Severity
High
Analysis Summary
MuddyWater (aka SeedWorm/Temp.Zagros) is a high-profile Advanced Persistent Threat (APT) state sponsored actor. The group was first observed in 2017, and since has operated multiple global espionage campaigns. With that in mind, their most significant operations mainly focus on Middle Eastern and Middle Asian nations.
The group targets a wide gamut of sectors, including governmental, military, telecommunication, and academia. In the past months, Clearsky had monitored and detected malicious files of each one of these TTPs – decoy Microsoft software with embedded Macros4, and documents exploiting vulnerability CVE-2017-01995 . This is the first time MuddyWater has used these two vectors in conjunction.
Attack Vector 1 – Malicious Macros
It appears that in the recent campaign, the group returned to use (in certain cases) compromised servers. They leveraged the servers to host malicious code segment used in the second stage of the attacks; similar to previous operations. Concurrently we identified several files by MuddyWater that targeted various entities in Tajikistan while using the group’s classic attack vector – a malicious VBA macro.
The file, named ‘UNDP_TJK_Agreement_ORGS.doc’, was disguised as an official document of a UN development plan in Tajikistan. After opening the document, a VBS file is created. It is encoded with multiple VBE, JavaScript, and Base64 layers; similar to previous attack vectors by MuddyWater. The malware’s second stage is downloaded from IP address 185[.]244[.]149[.]218.
Attack Vector 2 – CVE-2017-0199
This vulnerability in Microsoft Office allows remote attackers to execute arbitrary code via a crafted document, aka “Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API8 .
Indicators Of Compromise
IP(s) / Hostname(s)
- 66[.]219[.]22[.]235
- 83[.]171[.]238[.]62
- 185[.]185[.]25[.]175
- 185[.]244[.]14[.]218
URLs
- http[:]//185[.]185[.]25.175/ref45[.]php
- http[:]//185[.]185[.]25[.]175/sDownloads/
- http[:]//185[.]185[.]25[.]175/upl[.]php
Filename
UNDP_TJK_Agreement_ORGS.doc
Malware Hash (MD5/SHA1/SH256)
- 0a9d295016417b00457d4a031b5c52eea41bcde3465ac517767d8795a6a213eb
- 10157ab25bab7891068538111333a2101b987e930d5deb7bb60ed63cf7ca197d
- 1dae45ea1f644c0a8e10c962d75fca1cedcfd39a88acef63869b7a5990c1c60b
- 200c3d027b2d348b0633f8debbbab9f3efc465617727df9e3fdfa6ceac7d191b
- 20bf83bf516b12d991d38fdc014add8ad5db03907a55303f02d913db261393a9
- 4fe389bc1ea85896b4ebb6fe26aa40a6e3f8e9ca
- 592f0d9d7185eadab0509fdafdc305ab
- 65978dd3d6b3a518f465676aa6bd876e
- 6cb076f1f42573c5c43083a89bcfe442
- 8d1464e0cac7ea8f37e83fd142212c95db20fe77
- 951585840a07a6496b0270f1028281fcb65d5b9e9a6ed613ca8809b258ed729f
- 98f0f2c42f703bfbb96de87367866c3cced76d5a8812c4cbc18a2be3da382c95
- bb6fda2cdc852112544d2598a784d04f
- bb6fda2cdc852112544d2598a784d04f
- d5b7a5ae4156676b37543a3183df497367429ae2d01ef33ebc357c4bdd9864c3
- d77d16c310cce09b872c91ca223b106f4b56572242ff5c4e756572070fac210f
- e2867e2255cad213fcc5752a7062882e92870c57
- f5ef4a45e19da1b94c684a6c6d51b86aec622562c45d67cb5aab554f21eb9061
Remediation
Block threat indicators at your respective controls.