First Exploitation of Follina Seen in the Wild

For a few days, "Follina" is generating a lot of noise on the Internet, check our yesterday diary[1] about this new vulnerability if you need more details. It was time to hunt for some samples. For this purpose, I created a simple YARA rule on VT:

import "vt"
rule hunt_0day_msdt
{
    strings:
        $s1 = "!\" TargetMode=\"External\"/>" nocase wide ascii
    condition:
        new_file and all of ($s*) and vt.metadata.file_type == vt.FileType.DOCX
}

The rule is pretty simple but is doing a great job and the amount of false-positive hits are acceptable, thanks to the trailing "!" that must be present at the end malicious URLs found in the documents.

It seems that many security researchers (or redteams, pentesters?) are working on proof-of-concept documents, I detected a lot of documents embedding an URL with RFC1918 IP addresses:

But finally, I received a positive alert. The document was uploaded from Ireland but has a filename with Chinese characters. Google Translate returns the following translations:

Mobile phone room to receive orders - channel quotation - the lowest price on the whole network.docx

Of course, the tactic used in the document is exactly the same but URLs and payload are different:

hxxp://coolrat[.]xyz/Loading.html

The payload:

And the decoded Base64 string:

The malware is still available and I downloaded a copy (SHA256:3206fe87e2874db37239d64779c1f504cfca528cef8f5c2214f8434b392aa25a). It has a VT score of 16/68[2]. The domain to drop the payloads has been registered on May, 23rd 2022.

If not done yet, it's a good time to have a look at the document[3] released by Microsoft to mitigate this vulnerability! 

[1] https://isc.sans.edu/forums/diary/New+Microsoft+Office+Attack+Vector+via+msmsdt+Protocol+Scheme+CVE202230190/28694/
[2] https://www.virustotal.com/gui/file/3206fe87e2874db37239d64779c1f504cfca528cef8f5c2214f8434b392aa25a
[3] https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/

Xavier Mertens (@xme)
Xameco
Senior ISC Handler - Freelance Cyber Security Consultant
PGP Key

I will be teaching next: Reverse-Engineering Malware: Malware Analysis Tools and Techniques - SANS October Singapore 2022

Xme

712 Posts
ISC Handler
May 31st 2022
Hi! I think the first evidence of exploitation dates back around April ( Hash: 710370f6142d945e142890eb427a368bfc6c5fe13a963f952fb884c38ef06bfa). This was mentioned by Kevin Beaumont (@GossiTheDog) in his blog https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e. The CVE that was credited to @CrazymanArmy, who reported it Microsoft back in April, after seeing what appears to be an exploitation of msdt (https://twitter.com/CrazymanArmy/status/1531120929321152512).
Anonymous
I agree with that point. The diary title should be read as “we are now staring to see the first exploitation after the disclosure”.
Xme

712 Posts
ISC Handler

Sign Up for Free or Log In to start participating in the conversation!