exploitation chain is detailed below and relies on a large number of resources, such as DOCX, RTF, HTA, VBScript, and PowerShell.

A victim receives a spam email with a DOCX file attachment.
Victim downloads and opens the DOCX file.
DOCX file contains an embedded OLE object.
OLE object downloads and opens an RTF (disguised as a DOC) file.
DOC file uses CVE-2017-11882 Office Equation Editor vulnerability.
Exploit code runs an MSHTA command line.
MSHTA command line downloads and runs an HTA file.
HTA file contains a VBScript that unpacks a PowerShell script.
PowerShell script downloads and installs the password stealer.
Malware steals passwords from browsers, email and FTP clients.
Malware uploads data to a remote server.

....
........
..
............

 

[shmu26]

Doesn't sound so difficult to block. OSArmor, Voodooshield, Comodo, etc etc are all monitoring or blocking several of these processes.

 

[Andy Ful]

Even old Windows built-in SRP (Basic User or Dissallowed) or AppLocker will stop it because of
forced PowerShell Constrained Language mode (Windows 7+ with PowerShell 5.0). Also, the VBScript payload and final EXE paylod can be stopped on Windows XP+ by SRP (Dissallowed) .

 

[Solarquest]

VT of word 20/64
VirusTotal
Better for the RTF
VirusTotal

Hta

VirusTotal

Password stealer 58/64
VirusTotal