CISA analyzes malicious Word dropper exploiting CVE-2015-1641
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CISA analyzed a Word document weaponizing a five-year-old exploit to drop trojans that establish persistence and communicate to command infrastructure.
CISA's Malware Initial Findings Report (MIFR) documents analysis of a malicious Microsoft Word document (purchaseorderno.89764125.doc) designed to exploit CVE-2015-1641, a memory corruption vulnerability in Word's RTF parsing. Upon execution, the document drops and executes two .NET trojan files (~WRD8811.tmp, ~WRD8912.tmp) sharing the same MD5 hash. The trojan executable (ubndetnj.exe) performs environment detection to identify virtual analysis sandboxes; if detected, it drops copies of itself; if not, it establishes persistence through multiple registry keys, scheduled tasks, and encoded configuration entries in the HKEY_CURRENT_USER hive. The malware creates mutex objects (FireFX variants) for synchronization and establishes command-and-control by resolving the domain indogulf.hopto.org to 104.255.68.92. A companion DLL file injects code into system processes (svchost.exe, dwm.exe, taskhost.exe, slui.exe) for enumeration and execution. The dropper employs anti-analysis techniques and multi-stage execution to evade detection. This report was published in May 2020 based on analysis of submitted samples; there is no attribution or evidence of active in-the-wild exploitation at time of publication.
Mentioned in this report
Detection guidance
Office Application Spawning Executable With .tmp Extension
Word or other Office process launching a process whose image is a .tmp file, as when an exploited document (e.g. CVE-2015-1641) drops and runs a ~WRDxxxx.tmp payload. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Office Application Spawning Executable With .tmp Extension
description: Detects Microsoft Office processes creating a child process whose image
file has a .tmp extension. Exploit documents such as CVE-2015-1641 RTF droppers
write a .NET trojan to a ~WRDnnnn.tmp file and execute it directly. Generalises
on the parent/child relation and the .tmp image, not the specific file names.
tags:
- attack.execution
- attack.t1203
- attack.t1566.001
- attack.t1036.005
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \WINWORD.EXE
- \EXCEL.EXE
- \POWERPNT.EXE
- \OUTLOOK.EXE
Image|endswith: .tmp
condition: selection
falsepositives:
- Rare Office add-in or installer helpers that run a temporary executable with a .tmp
extension
level: high
id: 944ebfd1-c6c4-5fba-9282-3eab1f2d2fee
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-133m
Scheduled Task Created by Process Running From a .tmp File
schtasks.exe /create launched by a parent whose image is a .tmp file, consistent with a dropped trojan establishing persistence via scheduled tasks. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Scheduled Task Created by Process Running From a .tmp File
description: Detects schtasks.exe creating a task when the parent process image is
a .tmp file. A trojan dropped by a malicious Word document and executed from a temp-named
file registers scheduled tasks for persistence. Generalises on the parent image
extension and the /create flag, not the task name.
tags:
- attack.persistence
- attack.execution
- attack.t1053.005
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: .tmp
Image|endswith: \schtasks.exe
CommandLine|contains: /create
filter_inno_setup:
ParentImage|contains: \is-
condition: selection and not filter_inno_setup
falsepositives:
- Installer frameworks that run from a temp .tmp executable and register a scheduled
task
level: high
id: 4cc7005b-6b9a-56fe-aef1-a9b6c9d61957
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-133m
Run Key Persistence Written by a .tmp Executable
A process whose image is a .tmp file writing to a Run or RunOnce autostart registry key, as a Word-dropped .NET trojan does for persistence. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Run Key Persistence Written by a .tmp Executable
description: Detects a process running from a file with a .tmp extension that sets
a value under a CurrentVersion Run or RunOnce key. A trojan dropped by a malicious
Word document (e.g. CVE-2015-1641) persists through multiple registry keys in HKCU.
Generalises on the writer image and autostart key, not value names.
tags:
- attack.persistence
- attack.t1547.001
- attack.t1112
logsource:
category: registry_set
product: windows
detection:
selection:
Image|endswith: .tmp
TargetObject|contains:
- \CurrentVersion\Run\
- \CurrentVersion\RunOnce\
filter_inno_setup:
Image|contains: \is-
condition: selection and not filter_inno_setup
falsepositives:
- Legitimate installers that run from a temporary .tmp executable and register an
autostart entry
level: medium
id: 71fe9595-caeb-50a8-b971-1ce0dea38e17
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-133m
4 more detections for this report are in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/analysis-reports/ar20-133m
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs