Word add-in persistence Sample uses the CVE-2017-11882 %temp% dropper method to %APPDATA%\Microsoft\word\startup\w.wll
@blu3_team@ImPureMotion
https://t.co/fupQTmy79W
The decoded portion of the CVE-2017-11882 is "cmd /c start %TEMP%\jjjjjjjjjjjjjjjjjjj.j" which runs the executable and shows a messagebox
with the word "Hacked".
Example:
5c68c0a32a8c59271afe3456430125f77b02b240fe578da6b7f398656f6cf972
This is an early test using a small executable named "jjjjjjjjjjjjjjjjjjj.j".
@blu3_team@ImPureMotion How it works
Apparently embedded objects get stored in %temp% while the document is open and they use the original name. That gives
us a method of "dropping" a known file to a known location. CVE-2017-11882 gives us a method of executing it.
We have recently found samples in the wild using a new method involving CVE-11882 that effectively makes it a dropper.
Apologies if someone has already put this out but we haven't seen it and believe it is important.
@blu3_team@ImPureMotion