Rewterz Threat Alert – Hawkeye Keylogger too Exploits CVE-2017-11882 after Rattlesnake

Severity

High

Analysis Summary

Hawkeye is exploiting an 18-year-old vulnerability in Microsoft Office products using malicious office documents. The HawkEye malware kit and information-stealer has been spotted in a newfound slew of campaigns after a recent ownership change. It comes with special key-logging abilities and anti-detection features. The exploited flaw was discovered and manually fixed by Microsoft in 2017. 

CVE-2017-11882 

Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory, aka “Microsoft Office Memory Corruption Vulnerability”. 

The threat group uses NirSoft utilities to collect credentials. The recent Rattlesnake attack on Pakistan Navy also exploited this vulnerability, indicating that users are still running unpatched versions of the affected products. The vulnerability was also exploited by the Cobalt hackers last year.

Impact

• Credential Theft
• Remote Code Execution
• Memory Corruption
• Information Theft
• Keylogging

Indicators of Compromise

Domain Name

chandelawestafricanltd[.]com

MD5

• 8533c945b368586fe1e08da4d80f83fc
• c4f61a2281c18db830cec5a54a9c2799
• 7573dd8b5409654e0da294851df8b29d
• 159d076b1e872dc3699081dac564c029
• 70c5197ea83262a1568673496fef01ce
• 44b2dd31e8f2db620f35507fa68ebd6a
• 2c72dcda462a940cc4f079528c39fa52
• 5a42bc20ce4c2cd22b039871fdf8d6f7

SH256

• ca691249fc974266ee192fc81d993db419770095497fa58913219c06bc58a368
• 4a79e69a9723f42b6a9c6650937bbd819cf1bbcddb568a158f8c0340b943e16f
• d002a44fe33daa2f36d42be9b60ba0d974ecc9d83c0dd6bd5fe89a91ae3abde4
• 58731429bd5104f9e978c51b11dccc6a8d0a1c02cc01b3b9998859acdf63fd13
• 1b2d88edb315682c56e11b08fef4043e01277dca325e0780aaa07aec93448581
• 577c6219426df48ec8a2f3979b8c716604bd9623c798bfd4d9879b440f8cf2db
• dcc9af2b8052158b8e3323a3b0b377a2024dd7e4498a0be7d9fc56fb5cf2f2a6
• 700933c9c1b4e12bdaf76921e85595eea68d5b479c0af6e6709e71edde5b57ff

SHA1

• 54726c1276e6b64ec137cb3a120af1eae429347c

Source IP

• 66[.]117[.]14[.]246
• 66[.]171[.]248[.]178

URL

hxxp[:]//chandelawestafricanltd[.]com/image/obo/obxi[.]exe

Remediation

• Block the threat indicators at their respective controls.
• Immediately update Microsoft Office products to latest patched versions.
• Do not download files attached in untrusted emails.