Your Workplace Doc is at Threat | Mod Tech

Microsoft Workplace paperwork are used worldwide by each companies and residential customers. Its totally different workplace variations, whether or not licensed or unlicensed, supply customers a straightforward method to create and modify recordsdata. Nevertheless, this software program can also be vulnerable to cyberattacks.

Cyber ​​criminals typically make the most of their vulnerability and use VBA (Visible Primary Utility) macros as entry factors to realize entry to focus on programs and units.

Through the years, VBA macros have been a pervasive menace to Workplace paperwork with their skill to unfold malware. And that is why Microsoft lastly determined to dam VBA macros for recordsdata which have the ‘mark of the net’ (MOTW) tag. With this alteration, every time customers open a file downloaded from the Web, similar to e mail attachments which have macros, the next message will probably be displayed:

Determine 1. Safety danger warning

Because of this, attackers at the moment are pressured to consider other ways to achieve their victims. And that is the place Microsoft plugins come into the image.

What are Microsoft Add-ons?

An add-on is a software program program that extends the capabilities of the primary packages. It’s a time period generally utilized by Microsoft and different platforms which have extra options that may be added to the primary packages. Workplace Add-ins are DLL recordsdata which have totally different extensions relying on the applying. Microsoft Excel and Phrase have plugins with the file extensions, ‘.xll’ and ‘.wll’ respectively.

For the phrase, the ‘.wll’ The add-in should be positioned in a particular location, specified by the HKCUSoftwareMicrosoftOffice16.0WordSecurityTrusted Places registry worth, relying on the model of Workplace. This can be sure that ‘.wll’ the add-in runs by way of the Phrase utility.

For Excel add-ins, so long as ‘.xll’ the file is uploaded, it would open with an Excel utility.

Malicious XLL recordsdata

Many menace actors have began utilizing XLL recordsdata as their preliminary vector. These recordsdata are largely shared as an e mail attachment. It’s related to an icon just like one other Excel-compatible file, making it tough for finish customers to differentiate between the unique Excel file and an add-in file.

Determine 2. Malicious DLL with .XLL extension

When opening such recordsdata, Excel will show a warning in regards to the malicious code it incorporates.

Fig.3. MS Workplace Warning for Plugin

It’s attainable for a “.dll” (dynamic hyperlink library) file to be renamed as a “.xll” (Excel Add-in) and is used for malicious functions. The distinction between a standard DLL file and an XLL file is that XLLs can have sure exported features that will probably be referred to as by the Excel Add-in supervisor if activated by the Excel utility. When Excel begins the XLL file, it would name the export features based mostly on the XLL interface outlined as xlAutoOpen and xlAutoClose just like the strategies auto_open and automotive closed in VBA macros. These features can be utilized to add malicious code and obtain the malware payload.

Technical evaluation:

It begins with a file referred to as “BankStatement-1674745402.xll”, which is a 64-bit DLL file. This file incorporates an export perform with the identify “xlAutoOpen” as proven in determine 4.

Determine-4. DLL export perform

Now we have run this DLL file explicitly utilizing “rundll32.exe” with the parameters,

“C:WindowsSysWOW64rundll32.exe C:UsersuserDesktop9009859256BankStatement-1674745402.xll, xlAutoOpen”.

In determine 5, we will see the execution movement of the method.

Determine-5. Execution Course of Movement

The export perform has code (proven in Determine 6) that makes use of the strcat perform to generate totally different strings which have hyperlinks and instructions for execution. The next perform creates a hyperlink “http[:]//160[.]119[.]253[.]36/filesetup_v17.3.4.zip” and take a look at connecting to this hyperlink to obtain the zip file and reserve it as a “myphotos.zip”.

Determine-6. Code for hyperlink era and connection

After this, PowerShell is used to unzip this zip file to %Temp% folder with under talked about command,

“powershell.exe Develop-Archive –Path “C:UsersuserAppDataLocalTempmypictures.zip” -DestinationPath “C:UsersuserAppDataLocalTemp””

After unzipping we get “configuration_file_v17.3.4” named folder within the %Temp% folder that has the “Assets” folder and “configuration_file_v17.3.4.jpg” file inside.

Determine-7. configuration_file_v17.3.4 folder in Temp

The sources folder has a number of XML recordsdata that comprise dummy information. The attackers put that information on objective to make evaluation exhausting. He “configuration_file_v17.3.4.jpg” will not be a picture file format file. It’s nothing greater than a 32-bit PE file written in .NET language and appears like an installer for the Inno configuration module.

An Inno Setup is a well-liked free set up framework used to create installers for Home windows purposes. It supplies a scripting language that enables builders to customise the set up course of, together with creating shortcuts, registry entries, and different system settings.

Determine-8. “configuration_file_v17.3.4.jpg” file info in Die instrument

This .NET file has 213 strategies (proven in Determine 9) which can be closely obfuscated. We are able to de-obfuscate utilizing de4dot obfuscators To keep away from inverting a .NET utility, the writer has applied a number of strategies to make it harder for any researcher to know the code and logic of the applying.

Determine-9. “.NET Technique Rely”

This “configuration_file_v17.3.4.jpg” file executed utilizing under talked about command,

“cmd.exe /c begin C:UsersuserAppDataLocalTempfilesetup_v17.3.4filesetup_v17.3.4.jpg”

This file makes use of some anti-debugging strategies firstly of execution that are talked about under,

1. OllyDbg is a well-liked debugging instrument that can be utilized to research and modify working packages, together with .NET purposes. One method to detect and forestall debugging utilizing OllyDbg is to examine for the presence of a particular string related to the debugger.

Determine-10. OLLDBG Software Examine

2. Checking the debugger log, which is used to find out if a debugger is hooked up to the method and take applicable motion if one is discovered.

Determine-11. Debugger log examine

3. The IsDebuggerPresent perform is used to detect if a debugger is hooked up to the method or not.

4. The CheckRemoteDebuggerPresent perform is used to detect whether or not a debugger is related to the present course of or a distant course of or not.

Determine-12. IsDebuggerPresent and CheckRemoteDebuggerPresent features

Racoon Stealer V2 is a sort of malware designed to steal confidential info from contaminated programs. It’s able to stealing varied sorts of recordsdata together with .ttf and .xml recordsdata and storing them on the contaminated system. Nevertheless, if the CNC (command and management) server is down, the malware could not be capable of ship the stolen info to the server for exfiltration.

On this situation, the stolen .ttf and .xml recordsdata can stay on the contaminated system till the CNC server turns into accessible. This will probably expose delicate info to the attacker, since they will nonetheless entry the stolen recordsdata on the compromised system.

Quick Therapeutic Safety:

Fast Heal Safety Labs have been actively on the lookout for most of these recordsdata to make sure that all Fast Heal prospects are protected with the next detections.

• Downldr.XllfmAgent.S29349494
• Downldr.XllDanot.S29357788
• Trojan.GenericRl.S24740760
• Trojan.RacoonStealerCiR

Conclusion:

In conclusion, Microsoft plugins can current a possible menace vector for malware like Raccoon Stealer V2. A lot of these malware are designed to steal delicate info from contaminated programs and use Microsoft plug-ins as a way to ship the malware to focus on programs. To mitigate this danger, organizations ought to implement greatest practices for endpoint safety, similar to protecting software program updated, implementing sturdy antivirus and antimalware options, enabling firewalls and different community safety measures, and educating customers. on steps to determine and keep away from social engineering assaults. By taking these steps, organizations can considerably scale back the chance of malware assaults and information theft through Microsoft plug-ins and different potential assault vectors.

IOC:

IP:

160.119.253.242

160.119.253.36

45.93.201.114

URL:

http[:]//160[.]119[.]253[.]36/filesetup_v17.3.4.zip

Malicious DLL file:

ab06eca36c9e011a149ea1625b8ad3629907b2a418ce10fe039870a3d9928bb0

9a652f77b9fba07d04e4021d3f533791bdedf4284fbbc007b4c55fea94a46635

6f74060f131c9034f55349cdeb2b5ebbd73582e6ac9da11c9310892bfdfeba36

5dfa56596b133d080b770e11783b1763da445dc2fef57fe060c87e7b73012308

2d9e90155343ba8f8f8e16c80b1dc62227f607c2ba277491c6f8f384bf5e0499

16522212c1b951ffab57e8f8fa288295cca5d9600e83b74551601246841cae91

0ec2bb5aad17efc7e1e1d8371b04684957684fec8e73df62bd41320bbf517b13

4da00e7d529be457c914b085d66f012c070bf6e3f85675303aa41a7689c08c75

Malicious ZIP file:

59d2403b99c95a057e43dd25e3d58b66331d130b52c19d2919e7966023ede5f6

Expert:

Anjali Raut, Akshay Gaikwad