Security experts from FortiGuard Labs discovered a malicious Powerpoint file in name ADVANCED DIPLOMATIC PROTOCOL AND ETIQUETTE SUMMIT.ppsx using the CVE-2017-0199 Vulnerability.By opening, this malicious PDF file may compromise your system.
CVE-2017-0199 was originally a zero-day remote code execution vulnerability that allowed attackers to use a flaw that exists within the Windows Object Linking and Embedding (OLE) interface of Microsoft workplace to deliver malware.
This vulnerability has been disclosed and patched in last April 2017. This vulnerability triggers an RCE with Microsoft Office or Word with specially crafted files.
Fortigate identified that the flaw is used by attackers in Windows Object Linking and Embedding (OLE) interface of Microsoft Office and gain control over the system.
When the malicious file opened by the user it triggers ppt/slides/_rels/slide1.xml.rels and then it use to download remote code from hxxp://www[.]narrowbabwe[.]net:3345/exp[.]doc.The remote code developers include blank spaces to evade malware detection.
After decoding all the scripts it will read the following registry if it dosesn’t exists it will create them.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Seed0
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Feed0
Then it looks for the network adapter configured to connect with C&C server HTTP POST to hxxp://www[.]narrowbabwe[.]net/comsary/index[.]php to connect and download the malicious payload to establish control over the machine.
Solution From Fortinet
- Apply the patches released by Microsoft in April that covers the CVE-2017-0199 vulnerability.
- FortiGuard Antivirus service detects this threat as
- FortiGuard Web Filtering service blocks all C&C and related URLs.
- FortiSandbox rates the PPSX file as High Risk.