Kaspersky Threats — Exploit.MSOffice.CVE-2017-8759.a

Clase: Exploit

Los exploits son programas que contienen datos o códigos ejecutables que aprovechan una o más vulnerabilidades en el software que se ejecuta en una computadora local o remota con fines claramente maliciosos. A menudo, los usuarios malintencionados emplean un exploit para penetrar en la computadora de una víctima para luego instalar un código malicioso (por ejemplo, para infectar a todos los visitantes de un sitio web comprometido con un programa malicioso). Además, los exploits son comúnmente utilizados por Net-Worms para hackear una computadora víctima sin que el usuario requiera ninguna acción. Los programas Nuker son notables entre los exploits; dichos programas envían solicitudes especialmente diseñadas a computadoras locales o remotas, lo que hace que el sistema falle.

Más información

Plataforma: MSOffice

Microsoft Office es un conjunto multiplataforma de aplicaciones de productividad publicado por Microsoft. Las aplicaciones de Office son compatibles con muchos tipos de archivos y contenido.

Familia: Exploit.MSOffice.CVE-2017-8759

No family description

Examples

707484CA98D4FFF73D2919FDE73EFC99
0DB8B18788CED818672928A01B67A67A
264F6CD78923E4165B08ACB85AE2BC0E
C7829B5844F107DF73C0993F0CB35F5A
73FDC19F9B8D72E40E2EF534E8F0F3BF

Tactics and Techniques: Mitre*

TA0001

Initial Access

The adversary is trying to get into your network. Initial Access consists of techniques that use various entry vectors to gain their initial foothold within a network. Techniques used to gain a foothold include targeted spearphishing and exploiting weaknesses on public-facing web servers. Footholds gained through initial access may allow for continued access, like valid accounts and use of external remote services, or may be limited-use due to changing passwords.

T1566.001

Spearphishing Attachment

Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon User Execution to gain execution. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.

TA0002

Execution

The adversary is trying to run malicious code. Execution consists of techniques that result in adversary-controlled code running on a local or remote system. Techniques that run malicious code are often paired with techniques from all other tactics to achieve broader goals, like exploring a network or stealing data. For example, an adversary might use a remote access tool to run a PowerShell script that does Remote System Discovery.

T1204.002

Malicious File

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.

TA0006

Credential Access

The adversary is trying to steal account names and passwords. Credential Access consists of techniques for stealing credentials like account names and passwords. Techniques used to get credentials include keylogging or credential dumping. Using legitimate credentials can give adversaries access to systems, make them harder to detect, and provide the opportunity to create more accounts to help achieve their goals.

T1003.001

LSASS Memory

Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement using Use Alternate Authentication Material.